Hi all, We need to implement solution like this: Create 1 storage account and place there "folder" for each customer. Each folder should be have NTFS permission and account from on-prem AD Connect to each folder using SMB Each customer could have some different accounts to put data to the folder using sftp It would be great to have possibility to pass data from cutomer's storage to our storage(customer folder) in feature Is this solution possible? I haven't found something similar in Internet. I know that recomendation is create storage account for each customer, to use SAS or storage key for connection/mounting. But if you have lots of customers to have lots of storage accounts is not good ideas I think. Anyway it would be great to hear variants for this solution TIA Best regards, Viktor

Separate folder in Azure storage for each customer

Viktor Korokhov 130

Hi all,

We need to implement solution like this:

Create 1 storage account and place there "folder" for each customer.
Each folder should be have NTFS permission and account from on-prem AD
Connect to each folder using SMB
Each customer could have some different accounts to put data to the folder using sftp
It would be great to have possibility to pass data from cutomer's storage to our storage(customer folder) in feature

Is this solution possible? I haven't found something similar in Internet. I know that recomendation is create storage account for each customer, to use SAS or storage key for connection/mounting. But if you have lots of customers to have lots of storage accounts is not good ideas I think.

Anyway it would be great to hear variants for this solution

TIA

Best regards,

Viktor

Hari Babu Vattepally 1,195 Reputation points Microsoft Vendor

2024-12-19T12:19:28.6233333+00:00

Hi Viktor Korokhov

Thanks for posting and using Microsoft Q&A Forum.

We are reaching out to the internal team to get more information related to your query and will get back to you as soon as we have an update.
KarishmaTiwari-MSFT 20,307 Reputation points Microsoft Employee

2024-12-19T22:10:17.96+00:00
Hi Viktor Korokhov , you can achieve this with few modifications.
You can set up a single Azure Storage account and leverage Azure Files to create file shares, each representing a customer folder. Join the Azure Storage account to your on-premises Active Directory Domain Services (AD DS). This allows you to use NTFS permissions for access control. Mount the Azure file shares using the SMB protocol from on-premises or Azure VMs. Set up an SFTP server to allow customers to upload data to their respective folders and use Azure Data Factory or Azure Logic Apps to automate data transfer from customer storage to your storage.

Considerations:

Manage NTFS permissions and access control carefully.

Implement robust security measures, including encryption and network security configurations, to protect the data
Viktor Korokhov 130 Reputation points

2024-12-20T09:41:24.14+00:00

Hi KarishmaTiwari-MSFT ,
Many thanks for answer. Yes, we tried to implement this solution. We use CrushFTP on the present time and it connects to on-prem fileshare using SMB without any problems. But moving to Azure and using the similar scheme doesn't work.

We have a diagram like this

we asked CrushFTP support according this situation and answer was next:
"The bottom line is this can't work.CrushFTP cannot do SMB3 connection to azure as the SMB3 library doesn't support kerberos to Azure like that. Your windows machine can because of other magical components in your network that allow it to work...but our SMB3 library can't utilize that magic.We can't make a straight SMB3 connection since your Azure requires kerberos. We can't make kerberos because you likely can't access it directly with kerberos to do the KDC and REALM handling. We can't utilize your other magic on your network your domain joined windows PCs do.If you have some DFS share on your own network we can access that behind the scenes points to Azure (but we won't ever need to know that), then this may work, but I don't even know if DFS can do that."
Do I understand correctly it is only specific problem for CrushFTP software? If yes, do you have recomendations for SFTP software in this case?

Best regards,

Viktor
KarishmaTiwari-MSFT 20,307 Reputation points Microsoft Employee

2024-12-24T00:48:02.14+00:00

@Viktor Korokhov Thanks for sharing the details. I am confirming with the Product team on this, will share as I hear back from them.

Share via

Separate folder in Azure storage for each customer

Your answer