Share via

Add ACL permissions for a local user in SFTP enabled storage account.

Sumit Gaur 285 Reputation points
2025-08-02T15:18:20.28+00:00

We are using an Azure Storage Account as an SFTP server to support various integration needs. For one of the integration Instead of creating separate blob containers for each application, we designed a shared folder structure within a single container containerA. This approach allows multiple applications to send and receive data while keeping the setup manageable and let us build a generic integration behind it using Azure Function / Azure Logic Apps.The folder structure in containerA looks like this:

/containerA

├── App1

│ ├── Incoming

│ └── Outgoing

└── App2

├── Incoming

└── Outgoing

SFTP Access Setup

We created two local users, one for each application (App1 and App2).

  • Both users were granted read access to containerA and were configured to use Access Control List (ACL) authorization.
  • Our goal is to isolate access so that:

App1 can only access /App1/**

App2 can only access /App2/**

  • Neither application can access the other’s directories

While Microsoft documentation mentions that directory-level access isolation is possible through ACLs, it is not clearly explained where or how to define these ACLs at the virtual directory level within the blob container when using SFTP.

When setting up local users, we only get the option to enable ACL-based authorization, but not to explicitly define or assign ACLs for specific folders.

https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support-authorize-access?tabs=azure-portal

is this something doable via ACL and if so how to configure this at user or container level?

User's image User's image

Azure Storage
Azure Storage
Globally unique resources that provide access to data management services and serve as the parent namespace for the services.
0 comments
Accepted answer
  1. Manu Philip 20,456 Reputation points MVP Volunteer Moderator
    2025-08-03T17:15:06.7833333+00:00

    Hi Sumit Gaur

    I am documenting the steps needed to assign ACL for local users for respective directories as you needed

    1. Create an admin user first to assign the ACL for App1 and App2. For example admin1. containerA as the home directory
    2. Allow all permissions to the admin user as below: User's image
    3. Get the connection string for the admin user like below: User's image
    4. Connect sftp with the admin user as below: User's image Use the password copied during the admin user creation
    5. Now, the admin user can list the folders for App1 and App2 using ls command, like below: User's image
    6. Now admin user has to take ownership of all directories using the command chmod 001 .
    7. As the next step, admin user can start assigning ownership permissions to users on respective folders as below. Note that the ownership permissions are assigned to the corresponding user id . 1000 and 1001 are my user ids User's image chown 1000 fold1 chown 1001 fold1
    8. Now we are set with the ACL for the users on required folders.
    9. You may test it by connecting the sftp for corresponding users User's image Hope the above steps will help to work out on assigning the required permissions

    Hope this helps.

    --please don't forget to upvote and Accept as answer if the reply is helpful--

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Manu Philip 20,456 Reputation points MVP Volunteer Moderator
    2025-08-03T11:39:05.93+00:00

    Hi Sumit Gaur

    Have you checked the following reference, which shows how to assign container level permission to sftp users using ACL

    Give permission to containers

    Hope this helps.

    --please don't forget to upvote and Accept as answer if the reply is helpful--

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.