Ensure 'FTP State' is set to 'FTPS Only' or 'Disabled'

Overview

By default, App Services can be deployed over FTP. If FTP is required for an essential deployment workflow, FTPS should be required for FTP login for all App Services.

If FTPS is not expressly required for the App, the recommended setting is Disabled.

Rationale

FTP is an unencrypted network protocol that will transmit data - including passwords - in clear-text. The use of this protocol can lead to both data and credential compromise, and can present opportunities for exfiltration, persistence, and lateral movement.

Impact

Any deployment workflows that rely on FTP or FTPs rather than the WebDeploy or HTTPs endpoints may be affected.

Default Value

By default, FTP based deployment is All allowed.

Remediation guidance

Remediate from Azure Portal

Open the web app using the Open in Azure button.
Select Settings and then Configuration
Under General Settings, for the Platform Settings, the FTP state should be set to Disabled or FTPS Only

Remediate from Azure CLI

For each out of compliance application, run the following choosing either 'disabled' or 'FtpsOnly' as appropriate:

az webapp config set --resource-group <resourceGroupName> --name <appName> --ftps-state [Disabled|FtpsOnly]

Remediate from PowerShell

For each out of compliance application, run the following:

Set-AzWebApp -ResourceGroupName <resourceGroupName> -Name <appName> -FtpsState [Disabled|FtpsOnly]

Service-wide remediation

Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.

Azure

Use management group or subscription Azure Policy assignments, remediation tasks where supported, landing-zone standards, and IaC modules so drift is prevented at scale.

Operational rollout

Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
Re-scan and track approved exceptions with an owner and expiry date.

Query logic

These are the stored checks tied to this control.

Azure App Services allowing plain FTP deployments

Connectors

Microsoft Azure

Covered asset types

Site

Expected check: eq []

{
  sites(where: { siteConfig: { ftpsState: "AllAllowed" } }) {
    ...AssetFragment
  }
}