App Service web apps should require FTPS
Azure App Service web apps are evaluated for FTP exposure via the `ftpsState` setting. `FtpsOnly` or `Disabled` indicate FTP is not allowed. `AllAllowed` means both FTP and FTPS are accepted.
Allowing plain FTP risks credentials and data being transmitted unencrypted. Allowing FTP (unencrypted) exposes credentials on public endpoints, enabling credential theft and session hijacking.
What this control checks
Web apps must not permit plain FTP, so FTPS is required for file transfers
Common pitfalls
AllAllowed accepts both FTP and FTPS
AllAllowed means both FTP and FTPS are accepted.
FTP can be deployed by default
By default, Azure Functions, Web, and API Services can be deployed over FTP.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "App Service apps should require FTPS only" (4d24b6d4-5e53-4a4f-a7f4-618fa573ee4b); Prowler check app_ftp_deployment_disabled (prowler azure --checks app_ftp_deployment_disabled); PowerPipe controls azure_compliance.control.appservice_ftp_deployment_disabled and azure_compliance.control.appservice_web_app_ftps_enabled.
Scans of the Terraform code that flag the same setting before deployment: KICS query "App Service FTPS Enforce Disabled" (85da374f-b00f-4832-9d44-84a1ca1e89f8); Trivy check AZU-0071.
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 5.1.2.a (the cybersecurity practices of the suppliers and service providers, including their secure development procedures;), 6.2.1 (Before developing a network and information system, including software, the relevant entities shall lay down rules for...), 6.2.2.b (apply principles for engineering secure systems and secure coding principles to any information system development...) and 1 more clause.
FedRAMP Moderate Baseline Rev 4: Mapped to SC-8 (Transmission Confidentiality And Integrity) and SC-8(1) (Cryptographic Or Alternate Physical Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
FedRAMP Moderate Baseline Rev 4
- SC-8 (1): Cryptographic Or Alternate Physical Protection
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 3.13.8: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
- 9.10 Ensure FTP deployments are Disabled
- 9.9 Ensure FTP deployments are Disabled
- 9.3 Ensure 'FTP State' is set to 'FTPS Only' or 'Disabled'
- SC.L2-3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards
- 164.312(e)(1) Transmission security
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_ftps_enabled - Powerpipe Controls:
azure_compliance.control.appservice_ftp_deployment_disabled,azure_compliance.control.appservice_web_app_ftps_enabled - Prowler Check:
app_ftp_deployment_disabled - Azure Policy Definition:
4d24b6d4-5e53-4a4f-a7f4-618fa573ee4b - KICS Query:
85da374f-b00f-4832-9d44-84a1ca1e89f8 - Trivy Check:
AZU-0071
Last reviewed: 2026-10-11