Back to Checks
azure

App Service web app has FTP disabled or FTPS-only enforced

app_ftp_deployment_disabled
Service: appSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:microsoft.web/sites

Azure App Service web apps are evaluated for FTP exposure via the ftpsState setting. Values FtpsOnly or Disabled indicate FTP is not allowed; AllAllowed means both FTP and FTPS are accepted.

Prowler logoProwlerprowler-provider-azure

Risk

Allowing FTP (unencrypted) exposes credentials on public endpoints, enabling credential theft and session hijacking.

Compromise grants write access to code and content, enabling malicious deployments, backdoors, and data leakage, degrading integrity and confidentiality-with greater blast radius if shared, user-scope publishing credentials are used.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks app_ftp_deployment_disabled

Recommendation

Disable FTP or enforce FTPS (ftpsState: FtpsOnly or Disabled).

Prefer CI/CD over manual FTP and apply least privilege with app-scoped credentials. Rotate publishing secrets, enforce modern TLS, and restrict access via private networking. If FTP is unavoidable, require FTPS and monitor publishing logs.

Remediation

CLI

az webapp config set --resource-group <RESOURCE_GROUP> --name <APP_NAME> --ftps-state FtpsOnly

Terraform

# Enforce FTPS-only on an App Service
resource "azurerm_windows_web_app" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<example_resource_name>"
  service_plan_id     = "<example_resource_id>"

  site_config {
    ftps_state = "FtpsOnly" # CRITICAL: Enforces FTPS-only (not AllAllowed)
  }
}

NativeIaC

// Configure an existing App Service to enforce FTPS-only
resource webConfig 'Microsoft.Web/sites/config@2022-03-01' = {
  name: '<example_resource_name>/web'
  properties: {
    ftpsState: 'FtpsOnly' // CRITICAL: Sets FTP state to FTPS-only, avoiding insecure 'AllAllowed'
  }
}

Other

1In Azure Portal, go to App Services and select your app
2Go to Settings > Configuration > General settings
3Set FTP state to FTPS only (or Disabled)
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.app.app_client import app_client


class app_ftp_deployment_disabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            apps,
        ) in app_client.apps.items():
            subscription_name = app_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for app in apps.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=app)
                report.subscription = subscription_id
                report.status = "FAIL"
                report.status_extended = f"FTP is enabled for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'."
                if (
                    app.configurations
                    and getattr(app.configurations, "ftps_state", "AllAllowed")
                    != "AllAllowed"
                ):
                    report.status = "PASS"
                    report.status_extended = f"FTP is disabled for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'."

                findings.append(report)

        return findings

References