App Service apps should have FTP deployments disabled
Azure App Service web apps are evaluated for FTP exposure via the `ftpsState` setting. Values `FtpsOnly` or `Disabled` indicate FTP is not allowed. Function apps are evaluated for the `ftps_state` setting that controls FTP/FTPS deployment endpoints.
Allowing FTP (unencrypted) exposes credentials on public endpoints, enabling credential theft and session hijacking. Compromise grants write access to code and content, enabling malicious deployments, backdoors, and data leakage, degrading integrity and confidentiality.
What this control checks
Web apps pass with ftpsState of FtpsOnly or Disabled; AllAllowed fails.
Common pitfalls
AllAllowed accepts both FTP and FTPS
AllAllowed means both FTP and FTPS are accepted.
FTPS still presents a public basic-auth endpoint
FTPS still presents a public basic-auth endpoint susceptible to brute force and credential reuse. Values AllAllowed or FtpsOnly indicate deployment over FTP/FTPS is enabled.
Audit evidence
Evidence that deployed resources meet this control: Prowler checks app_ftp_deployment_disabled (prowler azure --checks app_ftp_deployment_disabled) and app_function_ftps_deployment_disabled (prowler azure --checks app_function_ftps_deployment_disabled).
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_78.
Framework-specific interpretation
PCI DSS v4.0: Mapped to 1.2.5 (Network security controls (NSCs) are configured and maintained.) and 2.2.5 (System components are configured and managed securely.).
NIS2 Directive (EU 2022/2555): Mapped to 11.1.1 (For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish...), 11.1.2.c (ensure that access is only granted to users that have been adequately authenticated.), 11.6.1 (The relevant entities shall implement secure authentication procedures and technologies based on access restrictions...) and 5 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 1.2.5: Network security controls (NSCs) are configured and maintained.
- 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- 9.10 Ensure FTP deployments are disabled
- 9.10 Ensure FTP deployments are disabled
- 9.10 Ensure FTP deployments are disabled
- 9.10 Ensure FTP deployments are Disabled
- 9.9 Ensure FTP deployments are Disabled
- 9.3 Ensure 'FTP State' is set to 'FTPS Only' or 'Disabled'
- 164.312(e)(1) Transmission security
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_ftp_deployment_disabled - Checkov Check:
CKV_AZURE_78 - Powerpipe Control:
azure_compliance.control.appservice_ftp_deployment_disabled - Prowler Checks:
app_ftp_deployment_disabled,app_function_ftps_deployment_disabled
Last reviewed: 2026-10-10