Unable to setup the ACLs at folder level on a Blob Container using local SFTP user

Ramkumar Perumal 0 Microsoft Employee

Unable to setup the ACLs at folder level on a Blob Container using local SFTP user.

The below documentation says Azure SFTP permissions can be setup for local user using ACLs and mentioned this capability is in Preview. Not sure if this is the issue why I am not able to setup.

https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support#access-control-lists-acls

This documentation is what referred by the above URL to Setup the ACLs, but there are no information on how to setup for local users.

https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-access-control

Thanks.

Sathvika Reddy Dopathi 200 Reputation points Microsoft External Staff

2025-03-06T06:51:44.17+00:00
Hi @Ramkumar Perumal,

Adding to the below mentioned answer you can also manage permissions for users accessing your blob storage via SFTP using RBAC (Role Back Access Control) and SAS tokens (Shared Access Signatures).

Make sure that SFTP support is enabled for your Azure Blob Storage account. To enable this, go to the SFTP setting in the storage account.

Create a Local User for SFTP Access –

Go to the Storage account in Azure portal.

Under Settings, Select SFTP and then click on Add local user.

Configure the local user with a password for authentication.

You can set ACLs on a specific directory within your Blob container using either Azure CLI. you can grant a user read, write, or execute permissions on a specific directory.

Select Access Control (IAM) and then Add role assignment. Give the necessary permissions to access the Blob container and directories. Verify that the permissions are applied correctly.

Additional Steps:

Try setting ACLs at the container level for your local SFTP user to see if that works. This will help determine if the issue is specific to folder-level permissions. If possible, test with Azure AD users instead of local SFTP users. Azure AD integration might have better support for ACLs.

If folder-level ACLs are not yet fully supported, you can use virtual directory prefixes to organize your blobs and apply ACLs at the virtual directory level. As an alternative to ACLs, you can use Shared Access Signature (SAS) tokens to grant limited-time access to specific blobs or folders to your local SFTP users.

References:

Use the Azure portal to manage ACLs in Azure Data Lake Storage - Azure Storage | Microsoft Learn

Authorize access to Azure Blob Storage for an SFTP client - Azure Storage | Microsoft Learn

Please let us know if you have any further queries. I’m happy to assist you further.

Please consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Sathvika Reddy Dopathi 200 Reputation points Microsoft External Staff

2025-03-07T05:06:31.1266667+00:00

Hi @Ramkumar Perumal,

Just checking in to see if the above suggestion helped you to solve your issue, please let us know if you have any further queries. If the above suggestion help do "Upvote" for the answer that helped you, this can be beneficial to other community members.
Ramkumar Perumal 0 Reputation points Microsoft Employee

2025-03-07T22:58:47.12+00:00

Thanks for details. The references are not accurate for setting ACLs for local SFTP users. I have already enabled SFTP and wanted to restrict permissions using local user. I do not want to use SAS tokens.
Sathvika Reddy Dopathi 200 Reputation points Microsoft External Staff

2025-03-10T04:23:28.5966667+00:00
Hi @Ramkumar Perumal,

Thanks for the response.

I understand that you have enabled SFTP on your Azure Blob Storage account and want to restrict permissions using local users. You can manage and restrict with the help of RBAC (Role Based Access Control).

After creating the local user, assign RBAC roles to the local user.

Go to the Storage account, under the settings select Access Control (IAM).

Click on +Add (Add Role Assignment), Select the following roles you want.

In the Assign access to section, select User, group. Search for the local user you created before and select them.

Click on Save to apply the roles which you gave.

Please let us know if you have any further queries. I’m happy to assist you further.

Please consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

1 answer

Amrinder Singh 5,715 Reputation points Microsoft Employee

2025-03-06T05:38:28.5566667+00:00

Hi Ramkumar Perumal,

Thanks for reaching out over Q&A Forum.

The first link that you are shared is w.r.t. managing ACL for ADLSGen2 and not SFTP.

You can follow this link for managing the ACLs for SFTP Storage via Portal, PS or CLI

https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support-authorize-access?tabs=azure-portal#give-permission-to-containers

Hope this helps! Please let us know if you have any further quires, we will be glad to assist you.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Please sign in to rate this answer.
Ramkumar Perumal 0 Reputation points Microsoft Employee

2025-03-07T23:01:45.81+00:00

Thanks Amrinder. The reference link is what I used to create user and setup permissions to the container. But I want to restrict the access to the child folder. For example, i have the following folder structure;

Root/Parent-1/Child-1/SubChild-1.

I created local users, and container access. But I want the SFTP local user to ONLY acces SubChild-1 folder and not the entire directory.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Unable to setup the ACLs at folder level on a Blob Container using local SFTP user

1 answer

Your answer