Use a newer PHP runtime version

March 21, 2025 ยท View on GitHub

SYNOPSIS

Configure applications to use newer PHP runtime versions.

DESCRIPTION

Within a App Service app, the version of PHP runtime used to run application/ site code is configurable.

Overtime, a specific version of PHP may become outdated and no longer supported by Microsoft in Azure App Service. This can lead to security vulnerabilities or are simply not able to use the latest security features.

PHP 8.0 and 8.1 are approaching end of support.

RECOMMENDATION

Consider updating the site to use a newer PHP runtime version such as 8.2.

EXAMPLES

Configure with Azure template

To deploy App Services that pass this rule:

  • Set properties.siteConfig.linuxFxVersion to a minimum of PHP|8.2.

For example:

{
  "type": "Microsoft.Web/sites",
  "apiVersion": "2023-01-01",
  "name": "[parameters('name')]",
  "location": "[parameters('location')]",
  "identity": {
    "type": "SystemAssigned"
  },
  "kind": "web",
  "properties": {
    "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', parameters('planName'))]",
    "httpsOnly": true,
    "clientAffinityEnabled": false,
    "siteConfig": {
      "alwaysOn": true,
      "minTlsVersion": "1.2",
      "ftpsState": "Disabled",
      "http20Enabled": true,
      "healthCheckPath": "/healthz",
      "linuxFxVersion": "PHP|8.2"
    }
  },
  "dependsOn": [
    "[resourceId('Microsoft.Web/serverfarms', parameters('planName'))]"
  ]
}

Configure with Bicep

To deploy App Services that pass this rule:

  • Set properties.siteConfig.linuxFxVersion to a minimum of PHP|8.2.

For example:

resource php 'Microsoft.Web/sites@2023-01-01' = {
  name: name
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  kind: 'web'
  properties: {
    serverFarmId: plan.id
    httpsOnly: true
    clientAffinityEnabled: false
    siteConfig: {
      alwaysOn: true
      minTlsVersion: '1.2'
      ftpsState: 'Disabled'
      http20Enabled: true
      healthCheckPath: '/healthz'
      linuxFxVersion: 'PHP|8.2'
    }
  }
}

Configure with Azure Policy

To address this issue at runtime use the following policies:

NOTES

From November 2022 - PHP is only supported on Linux-based plans.