|
1 | 1 | --- |
2 | 2 | title: Authorize SFTP access to blobs using Microsoft Entra ID (preview) |
3 | 3 | titleSuffix: Azure Storage |
| 4 | +description: Learn how to authorize SSH File Transfer Protocol (SFTP) access to blobs by using Microsoft Entra ID. |
4 | 5 | author: jeevanbalanmanoj |
5 | 6 | ms.date: 02/24/2026 |
6 | 7 | ms.topic: how-to |
@@ -225,7 +226,7 @@ Use the following command to view the OpenSSH certificate: |
225 | 226 |
|
226 | 227 | The _Principals_ section contains the username: |
227 | 228 |
|
228 | | -:::image type="content" source="./media/secure-file-transfer-protocol-support/verify-opensshcert.png" alt-text="Screenshot of the principals section in the command ouput."::: |
| 229 | +:::image type="content" source="./media/secure-file-transfer-protocol-support/verify-certificate.png" alt-text="Screenshot of the principals section in the command ouput."::: |
229 | 230 |
|
230 | 231 | For security reasons, the OpenSSH certificate is valid for 65 minutes. After this period, you need to request a new certificate to initiate any further transactions. |
231 | 232 |
|
@@ -262,15 +263,15 @@ SFTP clients such as WinSCP and PuTTY support OpenSSH-based authentication. The |
262 | 263 | 1. Obtain the OpenSSH certificate from the previous step (Generate OpenSSH certificate) |
263 | 264 | 1. In WinSCP, enter the Host name and Username, and then select **Advanced** |
264 | 265 |
|
265 | | - :::image type="content" source="./media/secure-file-transfer-protocol-support/winscp-login.png" alt-text="Screenshot of of the Login window and the Advanced option."::: |
| 266 | + :::image type="content" source="./media/secure-file-transfer-protocol-support/login-dialog.png" alt-text="Screenshot of of the Login window and the Advanced option."::: |
266 | 267 |
|
267 | 268 | 1. In the SSH tab, go to the Authentication section. Attach the private key and certificate files obtained from the previous sections, and then select **OK**. |
268 | 269 |
|
269 | | - :::image type="content" source="./media/secure-file-transfer-protocol-support/winscp-advanced-settings.png" alt-text="Screenshot of the Authentication settings in the Advanced Site Settings dialog box."::: |
| 270 | + :::image type="content" source="./media/secure-file-transfer-protocol-support/advanced-settings.png" alt-text="Screenshot of the Authentication settings in the Advanced Site Settings dialog box."::: |
270 | 271 |
|
271 | 272 | 1. Select **Login** to sign in by using the Microsoft Entra ID account and OpenSSH certificate. |
272 | 273 |
|
273 | | - :::image type="content" source="./media/secure-file-transfer-protocol-support/winscp-login-highlight.png" alt-text="Screenshot Login dialog box."::: |
| 274 | + :::image type="content" source="./media/secure-file-transfer-protocol-support/login-button.png" alt-text="Screenshot Login dialog box."::: |
274 | 275 |
|
275 | 276 | ##### [Azure CLI](#tab/azurecli) |
276 | 277 |
|
@@ -364,9 +365,9 @@ An `Access denied` error can happen even if you're able to connect to storage ac |
364 | 365 |
|
365 | 366 | This error can happen because WinSCP automatically tries to **canonicalize every directory** it enters. That means that for _every_ `cd` or directory listing, it sends one or more extra protocol requests to figure out the "true" absolute path. |
366 | 367 |
|
367 | | - - The **root directory** shows _containers_. |
368 | | - - Each container acts as **a virtual chroot**. Once you're inside it, you can't go above or outside it. |
369 | | - - Paths are **virtual**, not physical. Azure doesn't support `/`-based absolute traversal above containers. |
| 368 | +- The **root directory** shows _containers_. |
| 369 | +- Each container acts as **a virtual chroot**. Once you're inside it, you can't go above or outside it. |
| 370 | +- Paths are **virtual**, not physical. Azure doesn't support `/`-based absolute traversal above containers. |
370 | 371 |
|
371 | 372 | Resolve this problem by using one of the following options: |
372 | 373 |
|
|
0 commit comments