App Service API apps should require FTPS only
Enable FTPS enforcement for enhanced security. The Azure Policy checks Microsoft.Web/sites config for `ftpsState`. Values `FtpsOnly` or `Disabled` indicate FTP is not allowed; `AllAllowed` means both FTP and FTPS are accepted.
Allowing FTP (unencrypted) exposes credentials on public endpoints, enabling credential theft and session hijacking. Allowing plain FTP risks credentials and data being transmitted unencrypted.
What this control checks
ftpsState must be FtpsOnly or Disabled; AllAllowed fails.
Common pitfalls
AllAllowed accepts both FTP and FTPS
AllAllowed means both FTP and FTPS are accepted.
FTP can be deployed by default
By default, Azure Functions, Web, and API Services can be deployed over FTP.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "App Service apps should require FTPS only" (4d24b6d4-5e53-4a4f-a7f4-618fa573ee4b); Prowler check app_ftp_deployment_disabled (prowler azure --checks app_ftp_deployment_disabled); PowerPipe controls azure_compliance.control.appservice_api_app_ftps_enabled and azure_compliance.control.appservice_ftp_deployment_disabled.
Scans of the Terraform code that flag the same setting before deployment: Trivy check AZU-0071.
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 5.1.2.a (the cybersecurity practices of the suppliers and service providers, including their secure development procedures;), 6.2.1 (Before developing a network and information system, including software, the relevant entities shall lay down rules for...), 6.2.2.b (apply principles for engineering secure systems and secure coding principles to any information system development...) and 1 more clause.
NIST SP 800-53 Rev 5: Mapped to SC-8 (Transmission Confidentiality and Integrity) and SC-8(1) (Cryptographic Protection).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-8 (Transmission Confidentiality And Integrity) and SC-8(1) (Cryptographic Or Alternate Physical Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- SC-8(1): Cryptographic Protection
- Transmission Confidentiality And Integrity (SC-8)
FedRAMP Moderate Baseline Rev 4
- SC-8 (1): Cryptographic Or Alternate Physical Protection
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 9.10 Ensure FTP deployments are Disabled
- 9.9 Ensure FTP deployments are Disabled
- 9.3 Ensure 'FTP State' is set to 'FTPS Only' or 'Disabled'
- SC.L2-3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards
- SC-8 Transmission Confidentiality And Integrity
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 164.312(e)(1) Transmission security
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_api_app_ftps_enabled - Powerpipe Controls:
azure_compliance.control.appservice_api_app_ftps_enabled,azure_compliance.control.appservice_ftp_deployment_disabled - Prowler Check:
app_ftp_deployment_disabled - Azure Policy Definition:
4d24b6d4-5e53-4a4f-a7f4-618fa573ee4b - Trivy Check:
AZU-0071
Last reviewed: 2026-10-10