Azure Storage now supports SFTP with Entra ID integration, replacing the older local-user authentication model. By enabling hierarchical namespace (Azure Data Lake Storage Gen2) on a storage account and turning on SFTP (billed at ~$0.30/hour), applications can connect via standard SFTP clients on port 22. Authentication works through short-lived OpenSSH tokens (65-minute lifetime) generated via the AZ CLI after authenticating to Entra ID, eliminating the need for long-lived per-account credentials. Permissions are enforced through standard Azure data plane RBAC roles (e.g., Storage Blob Data Contributor), enabling conditional access, MFA, audit logs, and lifecycle management through existing Entra governance. Local users are being phased out in favor of this model. Service principals are also supported for non-human identities.