Christos Polydorou

The Secure File Transfer Protocol or SFTP has been one of the most secure and reliable ways to exchange files between two systems for as long as I can remember. Especially for system-to-system communications that require authentication using keys. Storage accounts on the other hand are a more modern way to handle data, providing blob service along with the traditional SMB and NFS file shares. SMB and NFS are not suitable for communications over the public internet leaving us with blob as the only option - apart from deploying a Linux machine.   Fortunately, Microsoft decided to add SFTP support to the blob service of the storage account. To enable the SFTP support for your storage account, you have to enable the hierarchical namespace feature and of course, the SFTP support, as shown in the below screenshot: To confirm that the functionality has been enabled for your storage account, you may check the Settings of the storage account where a new blade named SFTP should be avail...

In the era of the cloud, we are creating resources that in the majority of the cases are exposed to the public internet, lowering the security posture of the solution. Resources such as Virtual Machines, Database Servers, etc. can be easily left unprotected when the strategy and governance rules are not followed. The storage account resource, for instance, when configured with a public endpoint, is reachable from all networks, including public internet. If we try to resolve the name of one of the endpoints of the storage account - let's take file for example - we'll be directed to a public IP address: This can be considered a security risk since we are not only exposing the storage account to the entire internet but also allow data to traverse networks that we have no control over. To avoid this risk, we can configure a Private Endpoint for the storage account on the VNet that the clients are connected to. When using a Private Endpoint, an interface to the storage account will ...