Azure App Service's Two Basic Auth Policies, Not One

The Trap

Azure App Service exposes two independent basic-auth publishing policies under Microsoft.Web/sites/basicPublishingCredentialsPolicies: one named scm, one named ftp. The Portal’s Configuration > General Settings toggle labelled “Basic Auth Publishing Credentials” writes to the scm policy only. There is no equivalent Portal control for ftp. Admins who flip that single toggle and consider deployment authentication closed have, in practice, left FTPS basic auth untouched.

The Default State

New App Service instances ship with ftpsState set to AllAllowed and both policy children defaulting to properties.allow: true. The publish profile generated at site creation contains a static username and password tied to the site itself, not to Entra ID, and it does not expire or rotate on any schedule. Combined with Always On: true, which most teams enable purely to avoid cold-start latency on the primary web app, the platform’s keep-alive ping continuously warms the worker process rather than letting it idle out after twenty minutes of inactivity.

The Blast Radius

Publish profiles leak routinely: committed into CI pipeline logs, left in old zip-deploy scripts, or pasted into ticketing systems during migrations. An attacker holding a leaked profile connects over FTPS, uploads an aspx or php shell into /site/wwwroot, and finds the SCM basic-auth toggle irrelevant because FTP authentication was never gated by it. Because Always On prevents the worker process from being recycled on idle, the shell’s process persists without re-upload, and FTP-based file drops don’t pass through the same deployment-slot audit trail as Kudu or source control deployments, so standard deployment logging misses the write entirely.

The Lead Mechanic Fix

Disable both policy resources explicitly and remove FTP as an authentication path where it isn’t operationally required:

az resource update --resource-group <rg> --namespace Microsoft.Web --resource-type basicPublishingCredentialsPolicies --parent sites/<app-name> --name ftp --set properties.allow=false

az resource update --resource-group <rg> --namespace Microsoft.Web --resource-type basicPublishingCredentialsPolicies --parent sites/<app-name> --name scm --set properties.allow=false

az webapp config set --resource-group <rg> --name <app-name> --ftps-state Disabled

Rotate the publish profile immediately afterwards with az webapp deployment user set --user-name <new-user> --password <new-pass>, and move deployment to OIDC-federated GitHub Actions or Entra ID-authenticated pipelines so no static publish credential exists to leak.