Application Insights availability tests not supporting TLS 1.3

Question

Application Insights availability tests not supporting TLS 1.3

Henry Ing-Simmons 0

We received a High impact advisory in Security Advisor that "TLS should be updated to the latest version for web apps". This was a simple change in our IAC that we started to roll out.

Upon doing so we started getting all of our availability tests failing.

It would appear as if the availability tests (both classing Ping and Standard) do not support TLS 1.3.

I found this post from December 2023 which appears that some regions have been upgraded to TLS 1.3

https://azure.microsoft.com/en-us/updates?searchterms=application-insights-availability-tests-tls-13

This corroborates what I'm seeing with US pinging green and the rest of the regions I'm using failing:

User's image

When are these other regions going to be updated? I'm very surprised a year and a half later this has not already been done.

And given this hasn't been done yet why are we getting warnings about upgrading to 1.3? This seems contradictory?

Mohan Krishna T Sreeramulu 80 Reputation points Microsoft External Staff

2025-04-25T19:06:22.54+00:00
Hi Henry Ing-Simmons,

The availability tests in Azure Application Insights started using TLS 1.3 from December 2023 for some regions. However, you are experiencing failures in availability tests in regions that have not yet been upgraded to TLS 1.3,

It's due to those regions you mentioned in Screen shot were supporting only older TLS versions.

Azure updates | Microsoft Azure

As for the timeline for upgrading other regions to TLS 1.3, specific dates for each region's upgrade have not been detailed in the provided context.

The warnings about upgrading to TLS 1.3 are likely in anticipation of the broader rollout and to encourage users to prepare for the eventual deprecation of older TLS versions.

The specific timelines for when each region will update to TLS 1.3 have not been provided. It’d be best to keep an eye on Azure updates or reach out to Azure Support for specific timelines regarding your regions.

You may find more helpful info in the supported configurations document

https://learn.microsoft.com/en-us/azure/azure-monitor/app/application-insights-tls#supported-tls-configurations

https://learn.microsoft.com/en-us/security/engineering/solving-tls1-problem#supported-versions-of-tls-in-window If you found the answer helpful, please consider upvoting it. Let me know if the issue is resolved. If you need further clarification, please feel free to let us know as we are always here to help whenever you need us.
Vinod Pittala 1,750 Reputation points Microsoft External Staff

2025-04-28T07:29:53.6733333+00:00

Hello Henry Ing-Simmons,

Kindly confirm if the provided solution resolves your issue. we will look forward to your valuable feedback.

Please feel free to let us know, as we are always here to help whenever you need us.

Thank you.
Henry Ing-Simmons 0 Reputation points

2025-04-28T08:42:09.76+00:00

Those links don't help me as they don't tell me which regions are/aren't supported. Indeed, the first link seems to just imply that TLS 1.3 is supported which is not the case.

Given TLS 1.3 is nearly 7 years old why have Azure not upgraded all regions by this point?

I'm not currently on a support plan which allows me to contact support, hence my posting here. So, suggesting I contact support is also not helpful.
SadiqhAhmed-MSFT 48,716 Reputation points Microsoft Employee

2025-05-02T06:52:05.6166667+00:00

@Henry Ing-Simmons Apologies for the confusion and the resulting issues. The TLS 1.3 rollout was delayed due to some technical difficulties. These problems were patched mid-late last year and required disabling some legacy TLS aspects. Consequently, coupled with the TLS 1.0/1.1 retirement moving to 5/1/2025, we haven't been able to proceed with the upgrade across all regions.

The team is focusing on retiring legacy TLS starting May 1, which will take a few months. We'll resume the TLS 1.3 rollout afterward. The Advisor's recommendation should ensure you're not using TLS 1.0 and 1.1.

The dates shared in the Azure Update are the most accurate information -https://azure.microsoft.com/en-us/updates?searchterms=application-insights-availability-tests-tls-13, suggest you keep an eye on this site for updates.

Hope this clarifies! Please let us know if you have any further questions.

Your answer

Mohan Krishna T Sreeramulu 80 Reputation points Microsoft External Staff

2025-04-25T19:06:22.54+00:00

Hi Henry Ing-Simmons,

The availability tests in Azure Application Insights started using TLS 1.3 from December 2023 for some regions. However, you are experiencing failures in availability tests in regions that have not yet been upgraded to TLS 1.3,

It's due to those regions you mentioned in Screen shot were supporting only older TLS versions.

Azure updates | Microsoft Azure

As for the timeline for upgrading other regions to TLS 1.3, specific dates for each region's upgrade have not been detailed in the provided context.

The warnings about upgrading to TLS 1.3 are likely in anticipation of the broader rollout and to encourage users to prepare for the eventual deprecation of older TLS versions.

The specific timelines for when each region will update to TLS 1.3 have not been provided. It’d be best to keep an eye on Azure updates or reach out to Azure Support for specific timelines regarding your regions.

You may find more helpful info in the supported configurations document

https://learn.microsoft.com/en-us/azure/azure-monitor/app/application-insights-tls#supported-tls-configurations

https://learn.microsoft.com/en-us/security/engineering/solving-tls1-problem#supported-versions-of-tls-in-window If you found the answer helpful, please consider upvoting it. Let me know if the issue is resolved. If you need further clarification, please feel free to let us know as we are always here to help whenever you need us.
Vinod Pittala 1,750 Reputation points Microsoft External Staff

2025-04-28T07:29:53.6733333+00:00

Hello Henry Ing-Simmons,

Kindly confirm if the provided solution resolves your issue. we will look forward to your valuable feedback.

Please feel free to let us know, as we are always here to help whenever you need us.

Thank you.
Henry Ing-Simmons 0 Reputation points

2025-04-28T08:42:09.76+00:00

Those links don't help me as they don't tell me which regions are/aren't supported. Indeed, the first link seems to just imply that TLS 1.3 is supported which is not the case.

Given TLS 1.3 is nearly 7 years old why have Azure not upgraded all regions by this point?

I'm not currently on a support plan which allows me to contact support, hence my posting here. So, suggesting I contact support is also not helpful.
SadiqhAhmed-MSFT 48,716 Reputation points Microsoft Employee

2025-05-02T06:52:05.6166667+00:00

@Henry Ing-Simmons Apologies for the confusion and the resulting issues. The TLS 1.3 rollout was delayed due to some technical difficulties. These problems were patched mid-late last year and required disabling some legacy TLS aspects. Consequently, coupled with the TLS 1.0/1.1 retirement moving to 5/1/2025, we haven't been able to proceed with the upgrade across all regions.

The team is focusing on retiring legacy TLS starting May 1, which will take a few months. We'll resume the TLS 1.3 rollout afterward. The Advisor's recommendation should ensure you're not using TLS 1.0 and 1.1.

The dates shared in the Azure Update are the most accurate information -https://azure.microsoft.com/en-us/updates?searchterms=application-insights-availability-tests-tls-13, suggest you keep an eye on this site for updates.

Hope this clarifies! Please let us know if you have any further questions.

Share via

Application Insights availability tests not supporting TLS 1.3

Your answer