Azure Blob SFTP services

Question

https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support Does the SFTP feature allows restricting user access at the folder level. Can mount it to azure web app to enable SFTP feature and restrict user access to specific folder I create under SFTP?

Answer 1

prasantc Thanks for reaching Microsoft Q&A Team.

I understand that you would like to know about the possibilities within Azure Storage SFTP for limiting user access to particular folders.

SFTP does not support shared access signature (SAS) or Microsoft Entra authentication for accessing the SFTP endpoint. Hence, we cannot limit access to a specific folder via SFTP. https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support-how-to?tabs=azure-portal#configure-permissions

However, you can use ACLs (Access Control Lists) to limit the permissions of a user account for a certain folder. Access control lists (ACLs) in Azure Data Lake Storage Gen2

Azure Data Lake Storage Gen2 implements an access control model that supports both Azure role-based access control (Azure RBAC) and POSIX-like access control lists (ACLs).

ACLs are applied on the file and folder level. The key thing to remember is that you are always going to need RBAC Control Plane permissions in combination with ACLs. Best practice is to assign your security principals RBAC Reader role on the Storage Account/Container level and continue with more restrictive ACLs on the file and folder level.

There are two types of ACLs:
Access ACLs: They control access to an object. An object can be a file or a folder.
Default ACLs: These are ACLs assigned on the folder level only which get inherited as Access ACLs by the child file or folder.

Please find these related threads

https://learn.microsoft.com/en-us/answers/questions/927178/folder-level-permissions-within-a-container

https://learn.microsoft.com/en-us/answers/questions/654664/azure-storage-gt-permissions-per-folder.html

 Hope this helps. Please let us know if you have any further questions and we will be glad to assist you further. Thank you!

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.