How to whitelist an External Customer's Azure VM to allow them to connect to our Azure SFTP

Jack Wilson 0

We have an internal Azure SFTP we use to receive data feeds from external clients.

We add external client's Static IPs to the whitelist to allow them to connect.

One of our external clients is moving to an Azure hosted virtual machine, and we are now unable to whitelist their connection.

They've provided their public IP, however checking the Azure SFTP logs I can see that the connections are actually being logged as a private IP (one within Azure).

I imagine this is because its actually Azure talking to itself (Azure VM to Azure SFTP), but as its a private IP it cannot be whitelisted.

Is there another way to allow the connections from this external client's Azure VM?

Would a private endpoint be required for this?

Thanks,

Jack

Keshavulu Dasari 3,280 Reputation points Microsoft Vendor

2025-02-13T18:35:07.9433333+00:00
Hi Jack Wilson ,

You are understanding is right the issue occurs due to the internal Azure connection, which uses private IPs. To resolve this, you can use a private endpoint for your Azure SFTP. This will allow the external client's Azure VM to connect securely without needing to whitelist public IPs.

Using a private endpoint ensures that the traffic remains within the Azure network, providing a secure and efficient way to connect without relying on public IP whitelisting

Create a Private Endpoint:

Navigate to your Azure Storage account in the Azure portal.

Under the Networking section, select Private endpoint connections.

Click + Private endpoint to create a new private endpoint.

Follow the prompts to configure the private endpoint, ensuring it connects to your SFTP service.

Ensure that the DNS settings are configured to resolve the private endpoint. You might need to set up a private DNS zone and link it to your virtual network.

Modify your NSG rules to allow traffic from the private endpoint to your SFTP service.

For more information:

https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support-connect

https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support

I hope this information helps! Let us know if you have any further questions. We will be glad to assist you further.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Keshavulu Dasari 3,280 Reputation points Microsoft Vendor

2025-02-14T19:49:26.4466667+00:00

Hi Jack Wilson ,

I hope this information helps! Let us know if you have any further questions. We will be glad to assist you further.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Share via

How to whitelist an External Customer's Azure VM to allow them to connect to our Azure SFTP

Your answer