Azure Compliance ControlsAzure Functions
Function apps should require FTPS only
Function apps should require FTPS only. Enable FTPS enforcement for enhanced security. The KICS query states that an Azure Function App should only enforce FTPS when `ftps_state` is enabled.
What this control checks
Function apps with FTPS state set to AllAllowed fail
Framework mappings
The clauses this control is mapped to in each framework.
- SC-8(1): Cryptographic Protection
- Transmission Confidentiality And Integrity (SC-8)
FedRAMP Moderate Baseline Rev 4
- SC-8 (1): Cryptographic Or Alternate Physical Protection
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 3.13.8: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
- SC.L2-3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_function_app_ftps_enabled - Powerpipe Control:
azure_compliance.control.appservice_function_app_ftps_enabled - Azure Policy Definition:
399b2637-a50f-4f95-96f8-3a145476eb15 - KICS Query:
9dab0179-433d-4dff-af8f-0091025691df
Last reviewed: 2026-10-11