How to find web apps without HTTPS Only in Azure

Before you start

Use an Azure account with at least read access to the subscriptions you want to check, such as the built-in Reader role assigned at the subscription or a parent scope. Resource Graph is a free service, and the examples need no further licence. The PowerShell example uses Az.Accounts and Az.ResourceGraph. It reads Azure and exports a CSV, and it changes no app. Its finally block disconnects the account and removes its local Azure contexts, so you may need to sign in again afterwards.

Resource Graph keeps a copy of each app's properties, indexed with a short delay, so a setting changed a moment ago may not show yet. A property can also be missing from the copy. An app with no value for httpsOnly is listed with the apps that have it off, so check it in its own settings.

Option 1

Find web apps without HTTPS Only with PowerShell

Install the modules once and connect to Azure. The query lists every App Service site where httpsOnly is not true.

Install-Module -Name Az.Accounts, Az.ResourceGraph -Repository PSGallery -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-AzAccount -ErrorAction Stop
try {
    $subscriptionIds = @(
        Get-AzSubscription |
        Where-Object State -eq 'Enabled' |
        Select-Object -ExpandProperty Id
    )
    if ($subscriptionIds.Count -eq 0) {
        Write-Output 'No enabled subscriptions are available to this account.'
        return
    }
    $query = @(
        'Resources'
        '| where type =~ "microsoft.web/sites"'
        '| extend httpsOnly = tostring(properties.httpsOnly)'
        '| where httpsOnly != "true"'
        '| project id, name, resourceGroup, subscriptionId, kind, location,'
        '    state = tostring(properties.state),'
        '    hostName = tostring(properties.defaultHostName), httpsOnly'
        '| order by id asc'
    ) -join ' '
    function Get-AzGraphRows {
        param([string]$Query, [string[]]$SubscriptionIds)
        $results = [System.Collections.Generic.List[object]]::new()
        $skipToken = $null
        do {
            $arguments = @{
                Query = $Query
                Subscription = $SubscriptionIds
                First = 1000
            }
            if ($skipToken) { $arguments.SkipToken = $skipToken }
            $page = Search-AzGraph @arguments
            foreach ($record in $page.Data) { $results.Add($record) }
            $skipToken = $page.SkipToken
        } while ($skipToken)
        return $results.ToArray()
    }
    $rows = @(Get-AzGraphRows -Query $query -SubscriptionIds $subscriptionIds)
    if ($rows.Count -eq 0) {
        Write-Output 'No web apps without HTTPS Only were found in the indexed resources.'
    } else {
        $rows | Select-Object name, resourceGroup, subscriptionId, kind, location, state,
            hostName, httpsOnly, id |
            Export-Csv -Path './web-apps-without-https-only.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($rows.Count) apps saved to web-apps-without-https-only.csv."
    }
} finally {
    Disconnect-AzAccount | Out-Null
}

The export holds each app's name, resource group, subscription, kind, location, state, host name, httpsOnly value and full resource ID. The kind column tells a function app from a web app. A value of false means the setting is off, and a blank means Resource Graph holds no value. An empty result prints a message.

To narrow the search, keep only the subscription IDs you want in $subscriptionIds. The query keeps id in the output because Azure only returns a continuation token when it is there.

Option 2

Review web apps without HTTPS Only in Azure Resource Graph Explorer

1. Sign in to the Azure portal with read access to the subscriptions.
2. Search for resource graph > choose Resource Graph Explorer.
3. To change its scope, choose Directory, then choose the directory, management group or subscription to query.
4. Paste this query in Query 1 and choose Run query:
   KQL

   Resources
   | where type =~ "microsoft.web/sites"
   | extend httpsOnly = tostring(properties.httpsOnly)
   | where httpsOnly != "true"
   | project id, name, resourceGroup, subscriptionId, kind, location,
       state = tostring(properties.state),
       hostName = tostring(properties.defaultHostName), httpsOnly
   | order by id asc

5. Review the apps in Results, or choose Download as CSV to keep them.

To check 1 app instead, search for App Services, choose the app, then choose Settings > Configuration > General settings and read HTTPS Only. That page can also change the setting, so leave it unsaved if you only wanted to look. Explorer suits an occasional check of many apps. Use PowerShell when you need a repeatable CSV or automatic paging.

Common questions

Why does an app with HTTPS Only off still open over HTTPS?

The default azurewebsites.net address of an app already works over HTTPS. HTTPS Only adds the redirect, so a request to the HTTP address is sent to the HTTPS one. Without it, that request is not redirected.

Does the result include function apps and deployment slots?

Function apps run as sites and appear in the result, with their kind in the kind column. Deployment slots are separate resources, of type microsoft.web/sites/slots. Neither the query nor the Altivane report includes them.

Can the same approach find other Azure resources?

Yes. Resource Graph answers questions about other resources in the same way. For an example, see how to find unused public IP addresses in Azure.