Many teams enable SFTP on Azure Blob Storage to exchange files with partners and customers. It works, but the bill and the day-to-day administration are often larger than expected. This guide explains how SFTP is charged, what it really costs over a year, and when another approach is cheaper and simpler.
Short answer: SFTP is billed every hour it is enabled, for each storage account, at around USD 0.30 per hour in many regions. That is roughly USD 220 per month per account, before storage, transactions and data transfer. For people who only need to upload and download files, a web file explorer is usually cheaper and easier to control.
How SFTP on Azure Blob Storage is billed
According to the Microsoft documentation, enabling SFTP on a storage account has an hourly cost, charged as long as the feature is enabled, whether files are transferred or not. On top of that, you pay the usual charges of the storage account:
- Storage capacity, as for any blob.
- Transactions: every SFTP command is converted into read, write or other operations on the account.
- Data transfer out of Azure, when partners download files.
The hourly rate depends on the region. At the time of writing it is around USD 0.30 per hour in many regions; always check the Azure Blob Storage pricing page for your own region and currency.
What it costs over a year
The SFTP charge alone, with SFTP always enabled so that partners can connect at any time:
| Storage accounts with SFTP | Per month | Per year |
|---|---|---|
| 1 | about USD 216 | about USD 2,630 |
| 2 | about USD 432 | about USD 5,260 |
| 3 | about USD 648 | about USD 7,880 |
Based on USD 0.30 per hour, 720 hours per month and 8,760 hours per year. Storage, transactions and data transfer are not included.
Because billing is per storage account, the cost grows quickly when each business unit, environment or region has its own account.
The costs that are not on the invoice
The hourly charge is only part of the effort. SFTP on Azure Blob Storage also comes with technical requirements and administration work:
- Hierarchical namespace is required. SFTP only works on accounts with hierarchical namespace (Data Lake Storage Gen2). Enabling it on an existing account is a one-way upgrade that you need to plan and test.
- A separate identity model. SFTP uses local users with a password generated by Azure or an SSH key. Their permissions do not follow your Azure RBAC role assignments or your Microsoft Entra ID groups, so you create, rotate and remove these credentials yourself.
- Folder-level access needs ACLs. Container permissions apply to the whole container. Giving each partner its own folder means configuring access control lists, which is easy to get wrong.
- Partners need an SFTP client. Business users and external partners must install and configure a tool such as FileZilla or WinSCP, and keep their key or password safe.
- Network rules. Port 22 is exposed at the platform level, and firewall or private endpoint rules apply to all endpoints of the account, not only SFTP.
Microsoft suggests enabling SFTP only while you transfer data to avoid passive charges. That works for scheduled jobs, but not when partners are expected to send files whenever they need to.
When SFTP remains the right choice
SFTP is still a good fit for system-to-system transfers:
- A partner's application or ERP can only deliver files over SFTP.
- Existing scripts or managed file transfer tools already speak SFTP.
- Transfers are scheduled, so SFTP can be enabled only during a time window.
In these cases, keep SFTP and limit it to the accounts and hours you really need.
A simpler option for people: a web file explorer
When the people exchanging files are humans — partners, customers, business teams — they rarely need a protocol. They need to open a folder, upload or download files, and lose access when the project ends.
Blob Web Explorer works directly on your existing Azure Blob containers, without SFTP and without hierarchical namespace:
- Browser access: nothing to install for partners or business users.
- Share a container by email with Read or Write access and an end date; access stops automatically.
- No storage keys or SAS URLs to send: the connection is configured once by the container owner.
- Activity log: every upload, download and deletion is recorded per user.
- Predictable price: the Pro plan is EUR 29 per month for up to 25 containers and 100 active recipients, whatever the number of storage accounts. See pricing.
| SFTP on Azure Blob Storage | Blob Web Explorer | |
|---|---|---|
| Billing | Per hour, per storage account | Per subscription, up to 25 containers (Pro) |
| Requires hierarchical namespace | Yes | No |
| Partner tool | SFTP client to install | Web browser |
| Identity | Local users with password or SSH key | Blob Web Explorer accounts, or Microsoft Entra ID (Enterprise) |
| Access end date | Remove the local user or credential yourself | Built into each share |
| Who did what | Azure Storage logs, if enabled | Built-in activity log per user |
Bottom line
SFTP on Azure Blob Storage is useful for automated transfers, but it costs around USD 220 per month for each storage account where it stays enabled, plus the work of managing local users, keys and ACLs. When the goal is to let people exchange files securely, a web file explorer on your existing containers is usually cheaper, quicker to set up and easier to audit.
Start free with Blob Web Explorer on one of your containers, or compare it with Azure Storage Explorer.
Frequently asked questions
How much does SFTP cost on Azure Blob Storage?
SFTP is billed per hour while it is enabled on a storage account, on top of the usual storage, transaction and data transfer charges. At around USD 0.30 per hour, which is the rate in many regions at the time of writing, an account with SFTP always on costs roughly USD 220 per month, or about USD 2,600 per year. Check the Azure Blob Storage pricing page for your region.
Is SFTP billed per storage account or per user?
Per storage account. Each account where SFTP is enabled is billed separately, whatever the number of local users or the volume transferred.
Can I enable SFTP only when I need it?
Yes, and Microsoft recommends it to avoid paying while nobody transfers files. It works for scheduled transfers, but not when partners must be able to send files at any time.
Do SFTP local users work with Microsoft Entra ID and Azure RBAC?
Local users are a separate identity model with a password or an SSH key. Their permissions do not follow Azure RBAC role assignments, so you manage these accounts and their credentials separately.
What is a cheaper alternative to SFTP for sharing Azure Blob files with partners?
For people rather than systems, a web file explorer such as Blob Web Explorer lets partners open a container in their browser with read or write access and an end date. It works on your existing containers and does not require SFTP or hierarchical namespace.