Specifying security requirements for web workloads, including Azure App Service

Many storage accounts and data workloads have an application in front of them that accesses and utilizes that data. This may be for an internal application for employees to access company information or it could be a web application for the company website where the public views and purchases company products. In either situation, the web workloads should be secured and access to data should be protected. Some security requirements that should be recommended are as follows:

• Apps should use a secure encrypted transmission through HTTPS, which is a default setting within Azure App Service. You should disable any HTTP transmission and accessibility. Azure Key Vault can be used to manage the TLS certificates and renew them before they expire.
• Azure App Service should create static IP restrictions to only allow requests from trusted subsets of IP addresses. App Service accepts requests from other...