Deny policy

Hi @moti jirata

It looks like your custom deny policy for enforcing a minimum TLS version on App Service is not actually firing, so you are still able to drop your minTlsVersion down to 1.0. Here are the most common reasons this happens and

what you can check or tweak:

1. Policy target type / operation mismatch • Your “if” block is scoped to the resource type “Microsoft.Web/sites/config” but when you update TLS via the portal or CLI you’re often hitting “Microsoft.Web/sites/write” on the parent resource. • The policy never actually evaluates because it only watches the child‐resource type. → Try adding or changing your “if” to also catch calls against type == 'Microsoft.Web/sites' and then inspect the nested property alias.

Property alias is incorrect • The built-in App Service TLS policy uses the alias Microsoft.Web/sites/config/minTlsVersion (no “web.” prefix) or the ARM path siteConfig.minTlsVersion. • If your policy is checking Microsoft.Web/sites/config/web.minTlsVersion, it won’t match. → Update your rule to use the correct alias:

"field": "Microsoft.Web/sites/config/minTlsVersion"

Enforcement delay or disabled assignment • New or updated policy assignments can take up to one hour before the deny effect kicks in. • Make sure your assignment’s Enforcement is set to Enabled and your effect is Deny. → In the Azure portal, go to Policy → Assignments → select your assignment → Properties.

Exemption or higher-priority policy • Check for any policy exemptions at the resource or resource-group level that might override your deny. → In the portal view your assignment, scroll to “Exemptions” and remove/reset as needed.

No policy evaluation errors in Activity Log • If your policy did trigger, you’d see a RequestDisallowedByPolicy with a 403 in the Activity Log. → Look under Azure Monitor → Activity Log, filter for “Failed” and your resource name.

What to try next

1. Update your JSON rule to something like:

"if": {
 "allOf": [
 {
 "anyOf": [
 {
 "field": "type",
 "equals": "Microsoft.Web/sites/config"
 },
 {
 "field": "type",
 "equals": "Microsoft.Web/sites"
 }
 ]
 },
 {
 "field": "kind",
 "notContains": "functionapp"
 },
 {
 "anyOf": [
 {
 "field": "Microsoft.Web/sites/config/minTlsVersion",
 "exists": false
 },
 {
 "field": "Microsoft.Web/sites/config/minTlsVersion",
 "less": "[parameters('minimalTlsVersion')]"
 }
 ]
 }
 ]
},
"then": {
 "effect": "[parameters('effect')]"
}

1. Wait ~1-hour after re-assignment and then try again.
2. Verify there’s no exemption in place.
3. Attempt the update again and watch for a 403 in the Activity Log.

Kindly review the following documents for your reference:

Please refer to the following documents

List of built-in policy definitions - Azure Policy | Microsoft Learn

Request disallowed by policy error - Azure Resource Manager | Microsoft Learn

If you find the answer helpful, please click "upvote" and accept it. This will help others in the community with similar questions easily find the solution.

Hello moti jirata

Greetings! Thanks for raising this question in Q&A forum.

Great question! Your policy definition looks structurally correct, but there are a few common reasons why a Deny policy like this doesn't actually block a change to minTlsVersion 1.0. Let me explain each one clearly and walk you through how to fix it.

Reason 1: The Effect Parameter May Be Overridden at Assignment

Your policy uses "effect": "[parameters('effect')]" which means the actual effect is determined at the time of assignment, not hardcoded in the definition. If the policy was assigned with the effect set to Audit or Disabled instead of Deny, it will not block anything it will only log non-compliance. Go to Azure Portal → Policy → Assignments, find your assignment, click on it, and check what value the effect parameter is set to. Make sure it is set to Deny.

Reason 2: Enforcement Mode May Be Set to DoNotEnforce

Even if the effect is set to Deny, the assignment has an enforcementMode setting. If this is set to DoNotEnforce, the policy will evaluate and report non-compliance but will NOT block any requests. Go to your policy assignment in the portal, click Edit assignment, scroll down to Enforcement mode, and make sure it is set to Enabled (not DoNotEnforce).

Reason 3: The Policy Scope May Not Cover Your App Service Resource

A Deny policy only applies to resources within the scope it is assigned to. If the policy is assigned at a resource group or subscription that does not contain your App Service, it won't apply. Confirm that your App Service is inside the subscription or resource group where the policy assignment is scoped.

Reason 4: The Field Path for minTlsVersion May Not Match Exactly

The condition in your policy checks Microsoft.Web/sites/config/web.minTlsVersion. However, Azure Policy evaluates Microsoft.Web/sites/config resources and their nested properties. It is worth double-checking by using the Azure Resource Explorer at https://resources.azure.com navigate to your App Service → config → web and confirm the exact property path returned. If the property is exposed differently (for example, as minTlsVersion directly under properties rather than under web), the condition won't match and the Deny won't fire.

Reason 5: The kind Condition May Be Excluding Your Resource

Your policy has "field": "kind", "notContains": "functionapp". Make sure your App Service is not of a kind that unexpectedly matches or mismatches this condition. For a standard Web App, the kind field is typically just app, so this should be fine but it is worth verifying by checking the resource in Azure Resource Explorer.

Step to Quickly Validate the Policy is Working

To confirm the policy is evaluating correctly, go to Azure Portal → Policy → Compliance, find your policy assignment, and check the compliance state of your App Service. If it shows as Non-compliant, the policy is evaluating it correctly but may not be blocking due to enforcement mode or effect setting. If it shows as Compliant or Not started, there may be a scope or condition match issue.

Once you set effect = Deny and enforcementMode = Enabled on the assignment, any attempt to set minTlsVersion to 1.0 on a Web App (non-function app) will be blocked with a 403 Forbidden response at request time.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix.