Connect to Azure Blob Storage by using the SSH File Transfer Protocol (SFTP) (preview)
You can securely connect to the Blob Storage endpoint of an Azure Storage account by using an SFTP client, and then upload and download files. This article shows you how to enable SFTP, and then connect to Blob Storage by using an SFTP client.
To learn more about SFTP support for Azure Blob Storage, see SSH File Transfer Protocol (SFTP) in Azure Blob Storage.
To help us understand your scenario, please complete this form before you begin using SFTP support. After you've tested your end-to-end scenarios with SFTP, please share your experience by using this form. Both of these forms are optional.
A standard general-purpose v2 or premium block blob storage account. You can also enable SFTP as you create the account. For more information on these types of storage accounts, see Storage account overview.
The hierarchical namespace feature of the account must be enabled. To enable the hierarchical namespace feature, see Upgrade Azure Blob Storage with Azure Data Lake Storage Gen2 capabilities.
If you're connecting from an on-premises network, make sure that your client allows outgoing communication through port 22 used by SFTP.
Enable SFTP support
This section shows you how to enable SFTP support for an existing storage account. To view an Azure Resource Manager template that enables SFTP support as part of creating the account, see Create an Azure Storage Account and Blob Container accessible using SFTP protocol on Azure. To view the Local User REST APIs and .NET references, see Local Users and LocalUser Class.
In the Azure portal, navigate to your storage account.
Under Settings, select SFTP.
This option appears only if the hierarchical namespace feature of the account has been enabled. To enable the hierarchical namespace feature, see Upgrade Azure Blob Storage with Azure Data Lake Storage Gen2 capabilities.
Select Enable SFTP.
If no local users appear in the SFTP configuration page, you'll need to add at least one of them. To add local users, see the next section.
Azure Storage doesn't support shared access signature (SAS), or Azure Active directory (Azure AD) authentication for accessing the SFTP endpoint. Instead, you must use an identity called local user that can be secured with an Azure generated password or a secure shell (SSH) key pair. To grant access to a connecting client, the storage account must have an identity associated with the password or key pair. That identity is called a local user.
In this section, you'll learn how to create a local user, choose an authentication method, and assign permissions for that local user.
To learn more about the SFTP permissions model, see SFTP Permissions model.
This section shows you how to configure local users for an existing storage account. To view an Azure Resource Manager template that configures a local user as part of creating an account, see Create an Azure Storage Account and Blob Container accessible using SFTP protocol on Azure.
In the Azure portal, navigate to your storage account.
Under Settings, select SFTP, and then select Add local user.
In the Add local user configuration pane, add the name of a user, and then select which methods of authentication you'd like associate with this local user. You can associate a password and / or an SSH key.
While you can enable both forms of authentication, SFTP clients can connect by using only one of them. Multifactor authentication, whereby both a valid password and a valid public and private key pair are required for successful authentication is not supported.
If you select SSH Password, then your password will appear when you've completed all of the steps in the Add local user configuration pane. Note that SSH passwords are generated by Azure and are minimum 88 characters in length.
If you select SSH Key pair, then select Public key source to specify a key source.
The following table describes each key source option:
Option Guidance Generate a new key pair Use this option to create a new public / private key pair. The public key is stored in Azure with the key name that you provide. The private key can be downloaded after the local user has been successfully added. Use existing key stored in Azure Use this option if you want to use a public key that is already stored in Azure. To find existing keys in Azure, see List keys. When SFTP clients connect to Azure Blob Storage, those clients need to provide the private key associated with this public key. Use existing public key Use this option if you want to upload a public key that is stored outside of Azure. If you don't have a public key, but would like to generate one outside of Azure, see Generate keys with ssh-keygen.
Select Next to open the Container permissions tab of the configuration pane.
In the Container permissions tab, select the containers that you want to make available to this local user. Then, select which types of operations you want to enable this local user to perform.
In the Home directory edit box, type the name of the container or the directory path (including the container name) that will be the default location associated with this local user.
To learn more about the home directory, see Home directory.
Select the Add button to add the local user.
If you enabled password authentication, then the Azure generated password appears in a dialog box after the local user has been added.
You can't retrieve this password later, so make sure to copy the password, and then store it in a place where you can find it.
If you chose to generate a new key pair, then you'll be prompted to download the private key of that key pair after the local user has been added.
Local users have a
sharedKeyproperty that is used for SMB authentication only.
Connect an SFTP client
You can use any SFTP client to securely connect and then transfer files. The following screenshot shows a Windows PowerShell session that uses Open SSH and password authentication to connect and then upload a file named
The SFTP username is
username. In the example above the
storage_account_name is "contoso4" and the
username is "contosouser." The combined username becomes
contoso4.contosouser for the SFTP command.
You might be prompted to trust a host key. During the public preview, valid host keys are published here.
After the transfer is complete, you can view and manage the file in the Azure portal.
The Azure portal uses the Blob REST API and Data Lake Storage Gen2 REST API. Being able to interact with an uploaded file in the Azure portal demonstrates the interoperability between SFTP and REST.
See the documentation of your SFTP client for guidance about how to connect and transfer files.
Connect using a custom domain
When using custom domains the connection string is
firstname.lastname@example.org. If home directory has not been specified for the user, it is
Ensure your DNS provider does not proxy requests. Proxying may cause the connection attempt to time out.
Connect using a private endpoint
When using a private endpoint the connection string is
email@example.com. If home directory has not been specified for the user, it is
Ensure you change networking configuration to "Enabled from selected virtual networks and IP addresses" and select your private endpoint, otherwise the regular SFTP endpoint will still be publicly accessible.
SFTP is a platform level service, so port 22 will be open even if the account option is disabled. If SFTP access is not configured then all requests will receive a disconnect from the service. When using SFTP, you may want to limit public access through configuration of a firewall, virtual network, or private endpoint. These settings are enforced at the application layer, which means they are not specific to SFTP and will impact connectivity to all Azure Storage Endpoints. For more information on firewalls and network configuration, see Configure Azure Storage firewalls and virtual networks.
Audit tools that attempt to determine TLS support at the protocol layer may return TLS versions in addition to the minimum required version when run directly against the storage account endpoint. For more information, see Enforce a minimum required version of Transport Layer Security (TLS) for requests to a storage account.
- SSH File Transfer Protocol (SFTP) support for Azure Blob Storage
- Limitations and known issues with SSH File Transfer Protocol (SFTP) support for Azure Blob Storage
- Host keys for SSH File Transfer Protocol (SFTP) support for Azure Blob Storage
- SSH File Transfer Protocol (SFTP) performance considerations in Azure Blob storage
Submit and view feedback for