Troubleshooting FTP/FTPS Access Denied Errors in Azure Function Apps (Elastic Premium SKU)

If you’re running an Azure Function App on the Elastic Premium SKU, you should know it behaves differently from Dedicated or Consumption SKUs — notably, it requires mounted Azure Files storage, not local worker-based storage. That makes file access troubleshooting slightly more involved.

Problem: FTP/FTPS “Access Denied” Error

Trying to connect to your app’s file system via FTP/FTPS and getting slapped with an “Access Denied”? Here are the most common (and fixable) culprits:

1. FTP/FTPS Must Be Enabled

Head to your App Service → Configuration → General settings. Make sure:

• FTP state is set to “All Allowed” or “FTPS Only”.
• FTP basic authentication is enabled.
• If any changes are made, ensure you click save.

Without these settings, FTP just won’t work — even if everything else is configured correctly.

2. Use the Right Credentials

From the Overview blade, click Download publish profile to grab your FTP username and password. The username will typically look like:

'AppServiceName\$AppServiceName'

⚠️ If the option is grayed out or you get an error downloading the publish profile, either:

• FTP is not enabled (see step 1), or
• Your user account lacks the necessary permissions.

3. Storage Account File Endpoint Connectivity

Since your Function App’s file system is mounted via Azure Files, the FTP endpoint relies on your access to the underlying storage account specified in:

WEBSITE_CONTENTAZUREFILECONNECTIONSTRING

Here’s what to check:

• Temporarily allow public access under the Storage Account → Networking blade.
  • If FTP works now, the issue is network access.

• Set the storage account to Selected Networks, and whitelist your public IP.

• Using a private endpoint? Make sure your PC resolves the file endpoint to the private IP:
  1. Run: nslookup <storageaccountname>.file.core.windows.net
  2. If it doesn’t resolve to a private IP, add a DNS record pointing: <storageaccountname>.privatelink.file.core.windows.net to the private endpoint IP address.
     • There is documentation on that here: DNS changes for private endpoints
  3. Or edit your Windows hosts file to manually resolve it.

Hopefully this guide gets you past that annoying “Access Denied” error!

About Author