{"id":59666,"date":"2026-11-09T11:02:19","date_gmt":"2026-11-09T01:02:19","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/09\/post-quantum-tls-on-azure-app-service-and-functions-explained\/"},"modified":"2026-11-09T11:04:29","modified_gmt":"2026-11-09T01:04:29","slug":"post-quantum-tls-on-azure-app-service-and-functions-explained","status":"publish","type":"post","link":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/09\/post-quantum-tls-on-azure-app-service-and-functions-explained\/","title":{"rendered":"Post-Quantum TLS on Azure App Service and Functions Explained"},"content":{"rendered":"\n

In this blog post Post-Quantum TLS on Azure App Service and Functions Explained we will examine why encrypted traffic that appears safe today may still create a long-term data risk, what Microsoft has changed and what CIOs should do next.<\/p>\n\n\n\n\n\n\n\n

The immediate concern is not that quantum computers are breaking business encryption today. It is that an attacker could collect encrypted traffic now, retain it and try to decrypt it years later when more powerful quantum computers become available.<\/p>\n\n\n\n

This matters when your applications process information that must remain confidential for a long time. Health records, legal documents, financial data, government information, intellectual property and customer identities are all potential targets.<\/p>\n\n\n\n

What post-quantum TLS means in plain English<\/h2>\n\n\n\n

Transport Layer Security, or TLS, creates the secure connection between a device and an online application. It provides the familiar browser padlock and stops someone monitoring the network from easily reading or changing information in transit.<\/p>\n\n\n\n

Before information can be exchanged, the device and Azure perform a digital handshake. This handshake creates temporary secret keys that are used to encrypt the session.<\/p>\n\n\n\n

Traditional handshakes rely on mathematical problems that are difficult for today\u2019s computers. A sufficiently capable quantum computer could potentially solve some of those problems much faster.<\/p>\n\n\n\n

Post-quantum TLS changes the key-establishment part of the handshake. Azure now combines a conventional method with ML-KEM, a newer method designed to resist attacks from both conventional and quantum computers.<\/p>\n\n\n\n

This is known as a hybrid key exchange. It avoids abandoning proven security overnight while adding another layer intended to withstand future quantum attacks.<\/p>\n\n\n\n

What Microsoft has changed<\/h2>\n\n\n\n

As of November 2026, Azure App Service supports hybrid post-quantum key exchange for compatible TLS 1.3 clients in the public Azure cloud. App Service is Microsoft\u2019s managed platform for hosting websites, web applications and application programming interfaces, commonly called APIs.<\/p>\n\n\n\n

Azure Functions hosted on the standard App Service infrastructure also receive this capability. Azure Functions runs small pieces of code in response to events, such as submitting a form, processing an order or receiving data from another system.<\/p>\n\n\n\n

For compatible connections, Microsoft handles the new handshake at the App Service front end, which is the Azure-managed entry point receiving internet traffic before it reaches your application code.<\/p>\n\n\n\n

In practical terms, most organisations do not need to rewrite their applications or purchase a special post-quantum certificate. Compatible devices can negotiate hybrid protection automatically, while incompatible devices continue using an approved conventional connection.<\/p>\n\n\n\n

Custom domains are supported as well. The capability strengthens the key exchange and does not require a new type of website certificate.<\/p>\n\n\n\n

Why Azure Functions needs a closer look<\/h2>\n\n\n\n

The phrase \u201cAzure Functions supports post-quantum TLS\u201d needs context. It applies when the Function App uses App Service front ends to receive an HTTPS request.<\/p>\n\n\n\n

Functions running on Azure Container Apps use a different entry point and are not covered by this App Service capability. Non-HTTP functions, such as code triggered only by a queue or timer, also have a different traffic path to assess.<\/p>\n\n\n\n

CIOs should therefore avoid accepting a simple \u201cyes, Functions is protected\u201d answer. Ask which hosting model is in use, which endpoints are publicly accessible and where TLS connections start and finish.<\/p>\n\n\n\n

Post-quantum protection applies to individual connections<\/h2>\n\n\n\n

Many Azure applications contain several separate encrypted connections. Protecting one does not automatically protect the others.<\/p>\n\n\n\n

User device -&gt; Azure App Service front end -&gt; Application code -&gt; Database or external API<\/code><\/pre>\n\n\n\n
The new App Service capability protects the first connection when the user\u2019s device supports the required TLS 1.3 hybrid method. It does not automatically prove that outbound calls from the application to databases, payment platforms or other APIs use post-quantum protection.<\/p>\n\n\n\n
Outbound security depends on the application runtime, operating system, software library and destination service. These dependencies need their own review.<\/p>\n\n\n\n
The same principle applies when Azure Front Door sits in front of the application:<\/p>\n\n\n\n
User device -&gt; Azure Front Door -&gt; App Service or Function App<\/code><\/pre>\n\n\n\n
Those arrows represent two separate TLS sessions. Our plain-English guide to post-quantum TLS on Azure Front Door explains the first connection in more detail.<\/p>\n\n\n\n
The connection from Front Door to the application origin must still be reviewed separately. Teams should also prevent users from bypassing Front Door and accessing the App Service endpoint directly where the architecture requires all traffic to pass through the edge security controls.<\/p>\n\n\n\n
What this capability does not solve<\/h2>\n\n\n\n
Post-quantum TLS is useful, but it is not complete quantum readiness.<\/p>\n\n\n\n
    \n
  • It does not make every client compatible.<\/strong> The browser, application or device must support TLS 1.3 and the compatible hybrid key exchange.<\/li>\n
  • It does not protect stored data.<\/strong> Database records, backups, file storage and archived documents require separate encryption and key-management planning.<\/li>\n
  • It does not make certificate signatures post-quantum.<\/strong> The website certificate may still use conventional digital signatures even when the session uses hybrid key exchange.<\/li>\n
  • It does not secure every internal connection.<\/strong> Each connection between gateways, applications, APIs and databases must be assessed.<\/li>\n
  • It does not replace normal security controls.<\/strong> Identity protection, patching, access restrictions, Microsoft Defender and web application firewalls remain essential.<\/li>\n<\/ul>\n\n\n\n
    Organisations protecting private keys separately should also understand the difference between key exchange and key storage. Our article on how keyless TLS raises the bar for Azure web application security covers that part of the security model.<\/p>\n\n\n\n
    Do not force TLS 1.3 without testing<\/h2>\n\n\n\n
    Azure App Service supports TLS 1.3, while new applications generally use TLS 1.2 as their minimum accepted version. A minimum of TLS 1.2 does not prevent a modern client from negotiating TLS 1.3.<\/p>\n\n\n\n
    Raising the minimum to TLS 1.3 can improve consistency, but it can also disconnect older business systems, embedded devices, integration partners and legacy software. That can turn a security improvement into an operational outage.<\/p>\n\n\n\n
    Test client compatibility before making TLS 1.3 mandatory. Pay particular attention to mobile applications, warehouse devices, payment integrations, older Windows systems and third-party services that call your APIs.<\/p>\n\n\n\n
    Teams should also identify any applications that still permit TLS 1.0 or 1.1. Microsoft plans to stop accepting these older versions for inbound App Service and Function connections on 31 May 2027, so this work should already be on the retirement plan.<\/p>\n\n\n\n
    A practical business scenario<\/h2>\n\n\n\n
    Consider a 200-person healthcare services company with a customer portal hosted on App Service. The portal sits behind Azure Front Door, sends documents to storage and calls an external billing platform.<\/p>\n\n\n\n
    Enabling hybrid protection at Front Door helps secure the customer\u2019s connection to the edge. App Service support can strengthen compatible direct inbound connections, but it does not automatically confirm post-quantum protection between every component.<\/p>\n\n\n\n
    The correct response is not an expensive rebuild. It is to map the traffic paths, restrict any unnecessary public endpoints, test client compatibility and prioritise the records that must remain confidential for ten or more years.<\/p>\n\n\n\n
    The business outcome is a defensible transition plan without unnecessary disruption or spending.<\/p>\n\n\n\n
    Five questions CIOs should ask now<\/h2>\n\n\n\n
      \n
    1. Which App Services and Function Apps handle long-lived sensitive data?<\/strong> Start with health, financial, legal, identity and intellectual property systems.<\/li>\n
    2. Are the Function Apps using App Service hosting or Azure Container Apps?<\/strong> The answer changes which platform entry point must be assessed.<\/li>\n
    3. Which users and systems currently connect with TLS 1.3?<\/strong> Measure compatibility instead of assuming every modern-looking device supports the same features.<\/li>\n
    4. Where does TLS terminate?<\/strong> Document Front Door, gateways, App Service, APIs, databases and external providers as separate connections.<\/li>\n
    5. Can the team prove hybrid negotiation?<\/strong> Configuration screenshots alone are not enough. Use controlled testing and retain evidence for security and risk reviews.<\/li>\n<\/ol>\n\n\n\n
      How this fits Australian security planning<\/h2>\n\n\n\n
      Post-quantum TLS is not a shortcut to Essential Eight compliance. The Essential Eight is the Australian Government\u2019s set of baseline strategies for reducing common cyber risks, including patching, multi-factor authentication, application control and reliable backups.<\/p>\n\n\n\n
      Post-quantum planning complements those controls rather than replacing them. Australian Signals Directorate guidance encourages organisations to identify where public-key cryptography is used, assess how long protected data remains valuable and build a staged transition plan.<\/p>\n\n\n\n
      The sensible goal for 2026 is crypto-agility, meaning the ability to change encryption methods without rebuilding the entire business system. An accurate inventory and clear ownership are more valuable than rushing to enable every new feature.<\/p>\n\n\n\n
      What leaders should do next<\/h2>\n\n\n\n
      Microsoft\u2019s App Service and Functions update is a useful step because much of the work happens in the managed Azure platform. For compatible inbound connections, organisations can gain stronger long-term protection without rewriting application code.<\/p>\n\n\n\n
      The main risk is overestimating what has been achieved. Hybrid key exchange protects a specific part of a specific connection. It does not automatically cover stored data, outbound traffic, certificate signatures or every service behind the application.<\/p>\n\n\n\n
      CloudProInc combines more than 20 years of enterprise IT experience with hands-on work across Azure, Microsoft 365, Defender and Wiz. As a Melbourne-based Microsoft Partner and Wiz Security Integrator, we help organisations map these connections, identify meaningful gaps and plan changes without turning quantum readiness into an oversized technology project.<\/p>\n\n\n\n
      If you are unsure which of your Azure applications already benefit from post-quantum TLS, or where sensitive traffic remains exposed, we are happy to take a practical look with you \u2014 no strings attached.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"
      Microsoft has added post-quantum protection to Azure App Service and Functions. Learn what it protects, where gaps remain and what CIOs should ask their teams to check.<\/p>\n","protected":false},"author":1,"featured_media":59668,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[51,19,13,127],"tags":[],"class_list":["post-59666","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-app-service","category-azure-security","category-blog","category-cloud-security"],"jetpack-related-posts":[{"id":59622,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/07\/a-plain-english-guide-to-post-quantum-tls-on-azure-front-door\/","url_meta":{"origin":59666,"position":0},"title":"A Plain-English Guide to Post-Quantum TLS on Azure Front Door","author":"CPI Staff","date":"November 7, 2026","format":false,"excerpt":"Azure Front Door can now protect customer-facing connections with hybrid post-quantum TLS. Here is what changed, what remains exposed and how security leaders should respond.","rel":"","context":"In "Azure Security"","block_context":{"text":"Azure Security","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-security\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/11\/a-plain-english-guide-to-post-quantum-tls-on-azure-front-door.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/11\/a-plain-english-guide-to-post-quantum-tls-on-azure-front-door.png 1x, \/wp-content\/uploads\/2026\/11\/a-plain-english-guide-to-post-quantum-tls-on-azure-front-door.png 1.5x, \/wp-content\/uploads\/2026\/11\/a-plain-english-guide-to-post-quantum-tls-on-azure-front-door.png 2x, \/wp-content\/uploads\/2026\/11\/a-plain-english-guide-to-post-quantum-tls-on-azure-front-door.png 3x, \/wp-content\/uploads\/2026\/11\/a-plain-english-guide-to-post-quantum-tls-on-azure-front-door.png 4x"},"classes":[]},{"id":59646,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/08\/post-quantum-tls-on-azure-front-door-what-leaders-should-do-now\/","url_meta":{"origin":59666,"position":1},"title":"Post-Quantum TLS on Azure Front Door What Leaders Should Do Now","author":"CPI Staff","date":"November 8, 2026","format":false,"excerpt":"Azure Front Door now supports hybrid post-quantum TLS. Learn what it protects, where gaps remain and the practical steps Australian security leaders should take now.","rel":"","context":"In "Azure Security"","block_context":{"text":"Azure Security","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-security\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/11\/post-quantum-tls-on-azure-front-door-what-leaders-should-do-now.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/11\/post-quantum-tls-on-azure-front-door-what-leaders-should-do-now.png 1x, \/wp-content\/uploads\/2026\/11\/post-quantum-tls-on-azure-front-door-what-leaders-should-do-now.png 1.5x, \/wp-content\/uploads\/2026\/11\/post-quantum-tls-on-azure-front-door-what-leaders-should-do-now.png 2x, \/wp-content\/uploads\/2026\/11\/post-quantum-tls-on-azure-front-door-what-leaders-should-do-now.png 3x, \/wp-content\/uploads\/2026\/11\/post-quantum-tls-on-azure-front-door-what-leaders-should-do-now.png 4x"},"classes":[]},{"id":59295,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/21\/how-keyless-tls-raises-the-bar-for-azure-web-application-security\/","url_meta":{"origin":59666,"position":2},"title":"How Keyless TLS Raises the Bar for Azure Web Application Security","author":"CPI Staff","date":"October 21, 2026","format":false,"excerpt":"Keyless TLS keeps website private keys inside Managed HSM while Azure Application Gateway handles secure traffic. Learn where it adds value, what changes, and how to adopt it safely.","rel":"","context":"In "Azure Key Vault"","block_context":{"text":"Azure Key Vault","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-key-vault\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/how-keyless-tls-raises-the-bar-for-azure-web-application-security.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/how-keyless-tls-raises-the-bar-for-azure-web-application-security.png 1x, \/wp-content\/uploads\/2026\/10\/how-keyless-tls-raises-the-bar-for-azure-web-application-security.png 1.5x, \/wp-content\/uploads\/2026\/10\/how-keyless-tls-raises-the-bar-for-azure-web-application-security.png 2x, \/wp-content\/uploads\/2026\/10\/how-keyless-tls-raises-the-bar-for-azure-web-application-security.png 3x, \/wp-content\/uploads\/2026\/10\/how-keyless-tls-raises-the-bar-for-azure-web-application-security.png 4x"},"classes":[]},{"id":59342,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/22\/keyless-tls-and-managed-hsm-a-cio-guide-to-safer-private-keys\/","url_meta":{"origin":59666,"position":3},"title":"Keyless TLS and Managed HSM A CIO Guide to Safer Private Keys","author":"CPI Staff","date":"October 22, 2026","format":false,"excerpt":"Keyless TLS protects a critical weak point in web security by keeping private keys inside protected hardware. Here is what CIOs should assess before adopting it.","rel":"","context":"In "Azure Key Vault"","block_context":{"text":"Azure Key Vault","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-key-vault\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/keyless-tls-and-managed-hsm-a-cio-guide-to-safer-private-keys.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/keyless-tls-and-managed-hsm-a-cio-guide-to-safer-private-keys.png 1x, \/wp-content\/uploads\/2026\/10\/keyless-tls-and-managed-hsm-a-cio-guide-to-safer-private-keys.png 1.5x, \/wp-content\/uploads\/2026\/10\/keyless-tls-and-managed-hsm-a-cio-guide-to-safer-private-keys.png 2x, \/wp-content\/uploads\/2026\/10\/keyless-tls-and-managed-hsm-a-cio-guide-to-safer-private-keys.png 3x, \/wp-content\/uploads\/2026\/10\/keyless-tls-and-managed-hsm-a-cio-guide-to-safer-private-keys.png 4x"},"classes":[]},{"id":59277,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/20\/azure-application-gateway-keyless-tls-without-slowing-delivery\/","url_meta":{"origin":59666,"position":4},"title":"Azure Application Gateway Keyless TLS Without Slowing Delivery","author":"CPI Staff","date":"October 20, 2026","format":false,"excerpt":"Keyless TLS keeps website private keys inside protected hardware while Application Gateway handles secure traffic. Learn where it fits, what it changes and how to adopt it safely.","rel":"","context":"In "Azure"","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 1x, \/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 1.5x, \/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 2x, \/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 3x, \/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 4x"},"classes":[]},{"id":58378,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/azure-firewall-premium-performance-gains-for-secure-ai-and-saas\/","url_meta":{"origin":59666,"position":5},"title":"Azure Firewall Premium Performance Gains for Secure AI and SaaS","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Azure Firewall Premium\u2019s latest performance gains help organisations inspect encrypted AI and SaaS traffic while reducing bottlenecks, security exceptions and user frustration.","rel":"","context":"In "AI Agents"","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/08\/azure-firewall-premium-performance-gains-for-secure-ai-and-saas.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/08\/azure-firewall-premium-performance-gains-for-secure-ai-and-saas.png 1x, \/wp-content\/uploads\/2026\/08\/azure-firewall-premium-performance-gains-for-secure-ai-and-saas.png 1.5x, \/wp-content\/uploads\/2026\/08\/azure-firewall-premium-performance-gains-for-secure-ai-and-saas.png 2x, \/wp-content\/uploads\/2026\/08\/azure-firewall-premium-performance-gains-for-secure-ai-and-saas.png 3x, \/wp-content\/uploads\/2026\/08\/azure-firewall-premium-performance-gains-for-secure-ai-and-saas.png 4x"},"classes":[]}],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"\/wp-content\/uploads\/2026\/11\/post-quantum-tls-on-azure-app-service-and-functions-explained.png","_links":{"self":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59666","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/comments?post=59666"}],"version-history":[{"count":2,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59666\/revisions"}],"predecessor-version":[{"id":59669,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59666\/revisions\/59669"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media\/59668"}],"wp:attachment":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media?parent=59666"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/categories?post=59666"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/tags?post=59666"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}