SFTP for Azure Blob Storage

SFTP for Azure Blob, with Entra ID sign-in.

Give your partners SFTP, FTPS and HTTPS access to your Blob containers, signed in through Microsoft Entra ID, with MFA, and with nothing to reconfigure on your storage account.

Your blobs stay in your subscription. We never store a copy, and we never hold your storage account keys, SAS tokens or service principal secrets.

Start your free trial See how it works

14 days. No credit card. No feature locks.

Path of one uploadPartner to container
1Your partner's clientWinSCP, FileZilla, OpenSSH, a script or a browser. Nothing new to install.
2SFTP.cloudSigns the user in through Entra ID and applies policy. Stores nothing.
Your Azure subscription
3Your Storage ConnectorIn your virtual network, next to the storage account. Dials out, never accepts inbound.
4Your Blob containerUnchanged. Same account, same tiers, same lifecycle rules.

Inbound rules in your network security group0

01The comparison

Native SFTP is fine for simple cases. Here is where it stops.

Azure has built-in SFTP support for Blob Storage, and for a handful of users it is a reasonable choice. It is worth knowing what it does and doesn't do before you commit a storage account to it.

Azure native SFTP

Local usersonly

Each one signs in with a password Azure generates, or an SSH key.

No MFAmultifactor authentication is not supported
Hourlycharged for every hour SFTP is enabled
  • Requires hierarchical namespace on the storage account, a setting you cannot turn off later
  • Local users don't work with Azure RBAC or ABAC, so access is managed separately from the rest of your Azure permissions
  • SFTP and FTPS only through separate services; no browser client
  • Microsoft recommends turning SFTP off when you aren't actively transferring

SFTP.cloud

Entra IDsingle sign-on

Transfer accounts follow the identity provider you already run.

MFAfor administrators and transfer accounts
One placeto offboard: a leaver in Entra ID is a leaver here
  • No hierarchical namespace requirement, and no storage account setting you cannot undo
  • SFTP, FTPS, FTPES and an HTTPS web client on the same plan
  • Geo-fencing and automatic blocking of attacking addresses
  • Dual signed audit trails you verify yourself, with a tool you download
From $2,400 a year, no per-GB charge

02How it works

Keep the storage account as it is. Add one small Connector next to it.

  1. 01

    Deploy a Storage Connector in your subscription.

    As a container or a small VM, usually in the same region as your storage account.

  2. 02

    Give it access with an identity you own.

    You create the credential and scope it to the containers you choose. It is held inside your subscription and never reaches us.

  3. 03

    Your partners connect over SFTP, FTPS, FTPES or HTTPS.

    Files stream between your container and your partner through the Connector's outbound channel. They are never written to a disk we own.

Runs on
Azure VMs, Container Instances, Container Apps or AKS. Anything that runs a container or a Linux or Windows service.
Network
Outbound connections only. Your network security group stays closed inbound.
Storage account
Works with or without hierarchical namespace. Nothing to enable, nothing to migrate.
Blobs
Stored as ordinary blobs. Access tiers, lifecycle management, soft delete and replication keep working.
Azure CLIScoped to one container
az role assignment create \
  --assignee <connector-identity> \
  --role "Storage Blob Data Contributor" \
  --scope /subscriptions/<sub-id>\
/resourceGroups/<rg>\
/providers/Microsoft.Storage\
/storageAccounts/<account>\
/blobServices/default\
/containers/partner-exchange
Grant the Connector's identity access to one container, and nothing else in the account. Use Storage Blob Data Reader for read-only access.

03Identity and security

Your identity provider decides who gets in. Your subscription holds the keys.

Nothing in our infrastructure can reach your storage account, so nothing in our infrastructure could be stolen and used against it.

  • 0Storage account keys
  • 0SAS tokens
  • 0Service principal secrets
  • 01

    Sign-in through Entra ID, with MFA.

    Transfer accounts and administrators sign in with the identity provider you already run, under the MFA and conditional access rules you already set.

  • 02

    Offboarding in one place.

    Disable someone in Entra ID and they lose access here too. There is no second list of local users to keep in step.

  • 03

    Optional encryption of the blobs themselves.

    Encrypt with a key that stays on your Connector and that we never receive. Anyone who reaches the container by another route finds only ciphertext. How we're built

04What you get

Everything in the product, on top of the storage account you already have.

05FAQ

SFTP and Azure Blob Storage, common questions.

Does Azure Blob Storage support SFTP natively?

Yes. Azure can expose a storage account over SFTP, with some conditions: hierarchical namespace must be enabled on the account, users are local to that account, MFA is not supported, and the feature is billed by the hour while it is enabled.

Do I need hierarchical namespace (Data Lake Storage Gen2) for SFTP.cloud?

No. SFTP.cloud works with standard Blob Storage accounts and with accounts that have hierarchical namespace enabled. You don’t change any setting on the storage account.

Can my partners sign in with Microsoft Entra ID?

Yes. Transfer accounts can sign in through Entra ID single sign-on, with MFA. Disable a user in Entra ID and their access to SFTP.cloud ends with it.

Does SFTP.cloud store copies of my files?

No. Files stream through the Storage Connector in your subscription, directly to and from your container. They are never written to a disk we own.

Do you need my storage account key or a SAS token?

No. The Connector authenticates to Blob Storage with a credential you create inside your subscription. That credential never leaves it, and you can rotate or revoke it without telling us.

What does it cost?

From $2,400 a year on the Shared plan, with 15 transfer accounts and 3 Storage Connectors included, and no per-gigabyte or per-hour charge. Azure still bills your storage and operations as usual.

Point it at a container and try it today.

Deploy a Connector, grant it access to one container and send your first file in an afternoon. Fourteen days, no credit card, and nothing to cancel if it is not for you.

Start your free trial

Want to see the moving parts first? See how it works or talk to an engineer. The person who answers builds the product.