Set up an Azure virtual machine

A single Azure virtual machine is enough for many SFTPPlus installations. Two VMs are preferred for implementing high availability transfers with a load balancer, and in this case the setup is similar to a single VM.

This guide covers the basic VM, storage, and inbound port choices for that setup. It deliberately leaves out detailed firewall design, private networking, and load balancer configuration, as those depend on your Azure environment.

Choose the VM ​

Use the latest supported operating system release when possible. SFTPPlus also runs on other current Linux distributions and Windows versions. We recommend an x86_64 VM. ARM64 is also supported when running Linux.

These resources are suitable for a single SFTPPlus instance:

Azure size availability varies by region. You can use another size that meets the same CPU and memory requirements.

SFTPPlus spends most of its time moving data between the network and storage, so its normal workload is not CPU-intensive. One vCPU is enough for a small installation, and a single server does not usually benefit from more than two vCPUs. On Windows, the extra memory is for the Windows graphical interface rather than SFTPPlus; the SFTPPlus process normally uses less than 500 MB.

Allow 20 GB of base storage for the operating system and SFTPPlus. If the Azure image requires a larger OS disk, keep its default. Add a separate data disk with the capacity and performance required for your users' files.

Create the VM and network rules ​

In the Azure portal, create a virtual machine in the required resource group, region, virtual network, and subnet. Select Ubuntu Server 26.04 or Windows Server 2025, choose one of the sizes above, and use SSH key authentication for Linux or a strong administrator account for Windows. Restrict SSH or Remote Desktop access to trusted administration addresses.

Add only the inbound rules for the SFTPPlus services you plan to enable:

Restrict port 10020 to administrator source addresses. For FTPS, allowing port 10021 alone is not enough: the network security group and any other firewall in the path must also allow inbound TCP connections to the passive range 10090-10100.

These non-default ports reduce exposure to broad automated scans and add a small extra layer of security. They do not replace authentication, TLS, SSH, or firewall controls. SFTPPlus can instead listen on the standard ports 443 for HTTPS, 22 for SFTP, and 21 for FTPS when that fits your network policy.

Install SFTPPlus ​

After Azure finishes creating the VM, connect over SSH or Remote Desktop, download the SFTPPlus package, and follow the installation documentation. The installer includes the application and Web Manager; it does not require a separate database, Java runtime, or web server.

Open https://VM_ADDRESS:10020 from an allowed administrator address and sign in with the account created during installation. You can then configure users, TLS certificates, SSH keys, and the services needed by your organization. Test each enabled transfer service through its public or private VM address: SFTP on port 10022, HTTPS on port 10443, and FTPS on port 10021 using the passive range 10090-10100.