Azure Compliance ControlsAzure App Service
App Service API apps should require FTPS only
Enable FTPS enforcement for enhanced security. The Azure Policy checks Microsoft.Web/sites config for `ftpsState`. Values `FtpsOnly` or `Disabled` indicate FTP is not allowed; `AllAllowed` means both FTP and FTPS are accepted.
What this control checks
ftpsState must be FtpsOnly or Disabled; AllAllowed fails.
Framework mappings
The clauses this control is mapped to in each framework.
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- SC-8(1): Cryptographic Protection
- Transmission Confidentiality And Integrity (SC-8)
FedRAMP Moderate Baseline Rev 4
- SC-8 (1): Cryptographic Or Alternate Physical Protection
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 9.10 Ensure FTP deployments are Disabled
- 9.9 Ensure FTP deployments are Disabled
- 9.3 Ensure 'FTP State' is set to 'FTPS Only' or 'Disabled'
- SC.L2-3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards
- SC-8 Transmission Confidentiality And Integrity
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 164.312(e)(1) Transmission security
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_api_app_ftps_enabled - Powerpipe Controls:
azure_compliance.control.appservice_api_app_ftps_enabled,azure_compliance.control.appservice_ftp_deployment_disabled - Prowler Check:
app_ftp_deployment_disabled - Azure Policy Definition:
4d24b6d4-5e53-4a4f-a7f4-618fa573ee4b - Trivy Check:
AZU-0071
Last reviewed: 2026-10-10