Deploy your app to Azure App Service using FTP/S

This article shows you how to use FTP or FTPS to deploy your web app, mobile app backend, or API app to Azure App Service.

The FTP/S endpoint for your app is already active. No configuration is necessary to enable FTP/S deployment.


The Development Center (Classic) page in the Azure portal, which is the old deployment experience, will be deprecated in March, 2021. This change will not affect any existing deployment settings in your app, and you can continue to manage app deployment in the Deployment Center page.

Get deployment credentials

  1. Follow the instructions at Configure deployment credentials for Azure App Service to copy the application-scope credentials or set the user-scope credentials. You can connect to the FTP/S endpoint of your app using either credentials.

  2. Craft the FTP username in the following format, depending on your choice of credential scope:

    Application-scope User-scope
    <app-name>\$<app-name> <app-name>\<deployment-user>

    In App Service, the FTP/S endpoint is shared among apps. Because the user-scope credentials aren't linked to a specific resource, you need to prepend the user-scope username with the app name as shown above.

Get FTP/S endpoint

In the same management page for your app where you copied the deployment credentials (Deployment Center > FTP Credentials), copy the FTPS endpoint.

Deploy files to Azure

  1. From your FTP client (for example, Visual Studio, Cyberduck, or WinSCP), use the connection information you gathered to connect to your app.
  2. Copy your files and their respective directory structure to the /site/wwwroot directory in Azure (or the /site/wwwroot/App_Data/Jobs/ directory for WebJobs).
  3. Browse to your app's URL to verify the app is running properly.


Unlike Git-based deployments and Zip deployment, FTP deployment doesn't support build automation, such as:

  • dependency restores (such as NuGet, NPM, PIP, and Composer automations)
  • compilation of .NET binaries
  • generation of web.config (here is a Node.js example)

Generate these necessary files manually on your local machine, and then deploy them together with your app.

Enforce FTPS

For enhanced security, you should allow FTP over TLS/SSL only. You can also disable both FTP and FTPS if you don't use FTP deployment.

  1. In your app's resource page in Azure portal, select Configuration > General settings from the left navigation.

  2. To disable unencrypted FTP, select FTPS Only in FTP state. To disable both FTP and FTPS entirely, select Disabled. When finished, click Save. If using FTPS Only, you must enforce TLS 1.2 or higher by navigating to the TLS/SSL settings blade of your web app. TLS 1.0 and 1.1 are not supported with FTPS Only.

    Disable FTP/S

What happens to my app during deployment?

All the officially supported deployment methods make changes to the files in the /home/site/wwwroot folder of your app. These files are used to run your app. So the deployment can fail because of locked files. The app might also behave unpredictably during deployment because the files aren't all updated at the same time. This behavior is undesirable for a customer-facing app. There are a few ways to avoid these issues:

Troubleshoot FTP deployment

How can I troubleshoot FTP deployment?

The first step for troubleshooting FTP deployment is isolating a deployment issue from a runtime application issue.

A deployment issue typically results in no files or wrong files deployed to your app. You can troubleshoot by investigating your FTP deployment or selecting an alternate deployment path (such as source control).

A runtime application issue typically results in the right set of files deployed to your app but incorrect app behavior. You can troubleshoot by focusing on code behavior at runtime and investigating specific failure paths.

To determine a deployment or runtime issue, see Deployment vs. runtime issues.

I'm not able to FTP and publish my code. How can I resolve the issue?

Check that you've entered the correct hostname and credentials. Check also that the following FTP ports on your machine are not blocked by a firewall:

  • FTP control connection port: 21, 990
  • FTP data connection port: 989, 10001-10300

How can I connect to FTP in Azure App Service via passive mode?

Azure App Service supports connecting via both Active and Passive mode. Passive mode is preferred because your deployment machines are usually behind a firewall (in the operating system or as part of a home or business network). See an example from the WinSCP documentation.

Why is my connection failing when attempting to connect over FTPS using explicit encryption?

FTPS allows establishing the TLS secure connection in either an Explicit or Implicit way.

  • If you are connecting in an Implicit way, the connection is established via port 990.
  • If you are connecting in an Explicit way, the connection is established via port 21.

One thing to be aware that can affect your connection success is the URL used, this will depend on the Client Application used. The portal will have just the URL as "ftps://" and you might need to change this.

  • If the URL used starts with "ftp://", the connection is implied to be on port 21.
  • If it starts with "ftps://", the connection is implied to be Implicit and on port 990.

Make sure to not mix both, such as attempting to connect to "ftps://" and using port 21, as it will fail to connect, even if you wish to do Explicit encryption. The reason for this is due to an Explicit connection starting as a plain FTP connection before the AUTH method.

How can I determine the method that was used to deploy my Azure App Service?

Let us say you take over owning an app and you wish to find out how the Azure App Service was deployed so you can make changes and deploy them. You can determine how an Azure App Service was deployed by checking the application settings. If the app was deployed using an external package URL, you will see the WEBSITE_RUN_FROM_PACKAGE setting in the application settings with a URL value. Or if it was deployed using zip deploy, you will see the WEBSITE_RUN_FROM_PACKAGE setting with a value of 1. If the app was deployed using Azure DevOps, you will see the deployment history in the Azure DevOps portal. If Azure Functions Core Tools was used, you will see the deployment history in the Azure portal.

More resources