Unable to setup the ACLs at folder level on a Blob Container using local SFTP user

Question

Unable to setup the ACLs at folder level on a Blob Container using local SFTP user

Ramkumar Perumal 30 Microsoft Employee

Unable to setup the ACLs at folder level on a Blob Container using local SFTP user.

The below documentation says Azure SFTP permissions can be setup for local user using ACLs and mentioned this capability is in Preview. Not sure if this is the issue why I am not able to setup.

https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support#access-control-lists-acls

This documentation is what referred by the above URL to Setup the ACLs, but there are no information on how to setup for local users.

https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-access-control

Thanks.

Sathvika Reddy Dopathi 225 Reputation points Microsoft External Staff

2025-03-06T06:51:44.17+00:00
Hi @Ramkumar Perumal,

Adding to the below mentioned answer you can also manage permissions for users accessing your blob storage via SFTP using RBAC (Role Back Access Control) and SAS tokens (Shared Access Signatures).

Make sure that SFTP support is enabled for your Azure Blob Storage account. To enable this, go to the SFTP setting in the storage account.

Create a Local User for SFTP Access –

Go to the Storage account in Azure portal.

Under Settings, Select SFTP and then click on Add local user.

Configure the local user with a password for authentication.

You can set ACLs on a specific directory within your Blob container using either Azure CLI. you can grant a user read, write, or execute permissions on a specific directory.

Select Access Control (IAM) and then Add role assignment. Give the necessary permissions to access the Blob container and directories. Verify that the permissions are applied correctly.

Additional Steps:

Try setting ACLs at the container level for your local SFTP user to see if that works. This will help determine if the issue is specific to folder-level permissions. If possible, test with Azure AD users instead of local SFTP users. Azure AD integration might have better support for ACLs.

If folder-level ACLs are not yet fully supported, you can use virtual directory prefixes to organize your blobs and apply ACLs at the virtual directory level. As an alternative to ACLs, you can use Shared Access Signature (SAS) tokens to grant limited-time access to specific blobs or folders to your local SFTP users.

References:

Use the Azure portal to manage ACLs in Azure Data Lake Storage - Azure Storage | Microsoft Learn

Authorize access to Azure Blob Storage for an SFTP client - Azure Storage | Microsoft Learn

Please let us know if you have any further queries. I’m happy to assist you further.

Please consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Sathvika Reddy Dopathi 225 Reputation points Microsoft External Staff

2025-03-07T05:06:31.1266667+00:00

Hi @Ramkumar Perumal,

Just checking in to see if the above suggestion helped you to solve your issue, please let us know if you have any further queries. If the above suggestion help do "Upvote" for the answer that helped you, this can be beneficial to other community members.
Ramkumar Perumal 30 Reputation points Microsoft Employee

2025-03-07T22:58:47.12+00:00

Thanks for details. The references are not accurate for setting ACLs for local SFTP users. I have already enabled SFTP and wanted to restrict permissions using local user. I do not want to use SAS tokens.
Sathvika Reddy Dopathi 225 Reputation points Microsoft External Staff

2025-03-10T04:23:28.5966667+00:00
Hi @Ramkumar Perumal,

Thanks for the response.

I understand that you have enabled SFTP on your Azure Blob Storage account and want to restrict permissions using local users. You can manage and restrict with the help of RBAC (Role Based Access Control).

After creating the local user, assign RBAC roles to the local user.

Go to the Storage account, under the settings select Access Control (IAM).

Click on +Add (Add Role Assignment), Select the following roles you want.

In the Assign access to section, select User, group. Search for the local user you created before and select them.

Click on Save to apply the roles which you gave.

Please let us know if you have any further queries. I’m happy to assist you further.

Please consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Venkatesan S 2,820 Reputation points Microsoft External Staff Moderator

2025-03-10T08:46:02.07+00:00

Hi Ramkumar Perumal

Could you please check this I want to restrict azure ADLS SFTP access to directory level. - Microsoft Q&A that I posted?

If this resolves your issue, please click “up-vote" for it, which could help other community members who read this thread. And, if you have any more questions, please let us know.
Sathvika Reddy Dopathi 225 Reputation points Microsoft External Staff

2025-03-12T05:30:03.14+00:00

Hi @Ramkumar Perumal,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Ramkumar Perumal 30 Reputation points Microsoft Employee

2025-03-21T04:58:03.51+00:00
Sathvika, The RBAC will only work at the container level and not at the directory within the container level.

Venkatesan, The link you shared is incorrect as it adds with some other text before making it as dead link. I removed the characters in the front and then was able to access the actual URL.

Following are the folder structure;

Root

--Inbound

----process1

----process2

--outbound

----process1

----process2

I have following users and permissions needs to be assigned.

user1process1 should be able to read and write to inbound/process1, and should be able to read outbound/process1.

adminuser1process1 should be able to read and write to inbound/process1, as well as outbound/process1.

The link you shared gives me option to change ownership if the folder and that means i delegate the full permission to that one user, but my requirement is to provide access to multiple users with different level of access.

Thanks for sharing the detailed document on how ACLs works but the feature is still not helping for simple user permissions.

One alternate is to flatten the structure and provide individual permissions, but that also means multiple users and makes the solution more cumbersome.
Venkatesan S 2,820 Reputation points Microsoft External Staff Moderator

2025-03-21T07:03:47.53+00:00

Hi Ramkumar Perumal

I edited the comment with proper link, and you can use this below link how they are assigning and modifying ACL for user using Connect to Azure Blob Storage from an SFTP client - Azure Storage | Microsoft Learn.

Note:

the ACLs for local users are supported, but also still in preview.

If this resolves your issue, please click “up-vote" for it, which could help other community members who read this thread. And, if you have any more questions, please let us know.
Venkatesan S 2,820 Reputation points Microsoft External Staff Moderator

2025-03-24T07:46:49.43+00:00

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet .In case if you have any resolution please do share that same with the community as it can be helpful to others . Otherwise, will respond back with the more details and we will try to help.
Ramkumar Perumal 30 Reputation points Microsoft Employee

2025-03-31T23:11:50.28+00:00

Hi Venkatesan, Thanks for additional details. Still not working. Can we quickly sync on a chat to get your assistance?
Venkatesan S 2,820 Reputation points Microsoft External Staff Moderator

2025-04-01T04:18:34.2966667+00:00

Hi Ramkumar Perumal

We are checking internally with our team on this issue. We will update you as soon as possible once we get an update from our team.

Accepted answer

1 additional answer

Your answer

Sathvika Reddy Dopathi 225 Reputation points Microsoft External Staff

2025-03-07T05:06:31.1266667+00:00

Hi @Ramkumar Perumal,

Just checking in to see if the above suggestion helped you to solve your issue, please let us know if you have any further queries. If the above suggestion help do "Upvote" for the answer that helped you, this can be beneficial to other community members.
Ramkumar Perumal 30 Reputation points Microsoft Employee

2025-03-07T22:58:47.12+00:00

Thanks for details. The references are not accurate for setting ACLs for local SFTP users. I have already enabled SFTP and wanted to restrict permissions using local user. I do not want to use SAS tokens.
Sathvika Reddy Dopathi 225 Reputation points Microsoft External Staff

2025-03-10T04:23:28.5966667+00:00

Hi @Ramkumar Perumal,

Thanks for the response.

I understand that you have enabled SFTP on your Azure Blob Storage account and want to restrict permissions using local users. You can manage and restrict with the help of RBAC (Role Based Access Control).

After creating the local user, assign RBAC roles to the local user.

Go to the Storage account, under the settings select Access Control (IAM).

Click on +Add (Add Role Assignment), Select the following roles you want.

In the Assign access to section, select User, group. Search for the local user you created before and select them.

Click on Save to apply the roles which you gave.

Please let us know if you have any further queries. I’m happy to assist you further.

Please consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Venkatesan S 2,820 Reputation points Microsoft External Staff Moderator

2025-03-10T08:46:02.07+00:00

Hi Ramkumar Perumal

Could you please check this I want to restrict azure ADLS SFTP access to directory level. - Microsoft Q&A that I posted?

If this resolves your issue, please click “up-vote" for it, which could help other community members who read this thread. And, if you have any more questions, please let us know.
Sathvika Reddy Dopathi 225 Reputation points Microsoft External Staff

2025-03-12T05:30:03.14+00:00

Hi @Ramkumar Perumal,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Ramkumar Perumal 30 Reputation points Microsoft Employee

2025-03-21T04:58:03.51+00:00

Sathvika, The RBAC will only work at the container level and not at the directory within the container level.

Venkatesan, The link you shared is incorrect as it adds with some other text before making it as dead link. I removed the characters in the front and then was able to access the actual URL.

Following are the folder structure;

Root

--Inbound

----process1

----process2

--outbound

----process1

----process2

I have following users and permissions needs to be assigned.

user1process1 should be able to read and write to inbound/process1, and should be able to read outbound/process1.

adminuser1process1 should be able to read and write to inbound/process1, as well as outbound/process1.

The link you shared gives me option to change ownership if the folder and that means i delegate the full permission to that one user, but my requirement is to provide access to multiple users with different level of access.

Thanks for sharing the detailed document on how ACLs works but the feature is still not helping for simple user permissions.

One alternate is to flatten the structure and provide individual permissions, but that also means multiple users and makes the solution more cumbersome.
Venkatesan S 2,820 Reputation points Microsoft External Staff Moderator

2025-03-21T07:03:47.53+00:00

Hi Ramkumar Perumal

I edited the comment with proper link, and you can use this below link how they are assigning and modifying ACL for user using Connect to Azure Blob Storage from an SFTP client - Azure Storage | Microsoft Learn.

Note:

the ACLs for local users are supported, but also still in preview.

If this resolves your issue, please click “up-vote" for it, which could help other community members who read this thread. And, if you have any more questions, please let us know.
Venkatesan S 2,820 Reputation points Microsoft External Staff Moderator

2025-03-24T07:46:49.43+00:00

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet .In case if you have any resolution please do share that same with the community as it can be helpful to others . Otherwise, will respond back with the more details and we will try to help.
Ramkumar Perumal 30 Reputation points Microsoft Employee

2025-03-31T23:11:50.28+00:00

Hi Venkatesan, Thanks for additional details. Still not working. Can we quickly sync on a chat to get your assistance?
Venkatesan S 2,820 Reputation points Microsoft External Staff Moderator

2025-04-01T04:18:34.2966667+00:00

Hi Ramkumar Perumal

We are checking internally with our team on this issue. We will update you as soon as possible once we get an update from our team.

Answer 1

Hi Ramkumar Perumal

As we discussed through offline the localuser1 can assign ACL to particular directory1 through SFTP and Local user 2 can assign ACL to particular directory2 through SFTP by changing owner from Admin user.

enter image description here

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members. User's image

If you have any other questions or are still running into more issues, let me know in the “comments” and I would be happy to help you.

Answer 2

Amrinder Singh 5,870 Microsoft Employee Volunteer Moderator

Hi Ramkumar Perumal,

Thanks for reaching out over Q&A Forum.

The first link that you are shared is w.r.t. managing ACL for ADLSGen2 and not SFTP.

You can follow this link for managing the ACLs for SFTP Storage via Portal, PS or CLI

https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support-authorize-access?tabs=azure-portal#give-permission-to-containers

Hope this helps! Please let us know if you have any further quires, we will be glad to assist you.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Ramkumar Perumal 30 Reputation points Microsoft Employee

2025-03-07T23:01:45.81+00:00

Thanks Amrinder. The reference link is what I used to create user and setup permissions to the container. But I want to restrict the access to the child folder. For example, i have the following folder structure;

Root/Parent-1/Child-1/SubChild-1.

I created local users, and container access. But I want the SFTP local user to ONLY acces SubChild-1 folder and not the entire directory.

Share via

Unable to setup the ACLs at folder level on a Blob Container using local SFTP user

1 additional answer

Your answer