Merge pull request #320 from JaimePolop/master

Update Azure Storage SFTP RBAC support

Author: carlospolop

src/pentesting-cloud/azure-security/az-services/az-storage.md

@@ -238,7 +238,7 @@ Azure Blob Storage now supports the SSH File Transfer Protocol (SFTP), enabling
 ### Key Features
 
 - Protocol Support: SFTP works with Blob Storage accounts configured with hierarchical namespace (HNS). This organizes blobs into directories and subdirectories for easier navigation.
-- Security: SFTP uses local user identities for authentication and does not integrate with RBAC or ABAC. Each local user can authenticate via:
+- Security: SFTP can use local user identities, but it also supports Microsoft Entra ID-based access with Azure RBAC for authorization. This means access can be granted with the usual Blob Storage data-plane roles instead of creating local SFTP users. Local users can authenticate via:
   - Azure-generated passwords
   - Public-private SSH key pairs
 - Granular Permissions: Permissions such as Read, Write, Delete, and List can be assigned to local users for up to 100 containers.
@@ -250,8 +250,8 @@ Azure Blob Storage now supports the SSH File Transfer Protocol (SFTP), enabling
 - Supported Encryption: Requires Microsoft Security Development Lifecycle (SDL)-approved cryptographic algorithms (e.g., rsa-sha2-256, ecdsa-sha2-nistp256).
 - SFTP Configuration:
   - Enable SFTP on the storage account.
-  - Create local user identities with appropriate permissions.
-  - Configure home directories for users to define their starting location within the container.
+  - For local-user access, create local user identities with appropriate permissions.
+  - For local users, configure home directories to define their starting location within the container.
 
 ### Permissions
 
@@ -491,12 +491,11 @@ az-file-shares.md
 - [https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction)
 - [https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview](https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview)
 - [https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support](https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support)
+- [https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support-entra-id-based-access](https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support-entra-id-based-access)
 - [Holiday Hack Challenge 2025 – Spare Key (Azure static website SAS leak)](https://0xdf.gitlab.io/holidayhack2025/act1/spare-key)
 - [Holiday Hack Challenge 2025: Blob Storage (Storage Secrets)](https://0xdf.gitlab.io/holidayhack2025/act1/blob-storage)
 - [https://learn.microsoft.com/en-us/cli/azure/storage/account](https://learn.microsoft.com/en-us/cli/azure/storage/account)
 - [https://learn.microsoft.com/en-us/cli/azure/storage/container](https://learn.microsoft.com/en-us/cli/azure/storage/container)
 - [https://learn.microsoft.com/en-us/cli/azure/storage/blob](https://learn.microsoft.com/en-us/cli/azure/storage/blob)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
-