SFTP enable Storage Account firewall

Question

Hi,

I have configured an Azure Storage Account with public access enabled, restricted to selected virtual networks and IP addresses. Additionally, I have enabled SFTP on this storage account. However, I noticed that SFTP traffic is not blocked, even though the firewall restrictions are in place.

Could someone confirm if SFTP access bypasses the firewall whitelisting configuration? Specifically, does enabling SFTP allow traffic to the endpoint regardless of the firewall settings?

Looking forward to your clarification.

Cheers

Answer 1

Hi Melan Peiris - Thanks for reaching out over Q&A Forum.

Ideally that shouldn't be the case. When using SFTP, you may want to limit public access through configuration of a firewall, virtual network, or private endpoint. These settings are enforced at the application layer, which means they aren't specific to SFTP and will impact connectivity to all Azure Storage Endpoints. So, even the SFTP calls should also tend to get blocked.

I'll test this once however it would request you to test it again just in case there is some regression in applying the changes and also enable the logging to see what is the IP being passed for calls.