Test a Storage request before declaring its minimum TLS policy ineffective

Source facts

Azure Storage checks the account’s minimum TLS version at the application layer. Microsoft warns that protocol-level scanning can report additional versions even when the account has a higher minimum.

A connection to the public endpoint can succeed before the request fails the account’s version check. Microsoft documents HTTP 400 with a message identifying the prohibited TLS version for a request below the configured minimum. Microsoft Learn.

Applicability

Identify the storage account, configured minimum, client protocol and actual endpoint used by the test. Keep this service-specific enforcement model separate from how another TLS server implements its negotiation policy.

DSE recommendation

DSE recommends retaining both the scanner observation and an application request result. Review the storage account setting directly, then use a controlled client test appropriate to the current supported protocol options. Do not weaken the account policy merely to reconcile a scanner’s interpretation. If an older-version test cannot be performed safely, record that verification limitation explicitly.

Verification

Compare an authorized request using an allowed version with an approved below-minimum test where available. Capture the HTTP status and explanatory response without recording credentials or data unnecessarily. Confirm the test targets the intended account and not an intermediary. Close the finding from configuration and request-level evidence together, rather than treating successful TLS negotiation as proof that the account accepted the operation.

Official references

Microsoft Learn: Enforce a Minimum Required Version of Transport Layer Security (TLS). Source retrieved September 9, 2026.