Via portal or ARM/Bicep, enforce TLS 1.2+ and disable older protocols for each service plan. Validate changes through SSL scan.