Configure Transport Layer Security (TLS) for a client application

✔️ Applies to: Azure Blob Storage, Azure Data Lake Storage, Azure Queue Storage, Azure Table Storage

✖️ Doesn't apply to: Azure Files (Microsoft.Storage or Microsoft.FileShares)

For security purposes, an Azure Storage account can require that clients use a minimum version of Transport Layer Security (TLS) to send requests. Calls to Azure Storage fail if the client uses a version of TLS that's lower than the minimum required version. For example, if a storage account requires TLS 1.2, a request sent by a client that uses TLS 1.1 fails.

This article describes how to configure a client application to use a particular version of TLS. For information about how to configure a minimum required version of TLS for an Azure Storage account, see Configure minimum required version of Transport Layer Security (TLS) for a storage account.

For Azure Files, see FileREST encryption in transit. Storage accounts that contain Azure file shares use the same TLS requirements, but the Azure Files article describes considerations for Azure Files.

Configure the client TLS version

To send a request with a particular version of TLS, the operating system must support that version.

The following examples show how to set the client's TLS version to 1.2 from PowerShell or .NET. The .NET Framework used by the client must support TLS 1.2. For more information, see Support for TLS 1.2.

# Set the TLS version used by the PowerShell client to TLS 1.2.
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;

# Create a new container.
$storageAccount = Get-AzStorageAccount -ResourceGroupName $rgName -Name $accountName
$ctx = $storageAccount.Context
New-AzStorageContainer -Name "sample-container" -Context $ctx

public static async Task ConfigureTls12()
{
    // Enable TLS 1.2 before connecting to Azure Storage
    System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Tls12;

    // Add your connection string here.
    string connectionString = "";

    // Create a new container with Shared Key authorization.
    BlobContainerClient containerClient = new BlobContainerClient(connectionString, "sample-container");
    await containerClient.CreateIfNotExistsAsync();
}

Verify the TLS version used by a client

To verify that the client used the specified version of TLS to send a request, use Fiddler or a similar tool. Open Fiddler to start capturing client network traffic, and then execute one of the examples in the previous section. Look at the Fiddler trace to confirm that the correct version of TLS was used to send the request, as shown in the following image.

Next steps

• Configure minimum required version of Transport Layer Security (TLS) for a storage account
• Security recommendations for Blob storage