Azure Blob Storage · Docs

Azure Blob Storage isn’t S3-compatible, so CloudFile talks to it through its own Blob API. You connect a container in a storage account and sign in with one of the account’s two access keys.

Before you start

An Azure subscription and permission to create storage accounts.
The Allow storage account key access setting must stay on for the account. If your organization enforces Microsoft Entra-only access with Azure Policy, ask an admin to exempt this account.

1. Create a storage account

An access key works for every container in its storage account, so give CloudFile an account of its own.

In the Azure portal, go to Storage accounts and choose Create.
Pick a resource group, name the account (3 to 24 lowercase letters and digits, for example acmesftp) and choose a region, for example Germany West Central.
Keep Primary service at Azure Blob Storage or Azure Data Lake Storage Gen2 and Performance at Standard. Locally-redundant storage (LRS) is enough for most servers.
On the Advanced tab, leave Enable hierarchical namespace off and keep the access tier at Hot. Cool and Cold tiers charge for reads and have minimum storage durations.
On the Networking tab, keep public network access enabled from all networks. CloudFile reaches the account over the internet.
On the Data protection tab, consider turning Enable soft delete for blobs off. It’s on by default with a 7-day retention, and soft-deleted files keep accruing storage charges. Leave versioning off: every rename then keeps a full copy of the file.
Choose Review + create, then Create.

2. Create the container

Open the storage account and go to Data storage → Containers.
Choose + Container, name it (3 to 63 lowercase letters, digits and single hyphens, for example sftp-files) and keep Anonymous access level at Private.
Choose Create.

3. Copy an access key

In the storage account, go to Security + networking → Access keys.
Choose Show next to key1 and copy the Key, a long base64 string ending in ==. Copy the key itself, not the connection string.

Azure keeps two keys so you can rotate them without downtime: switch CloudFile to key2, then regenerate key1.

4. Connect it

In CloudFile, go to Storage → Add bucket and choose Azure Blob Storage:

Field	Value
Container	Your container name, e.g. `sftp-files`
Storage account	Your storage account name, e.g. `acmesftp`
Endpoint	`https://<account>.blob.core.windows.net`, filled in for you
Account key	The access key from step 3
Name	Optional, e.g. `Production`

Change the endpoint only for a sovereign cloud, for example https://<account>.blob.core.usgovcloudapi.net or https://<account>.blob.core.chinacloudapi.cn.

Click Test connection, then Save. To use the container, open a server and pick it under Settings → Storage.

How files look in Azure

Files are stored as block blobs under <folder>/<username>/<path>, the same layout as on S3. An empty folder is a zero-byte blob named like the folder, with the hdi_isfolder metadata flag that Azure Storage Explorer also understands. Download links in the web file manager and in webhook payloads are read-only SAS links for that one blob, signed with the account key.

Uploads from the browser

The web file manager and file requests upload blocks straight to the container with write-only SAS links, and CloudFile commits them when the upload is complete. For that the storage account needs a CORS rule for https://cloudfile.dev: under Settings → Resource sharing (CORS) → Blob service, allow origin https://cloudfile.dev, methods PUT, GET, HEAD, allowed headers *, exposed headers *, max age 3600. Without it, browser uploads go through our servers and are limited to 100 MB per file. See Uploads from the browser.

Troubleshooting

Writing a test file failed: Server failed to authenticate the request. The account key is wrong or was regenerated, or the storage account name doesn’t match the key. Copy key1 again from Access keys.
Writing a test file failed: Key based authentication is not permitted on this storage account. Allow storage account key access is off. Turn it on under Settings → Configuration.
Writing a test file failed: The specified container does not exist. Check the container name. CloudFile never creates containers.
Writing a test file failed: This request is not authorized to perform this operation. The account’s firewall blocks CloudFile. Allow public network access from all networks under Security + networking → Networking.
Deleting the test file failed. The container has an immutability policy or a legal hold.

See Your own bucket for how files are laid out and how switching storage works.