Azure Compliance ControlsAzure App Service
App Service web apps should require FTPS
Azure App Service web apps are evaluated for FTP exposure via the `ftpsState` setting. `FtpsOnly` or `Disabled` indicate FTP is not allowed. `AllAllowed` means both FTP and FTPS are accepted.
What this control checks
Web apps must not permit plain FTP, so FTPS is required for file transfers
Framework mappings
The clauses this control is mapped to in each framework.
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
FedRAMP Moderate Baseline Rev 4
- SC-8 (1): Cryptographic Or Alternate Physical Protection
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 3.13.8: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
- 9.10 Ensure FTP deployments are Disabled
- 9.9 Ensure FTP deployments are Disabled
- 9.3 Ensure 'FTP State' is set to 'FTPS Only' or 'Disabled'
- SC.L2-3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards
- 164.312(e)(1) Transmission security
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_ftps_enabled - Powerpipe Controls:
azure_compliance.control.appservice_ftp_deployment_disabled,azure_compliance.control.appservice_web_app_ftps_enabled - Prowler Check:
app_ftp_deployment_disabled - Azure Policy Definition:
4d24b6d4-5e53-4a4f-a7f4-618fa573ee4b - KICS Query:
85da374f-b00f-4832-9d44-84a1ca1e89f8 - Trivy Check:
AZU-0071
Last reviewed: 2026-10-11