How to determine which TLS version is used between an Azure resource and a client ?

Question

How to determine which TLS version is used between an Azure resource and a client ?

Maureen Gavroy (Belfius) 40

Hi,

I’m currently working on a project to upgrade our Azure resources from TLS 1.2 to TLS 1.3. I know some resources already support TLS 1.3 as a minimum version, but I’m a bit hesitant to enforce it without being sure it won’t break anything.

I thus need to know for each resources, the TLS version used between the client and the resource. I’ve been digging through the logs, but they don’t seem to show which TLS version is actually being used for client-resource connections. Do you know if there’s a specific log or tool I could use to check this? Or maybe another way to test compatibility before making the switch?

Any advice would be really helpful!

Thanks, Maureen

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello @Maureen Gavroy (Belfius) ,

Welcome to Microsoft Q&A!

There isn't a single Azure Monitor log that shows the negotiated TLS version for every Azure resource. The TLS version is negotiated between the client and the service endpoint, and the available telemetry depends on the specific Azure service.

Test from the actual client/application against the resource endpoint and explicitly test TLS 1.2 and TLS 1.3.

For example, from a machine with OpenSSL:

openssl s_client -connect <hostname>:443 -tls1_2
openssl s_client -connect <hostname>:443 -tls1_3

A successful handshake with -tls1_3 confirms that the client and endpoint can negotiate TLS 1.3.

Check the client OS/runtime. The TLS version used by applications can depend on the operating system and runtime. Microsoft specifically notes that Azure Monitor/Application Insights does not control the TLS version used by HTTPS connections.

Check the specific Azure service's TLS configuration and supported versions before changing the minimum TLS version. Support for TLS 1.3 is not uniform across all Azure services.

If the resource is behind Application Gateway, Front Door, API Management, or another TLS-terminating service, test each TLS termination point separately. The client-to-frontend TLS connection and frontend-to-backend connection can use different TLS versions.

Azure Network Watcher can help validate connectivity and the network path, but it does not generally report the negotiated TLS version.

So, for your migration, I would not rely solely on Azure Monitor logs. Build a small compatibility test from representative clients, test TLS 1.3 explicitly, and then raise the minimum TLS version after confirming that all required clients successfully negotiate it.

References:

Application Insights FAQ – TLS support

Azure Network Watcher – Connection Troubleshoot

I hope this helps. If you have any further questions, please feel free to let us know.

If this answer helped resolve your question, please consider accepting it as the answer. This helps other members of the community find the information more easily.