Securely automate scheduled file upload from Linux to Azure File share.

Question

Securely automate scheduled file upload from Linux to Azure File share.

EnterpriseArchitect 6,301

What is the best way to automate file transfer from a Linux box to a Azure File Share securely without using a SAS key ?

Because so far the PowerShell on each of the Linux host is using the embedded secrets (SAS Key) that is deemed insecure.

Jerald Felix 9,835 Reputation points

2025-10-27T02:29:34.27+00:00
Hello EnterpriseArchitect,

For secure automated file uploads from Linux to Azure File Share without SAS keys, use Azure Managed Identity with the Azure CLI or SMB over AD—avoids embedded secrets entirely. This is the gold standard for enterprise Linux hosts.

Recommended Approach: Azure CLI with Managed Identity

Set Up Managed Identity:

Create a User Assigned Identity: az identity create --resource-group <rg> --name file-upload-identity.

Assign Storage role: az role assignment create --assignee <identity-principal-id> --role "Storage File Data SMB Share Contributor" --scope /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Storage/storageAccounts/<storage>/fileServices/default.

On Linux VM, login: az login --identity (system-assigned) or install MSI extension and use az login --identity -i <user-identity-id>.

Automate Upload via Cron:

Install Azure CLI: curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash.

Script (save as /usr/local/bin/upload-files.sh):
#!/bin/bash az login --identity az storage file upload-batch --destination <storage-account>.file.core.windows.net/<share> --source /local/path/to/files/ --destination-path . --account-name <storage-account> --auth-mode login

Make executable: chmod +x /usr/local/bin/upload-files.sh.

Add to crontab: crontab -e, then * * * * * /usr/local/bin/upload-files.sh (adjust schedule).

Alternative: SMB with Azure AD Kerberos (No CLI Needed)

Join Linux to Azure AD via SS64 (System Assigned Managed Identity): Install realmd and sssd, then sudo realm join --user=******@domain.com yourdomain.com.

Mount share: sudo mount -t cifs //<storage>.file.core.windows.net/<share> /mnt/azurefiles -o vers=3.0,sec=ntlmssp,username=<storage-account>,password=<key-from-env>,dir_mode=0777,file_mode=0777—but swap password for AAD auth.

Use rsync or cp in cron for uploads.

Managed Identity rotates creds automatically and scopes to RBAC—no keys to leak. For multi-host, use User Assigned. Test with az storage file list --share-name <share> --account-name <storage> --auth-mode login.

Best Regards,

Jerald Felix
EnterpriseArchitect 6,301 Reputation points

2025-10-27T03:33:58.1133333+00:00

Hi @Jerald Felix ,

Linux VM, login: az login --identity (system-assigned) or install MSI extension and use az login --identity -i <user-identity-id>.

How do I install the files from within the Linux system for the above?
EnterpriseArchitect 6,301 Reputation points

2025-10-28T14:05:22.6966667+00:00

@Jerald Felix

The OS is quite old IBM AIX server.
EnterpriseArchitect 6,301 Reputation points

2025-11-06T03:48:07.1866667+00:00

Yes, that does make sense.

Thank you for the confirmation.

Answer accepted by question author

0 additional answers

Your answer

EnterpriseArchitect 6,301 Reputation points

2025-10-27T03:33:58.1133333+00:00

Hi @Jerald Felix ,

Linux VM, login: az login --identity (system-assigned) or install MSI extension and use az login --identity -i <user-identity-id>.

How do I install the files from within the Linux system for the above?
EnterpriseArchitect 6,301 Reputation points

2025-10-28T14:05:22.6966667+00:00

@Jerald Felix

The OS is quite old IBM AIX server.
EnterpriseArchitect 6,301 Reputation points

2025-11-06T03:48:07.1866667+00:00

Yes, that does make sense.

Thank you for the confirmation.

Answer 1

Hi EnterpriseArchitect,

Good day, i hope you are doing great!

Thank you for your follow-up about IBM AIX.

The Azure CLI and Managed Identity approach applies only to supported Linux distributions and is not available on AIX, since Azure CLI binaries and the managed identity agent are not provided for that platform.

for more info, please refer the below MS official links.

Enable Kerberos authentication for Linux with Azure Files

For secure automated uploads from AIX, consider using Active Directory (AD) authentication via SMB with Kerberos, which avoids storing or using SAS keys.

Recommended Steps:

Ensure the AIX SMB client (smbc.rte) and Kerberos libraries are installed.
Join the AIX system to your AD domain and configure Kerberos with your domain and realm details.
Verify authentication using kinit to obtain a Kerberos ticket.
Mount the Azure File Share using SMB v3 with Kerberos authentication.
Automate file transfers using rsync, cp, or shell scripts scheduled through cron

I hope this helps. Please let me know if you have any further questions.

Thanks,

Harish.

EnterpriseArchitect 6,301 Reputation points

2025-11-06T04:41:10.4566667+00:00

Thank you @Harish Peddapally ,
This does make sense, the server is way too old.

Share via

Securely automate scheduled file upload from Linux to Azure File share.

Recommended Approach: Azure CLI with Managed Identity

Alternative: SMB with Azure AD Kerberos (No CLI Needed)

0 additional answers

Your answer