# Azure Blob Storage

> Store your SFTP server's files in your own Azure Blob Storage container, using the storage account's access key.

Updated 2026-10-22

Azure Blob Storage isn't S3-compatible, so CloudFile talks to it through its own Blob API. You connect a container in a storage account and sign in with one of the account's two access keys.

## Before you start

- An Azure subscription and permission to create storage accounts.
- The **Allow storage account key access** setting must stay on for the account. If your organization enforces Microsoft Entra-only access with Azure Policy, ask an admin to exempt this account.

## 1. Create a storage account

An access key works for every container in its storage account, so give CloudFile an account of its own.

1. In the Azure portal, go to **Storage accounts** and choose **Create**.
2. Pick a resource group, name the account (3 to 24 lowercase letters and digits, for example `acmesftp`) and choose a region, for example **Germany West Central**.
3. Keep **Primary service** at **Azure Blob Storage or Azure Data Lake Storage Gen2** and **Performance** at **Standard**. Locally-redundant storage (LRS) is enough for most servers.
4. On the **Advanced** tab, leave **Enable hierarchical namespace** off and keep the access tier at **Hot**. Cool and Cold tiers charge for reads and have minimum storage durations.
5. On the **Networking** tab, keep public network access enabled from all networks. CloudFile reaches the account over the internet.
6. On the **Data protection** tab, consider turning **Enable soft delete for blobs** off. It's on by default with a 7-day retention, and soft-deleted files keep accruing storage charges. Leave versioning off: every rename then keeps a full copy of the file.
7. Choose **Review + create**, then **Create**.

## 2. Create the container

1. Open the storage account and go to **Data storage → Containers**.
2. Choose **+ Container**, name it (3 to 63 lowercase letters, digits and single hyphens, for example `sftp-files`) and keep **Anonymous access level** at **Private**.
3. Choose **Create**.

## 3. Copy an access key

1. In the storage account, go to **Security + networking → Access keys**.
2. Choose **Show** next to **key1** and copy the **Key**, a long base64 string ending in `==`. Copy the key itself, not the connection string.

Azure keeps two keys so you can rotate them without downtime: switch CloudFile to key2, then regenerate key1.

## 4. Connect it

In CloudFile, go to **Storage → Add bucket** and choose **Azure Blob Storage**:

| Field | Value |
| --- | --- |
| Container | Your container name, e.g. `sftp-files` |
| Storage account | Your storage account name, e.g. `acmesftp` |
| Endpoint | `https://<account>.blob.core.windows.net`, filled in for you |
| Account key | The access key from step 3 |
| Name | Optional, e.g. `Production` |

Change the endpoint only for a sovereign cloud, for example `https://<account>.blob.core.usgovcloudapi.net` or `https://<account>.blob.core.chinacloudapi.cn`.

Click **Test connection**, then **Save**. To use the container, open a server and pick it under **Settings → Storage**.

## How files look in Azure

Files are stored as block blobs under `<folder>/<username>/<path>`, the same layout as on S3. An empty folder is a zero-byte blob named like the folder, with the `hdi_isfolder` metadata flag that Azure Storage Explorer also understands. Download links in the web file manager and in [webhook](/docs/webhooks) payloads are read-only SAS links for that one blob, signed with the account key.

## Uploads from the browser

The web file manager and file requests upload blocks straight to the container with write-only SAS links, and CloudFile commits them when the upload is complete. For that the storage account needs a CORS rule for `https://cloudfile.dev`: under **Settings → Resource sharing (CORS) → Blob service**, allow origin `https://cloudfile.dev`, methods `PUT, GET, HEAD`, allowed headers `*`, exposed headers `*`, max age `3600`. Without it, browser uploads go through our servers and are limited to 100 MB per file. See [Uploads from the browser](/docs/storage#uploads-from-the-browser-cors).

## Troubleshooting

- **Writing a test file failed: Server failed to authenticate the request.** The account key is wrong or was regenerated, or the storage account name doesn't match the key. Copy key1 again from **Access keys**.
- **Writing a test file failed: Key based authentication is not permitted on this storage account.** **Allow storage account key access** is off. Turn it on under **Settings → Configuration**.
- **Writing a test file failed: The specified container does not exist.** Check the container name. CloudFile never creates containers.
- **Writing a test file failed: This request is not authorized to perform this operation.** The account's firewall blocks CloudFile. Allow public network access from all networks under **Security + networking → Networking**.
- **Deleting the test file failed.** The container has an immutability policy or a legal hold.

See [Your own bucket](/docs/storage) for how files are laid out and how switching storage works.