# Ensure ‘HTTP/2’ is Enabled (‘HTTP20Enabled’ set to ‘true’) for Azure Web Apps and App Services (If in Use)

- Source: https://support.icompaas.com/support/solutions/articles/62000234766-ensure-http-2-is-enabled-http20enabled-set-to-true-for-azure-web-apps-and-app-services-if-in
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Azure Compute Services Benchmarks V1.0.0](https://support.icompaas.com/support/solutions/62000112692) › [CIS Azure compute Services](https://support.icompaas.com/support/solutions/folders/62000169260)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### Profile Applicability:

-   **Level 1**

### Description:

This check ensures that the web app hosted in Azure App Service has HTTP/2 enabled. HTTP/2 is a major revision of the HTTP network protocol that provides improvements over HTTP/1.x, including better performance, multiplexing, and header compression. Enabling HTTP/2 ensures faster page loads and a more efficient transfer of web resources.

### Rationale:

HTTP/2 offers several advantages over HTTP/1.x, such as multiplexing multiple requests over a single connection, which reduces latency and improves the overall speed of web applications. By enabling HTTP/2, applications benefit from faster load times, lower bandwidth usage, and enhanced performance, especially for complex web pages with many resources. This is important for both user experience and SEO.

### Impact:

Pros:

-   Improves the speed and efficiency of web applications.  
    
-   Reduces the number of connections required to transfer multiple resources, improving load times.  
    
-   Can improve SEO rankings due to faster page load times.  
    
-   Supports modern features like header compression and multiplexing.  
    

Cons:

-   Some older clients or browsers may not support HTTP/2, leading to compatibility issues.  
    
-   May require additional configuration and testing to ensure compatibility with legacy systems.  
    

### Default Value:

By default, Azure App Service enables HTTP/2 for SSL/TLS connections if the app uses a custom domain with an SSL certificate. For HTTP connections, it needs to be manually enabled.

### Pre-requisites:

Ensure that the app uses HTTPS and has an SSL certificate properly configured, as HTTP/2 only works with secure connections.

### Test Plan:

Using Azure Console:

1.  Log in to the Azure portal at [https://portal.azure.com](https://portal.azure.com/).  
    
2.  Go to the App Services blade.
    
3.  Select the app you want to review.  
    
4.  Under the Settings section, click on TLS/SSL settings.  
    
5.  Check if HTTP/2 is enabled by confirming that HTTP20enabled is set to true under the General Settings section.
    

Using Azure CLI:

To check if HTTP/2 is enabled, run the following command:

az webapp config show --resource-group <RESOURCE\_GROUP\_NAME> --name <APP\_NAME> --query "http20Enabled"

1.  The output should return true if HTTP/2 is enabled.
    

### Implementation Plan:

Using Azure Console:

1.  Log in to the Azure portal at [https://portal.azure.com](https://portal.azure.com/).  
    
2.  Go to App Services.  
    
3.  Select the app for which you want to enable HTTP/2.  
    
4.  Under the Settings section, click on TLS/SSL settings.  
    
5.  In the General Settings section, set HTTP20enabled to true.  
    
6.  Click Save to apply the changes.
    

Using Azure CLI:

To enable HTTP/2, run the following command:

az webapp config set --resource-group <RESOURCE\_GROUP\_NAME> --name <APP\_NAME> --http20-enabled true

### Backout Plan:

Using Azure Console:

1.  Log in to the Azure portal at [https://portal.azure.com](https://portal.azure.com/).  
    
2.  Go to App Services.  
    
3.  Select the app for which you want to disable HTTP/2.  
    
4.  Under the Settings section, click on TLS/SSL settings.  
    
5.  In the General Settings section, set HTTP20enabled to false.  
    
6.  Click Save to apply the changes.
    

Using Azure CLI:

To disable HTTP/2, run the following command:

az webapp config set --resource-group <RESOURCE\_GROUP\_NAME> --name <APP\_NAME> --http20-enabled false

### References:

-   [Azure App Service: Enable HTTP/2  
    ](https://docs.microsoft.com/en-us/azure/app-service/overview-http2)
    
-   [https://developers.google.com/web/updates/2015/09/behind-the-scenes-http2](https://developers.google.com/web/updates/2015/09/behind-the-scenes-http2)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.