Function apps should require FTPS only
Function apps should require FTPS only. Enable FTPS enforcement for enhanced security. The KICS query states that an Azure Function App should only enforce FTPS when `ftps_state` is enabled.
Enable FTPS enforcement for enhanced security.
What this control checks
Function apps with FTPS state set to AllAllowed fail
Common pitfalls
Enforce FTPS only when ftps_state is enabled
Azure Function App should only enforce FTPS when ftps_state is enabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Function apps should require FTPS only" (399b2637-a50f-4f95-96f8-3a145476eb15); PowerPipe control azure_compliance.control.appservice_function_app_ftps_enabled.
Scans of the Terraform code that flag the same setting before deployment: KICS query "Function App FTPS Enforce Disabled" (9dab0179-433d-4dff-af8f-0091025691df).
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-8 (Transmission Confidentiality and Integrity) and SC-8(1) (Cryptographic Protection).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-8 (Transmission Confidentiality And Integrity) and SC-8(1) (Cryptographic Or Alternate Physical Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- SC-8(1): Cryptographic Protection
- Transmission Confidentiality And Integrity (SC-8)
FedRAMP Moderate Baseline Rev 4
- SC-8 (1): Cryptographic Or Alternate Physical Protection
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 3.13.8: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
- SC.L2-3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_function_app_ftps_enabled - Powerpipe Control:
azure_compliance.control.appservice_function_app_ftps_enabled - Azure Policy Definition:
399b2637-a50f-4f95-96f8-3a145476eb15 - KICS Query:
9dab0179-433d-4dff-af8f-0091025691df
Last reviewed: 2026-10-11