Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
app_function_ftps_deployment_disabledProvider: Azure
Service:
appSeverity: MEDIUM
Categories:
internet-exposedResource type:
microsoft.web/sitesWhat this check verifies
Azure Function apps are evaluated for theftps_state setting that controls FTP/FTPS deployment endpoints. Values AllAllowed or FtpsOnly indicate deployment over FTP/FTPS is enabled, while Disabled indicates both endpoints are turned off.
Risk
Enabled FTP/FTPS deployment undermines confidentiality and integrity. FTP exposes credentials in cleartext; FTPS still presents a public basic-auth endpoint susceptible to brute force and credential reuse. Compromise enables unauthorized code pushes, leading to RCE, data leakage, and service disruption.Recommendation
Disable FTP and FTPS deployment on Function apps (ftps_state: Disabled). Adopt defense in depth: deploy via CI/CD with packaged artifacts (zip or containers), enforce least privilege publishing access, and limit exposure of build and deployment endpoints. If unavoidable, use FTPS-only with TLS 1.2 and rotate credentials promptly.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az webapp config set —resource-group <resource-group> —name <app-name> —ftps-state Disabled
References
- https://learn.microsoft.com/en-us/azure/azure-functions/functions-deployment-technologies?tabs=windows#trigger-syncing
- https://docs.microsoft.com/en-us/azure/app-service/deploy-ftp
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = app_function_ftps_deployment_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks