Need a vendor, a legacy system or a partner to upload files over SFTP, but you don’t want to maintain a server running sshd? Azure Blob Storage supports SFTP natively: you get a standard SFTP endpoint backed by cloud storage, with no virtual machines to patch. This guide walks you through it step by step.

How it works

Azure exposes the SFTP protocol directly on a storage account. Clients connect with any SFTP client (FileZilla, WinSCP, the sftp command) and the files land as blobs in your containers. Authentication uses storage-native local users (not Azure AD), each with its own directory and permissions.

Requirements

  • A StorageV2 (general purpose v2) or BlockBlobStorage account.
  • Hierarchical namespace (Data Lake Gen2) enabled — it’s required for SFTP and must be set when the account is created (it can’t be easily turned on afterward).
  • A container that will serve as the user’s home directory.

Step 1 — Create the account with SFTP and hierarchical namespace

# Create the account with hierarchical namespace + SFTP in one command
az storage account create 
  --name MYACCOUNT 
  --resource-group MYGROUP 
  --location eastus2 
  --sku Standard_LRS 
  --kind StorageV2 
  --enable-hierarchical-namespace true 
  --enable-sftp true

# (If the account already exists and has hierarchical namespace, just enable SFTP:)
az storage account update -n MYACCOUNT -g MYGROUP --enable-sftp true

Also create the container that will be the user’s “home”, for example uploads.

Step 2 — Create a local user

Each SFTP user is a storage “local user”, with a home directory and permissions on a container. Permissions are expressed with letters: r read, c create, w write, d delete, l list.

az storage account local-user create 
  --account-name MYACCOUNT 
  --resource-group MYGROUP 
  --name vendor1 
  --home-directory uploads 
  --permission-scope permissions=rcwdl service=blob resource-name=uploads 
  --has-ssh-password true

For SSH key authentication (more secure than a password), use --has-ssh-key true --ssh-authorized-key key="ssh-rsa AAAA..." instead of the password. If you use a password, generate it with:

az storage account local-user regenerate-password 
  --account-name MYACCOUNT -g MYGROUP --name vendor1

Step 3 — Connect

The SFTP username has the format account.localuser and the host is account.blob.core.windows.net (port 22):

sftp MYACCOUNT.vendor1@MYACCOUNT.blob.core.windows.net
# then: put file.csv  /  ls  /  get report.xlsx

In FileZilla/WinSCP you use the same host, username MYACCOUNT.vendor1 and the corresponding password or private key.

Important considerations

  • Cost: having SFTP enabled carries an hourly charge (about US$0.30/hr), whether or not it’s in use — that’s hundreds of dollars a month if left on permanently. If SFTP is occasional (monthly uploads), it’s worth enabling and disabling it with az storage account update --enable-sftp around the process.
  • Security: prefer SSH keys over passwords; restrict access with the account’s firewall rules (allowed IPs); give each user only the permissions and container they need.
  • Hierarchical namespace: remember it must be enabled at account creation. If your account doesn’t have it, you’ll need a new account and a data migration.
  • Limitations: SFTP on Blob doesn’t support every protocol command (for example, some rename/symlink operations) and is not a replacement for FTPS; check your client’s compatibility.

Conclusion

Azure Blob Storage as SFTP gives you a familiar endpoint for partners and legacy systems without managing servers — you pay for storage and for the time SFTP is active. For recurring transfers, automate the on/off toggle and keep an eye on the cost.

Keep reading: Infrastructure Support · Connect Claude with Odoo.

At Grupo TANDEM we design and implement secure, tailored Azure infrastructure. If you need to set up file exchange or any cloud service, let’s talk.