Share an Azure Blob container with an external partner, safely

A supplier needs to drop monthly files, an agency needs to download media, an auditor needs read access for two weeks. The files are in an Azure Blob container, and the partner is not in your organization. This guide compares the ways to share an Azure Blob container with an external partner and shows when each one fits.

Short answer: There are four common options: a SAS URL, a Microsoft Entra B2B guest with a Storage Blob Data role on the container, SFTP with a local user, or a web file explorer that shares the container by email. SAS is fastest but anonymous and hard to revoke; B2B guests are the most governed but need an admin; SFTP suits systems; a web file explorer suits people who need a time-limited folder.

The four ways to share a container, compared

Option 1: send a SAS URL

A shared access signature is a URL with a signed token that grants specific permissions until an expiry time.

1. In the Azure portal, open the container and select Shared access tokens.
2. Choose User delegation key as the signing method when available, rather than an account key.
3. Grant the minimum permissions: Read and List to download, Create and Write to upload.
4. Set a short expiry and, if the partner has a fixed IP, an allowed IP range.
5. Send the URL through a secure channel, separate from the context that explains what it is.

Limits: anyone who receives the link gets the same access, Azure does not record who used it, and stopping one token early is only targeted if it uses a stored access policy. See how to revoke a SAS token for what each method breaks.

Option 2: invite the partner as a Microsoft Entra B2B guest

Microsoft Entra B2B collaboration lets a partner sign in with their own identity. They appear in your directory as a guest user.

1. In the Microsoft Entra admin center, invite the partner as a guest user.
2. Once the invitation is redeemed, open the container in the Azure portal, then Access control (IAM).
3. Assign Storage Blob Data Reader (download) or Storage Blob Data Contributor (upload and delete) at the container scope, as described in Assign an Azure role for blob data access.
4. If the partner will use the Azure portal, also assign the Reader role on the storage account, which the portal requires to browse data.
5. Allow up to 10 minutes for role assignments to apply.

Strengths: named access, Conditional Access and MFA policies apply, and removing the role stops access. Limits: it needs an Entra administrator and an Azure RBAC administrator, external collaboration settings may block the partner's domain, guests are billed under the External ID monthly active users model beyond the free tier, and the partner still has to use the Azure portal or Azure Storage Explorer, which are built for administrators.

Option 3: enable SFTP with a local user

SFTP on Azure Blob Storage creates local users with a password or SSH key and permissions on one or more containers. It fits partners whose systems can only deliver over SFTP. It requires hierarchical namespace and is billed per hour while enabled, per storage account. Our guide on Azure Blob Storage SFTP cost details the price and the administration involved.

Option 4: share the container through a web file explorer

A web file explorer sits in front of your containers and lets the owner share a container with a person by email. The partner signs in, sees a folder view and works in the browser. Nothing is copied: files stay in your storage account.

Pitfalls to avoid with every option

• Never send an account key or connection string. It gives full control of every container in the storage account.
• One container per partner. Container scope is the simplest boundary for RBAC, SAS and shares. Folder-level access needs ACLs on hierarchical namespace accounts.
• Plan the end date on day one. Access without an expiry tends to outlive the project.
• Watch egress. You pay the data transfer when partners download large volumes; check bandwidth pricing.
• Check the storage firewall. If the account only allows selected networks, the partner's requests will be refused whatever their permissions.

When the native Azure option is the right choice

• A partner application fetches or pushes files: use a short-lived user delegation SAS generated by code, or SFTP if the partner can only speak SFTP.
• A partner with Azure skills already works in your tenant as a guest: a container-scoped role is clean and fully governed.
• A single file, once: a read-only SAS with an expiry of a few hours is enough.

Blob Web Explorer: share a container with a person, by email

Blob Web Explorer is a web file explorer for Azure Blob Storage built for this case: giving business users and partners access to files without the Azure portal, keys or SFTP.

• Share by email from the container details, with Read or Read and Write access, a validity period and an optional reason.
• Access stops automatically at the end date; you can also disable or remove a share at any time, one person at a time.
• No key or SAS URL to send: you link the container once, with your Azure account, a SAS URL or a connection string.
• Browser only for the partner: browse, preview, upload, download, multi-file ZIP download.
• Activity log per user, with CSV export, to answer "who downloaded this file?".

On the SaaS service the partner needs a free account. Plans and recipient limits are on the pricing page; Enterprise adds Microsoft Entra ID sign-in and roles from your tenant.

Bottom line

To share an Azure Blob container with an external partner, match the method to who is on the other side: SAS or SFTP for systems, B2B guests with container-scoped roles for partners already in your Azure tenant, and a web file explorer for people who need a time-limited folder they can open in a browser. Whatever you choose, scope access to one container, set an end date and know how you will revoke it.

Start free with Blob Web Explorer and share a container with your first partner.

Frequently asked questions