How to Provide Managed SFTP Access to SharePoint and OneDrive with Power Automate

Abstract

This step-by-step tutorial shows how organizations can use SFTP To Go and Power Automate to provide controlled SFTP or FTPS access for files held in SharePoint and OneDrive. You will learn how to set up the managed file transfer endpoint, create restricted credentials and folders, and automate file movement between Microsoft 365 and external users or systems. The guide also covers testing, monitoring, and common business use cases.

SharePoint and OneDrive work well for collaboration inside Microsoft 365, but external systems don’t always support them directly. Customers, suppliers, automated processes, and business applications often use SFTP or FTPS for controlled file exchange.

Power Automate can bridge that gap. External users and systems connect to a managed file transfer endpoint, while Power Automate copies files between the endpoint and the required SharePoint document library or OneDrive for Business folder.

This approach does not expose SharePoint or OneDrive directly over SFTP. Each external user connects with a dedicated credential and sees only the folders and operations assigned to them.

In this tutorial, we’ll:

• Set up the endpoint
• Restrict access
• Connect Power Automate
• Build flows for transfers in both directions. 
• We’ll also cover testing, monitoring, duplicate prevention, and practical deployment decisions.

How the access model works

The workflow has three main components:

External users don’t need Microsoft 365 accounts. Each user connects to SFTP To Go with dedicated credentials and can access only the folders and actions assigned to them.

Power Automate connects to the managed endpoint over SFTP using Microsoft’s`SFTP-SSH` connector. External users and systems can access the same endpoint through SFTP or explicit FTPS, depending on what their applications support. The `SFTP-SSH` connector does not connect Power Automate over FTPS.

This guide covers complete inbound and outbound transfer workflows between SFTP To Go, SharePoint, and OneDrive, including access controls, duplicate prevention, testing, monitoring, and error handling. Each flow handles one transfer direction, which keeps the automation easier to control and troubleshoot.

Power Automate handles transfers between Microsoft 365 and the managed endpoint. SFTP To Go’s native file automations can support these flows by processing files within the endpoint itself. Event-based or scheduled automations can move, copy, PGP encrypt, decrypt, or organize files and send notifications or webhooks without adding those file operations to the Power Automate flow.

Note: For continuous synchronization, add flows for renames, deletions, and existing-file backfills. Use a SharePoint list, Dataverse table, or database to track file versions and transfer status, allowing Power Automate to prevent duplicates and resolve conflicting changes. These extensions are outside the scope of this guide.

What you'll need

• A Microsoft 365 work or school account with access to the relevant SharePoint site or OneDrive for Business account
• Permission to create and manage cloud flows in the intended Power Automate environment
• Access to the SharePoint, OneDrive for Business, and SFTP-SSH connectors required by the workflow
• An active SFTP To Go account with permission to create folders, credentials, and webhooks
• The SFTP To Go host, username, and password for the Power Automate connection
• The verified SSH host-key fingerprint for the SFTP To Go endpoint
• If using SSH-key authentication, the private key and passphrase managed by your organization and the corresponding public key added to the SFTP To Go credential
• Dedicated source and destination folders
• Representative test files and an agreed response to duplicate names and failed transfers

Power Automate connects to SFTP To Go over SFTP on port 22. Connector availability, trigger frequency, and flow limits can depend on the Microsoft plan and environment. Confirm what is available in the tenant where the production flow will run.

Manage users and access

Manage users and access

Create a dedicated credential for each external organization, automated system, or Power Automate connection where practical. Sharing one credential across unrelated workflows makes it harder to revoke access, separate activity, and determine which system transferred a file.

1. Open the `Credentials` tab in SFTP To Go.
2. Create the credential and select its authentication method.
3. Assign the appropriate folder created earlier as the credential’s home directory. For example, assign `/inbound/customer-a` to a credential used by Customer A to upload files.
4. Grant only the permissions required for that folder, such as write-only access for inbound uploads or  read-only access for outbound downloads.
5. Record who owns the credential and which workflow uses it.
6. Store its password or private key through the organization’s approved credential-management process.

The assigned Home directory appears as `/` when the credential connects. A credential assigned to `/inbound/customer-a`, for example, sees that folder as its root and cannot access its parent or sibling folders.

The Power Automate credential must have the permissions required by its actions. A flow that sends files to SFTP needs Write permission for the destination. A flow that retrieves inbound files needs Read permission for the source.

The Home directory also affects path handling. The SFTP-SSH connector resolves paths from the Power Automate credential’s root. If that credential is bound directly to `/outbound/customer-a`, use `/` as the destination path. If it is bound to `/outbound`, use `/customer-a`.

Connect Power Automate

Connect Power Automate to SFTP To Go

Test the SFTP connection before building the complete workflow. A successful folder listing confirms that Power Automate can reach the endpoint, authenticate, and resolve the credential’s root.

1. In Power Automate, select `Create`.
2. Select `Instant cloud flow`.
3. Choose `Manually trigger a flow` and click `Create`.
4. Click `+` to add an action and search for `SFTP`.
5. Choose `List files in folder` in the `SFTP-SSH` group.

Create the connection with the details assigned to the SFTP To Go credential:

• `Display name`: Use a name that identifies the connection’s purpose, such as `SFTP To Go – Customer A inbound`, `SFTP To Go – Customer A outbound`, or `SFTP To Go – System B inbound`.
• `Host server address`: Enter the host shown in the SFTP To Go `Credentials` tab.
• `User name`: Enter the username assigned to the credential.
• `Password`: Enter the password when using password authentication.
• `Port number`: Enter `22`.
• `SSH private key and passphrase`: Leave these blank for the tested password-based connection.
• `SSH host key fingerprint`: Enter the verified fingerprint for the endpoint.
• `Root folder path`: Enter `/`.

The root path is relative to the credential’s home directory. Setting it to `/` starts the Power Automate connection at that assigned home directory.

1. Set `Folder` to `/` in `List files in folder`.
2. Click `Save` in the toolbar.
3. Select `Test`, choose `Manually`, and click the `Test` button below to run the flow.
4. Open the completed run and expand `List files in folder`.
5. Confirm that Power Automate returns the folders and files visible to the credential.

Do not continue until this test succeeds. If authentication fails, compare the host, username, port, authentication fields, and fingerprint with the selected credential. If the wrong folders appear, check the credential’s home directory and permissions.

Connect SharePoint

Create or select a SharePoint connection that uses an account with access to the required site, document library, and folders.

1. On the left sidebar, select `Connections` (click `More` first if the `Connections` item is not visible).
2. Select `New connection`.
3. Choose `SharePoint`.
4. Choose `Connect directly (cloud services)`.
5. Sign in with the Microsoft account that has access to the content used by the flow.

No site or folder settings are required at this stage. When building the flows below, you’ll select the correct `Site Address`, `Library Name`, and `Folder` or `Folder Path` within the relevant trigger or action. At that point, confirm that the connection uses an account with access to those locations.

Connect OneDrive for Business

If you are planning to connect to OneDrive rather than to SharePoint, create a new connection using the `OneDrive for Business` connector with the Microsoft work or school account that owns the files involved in the workflow.

Microsoft documents that the connector operates on the account used to create the connection. Cross-drive access is not supported, including files and folders added through some OneDrive shortcut scenarios. Use SharePoint for team-owned document libraries and OneDrive for files owned by the connected business account.

Automate outbound transfers

An outbound flow copies a file from SharePoint or OneDrive to SFTP To Go. The external user or system can then retrieve it over SFTP or FTPS.

If the file needs further preparation after it reaches SFTP To Go, an SFTP To Go native file automation can handle that processing inside the managed endpoint. For example, it can copy the file into a customer-specific release folder, encrypt it with PGP, apply a delay, or send a notification or webhook when the file is ready. Power Automate remains responsible for transferring the file from Microsoft 365.

Transfer SharePoint files to SFTP

Use a dedicated SharePoint folder for files that are ready to be sent. Do not monitor an entire working library unless every new file should be transferred.

Step 1: Create the SharePoint flow

1. In Power Automate, select `Create`.
2. Select `Automated cloud flow`.
3. Enter a descriptive flow name.
4. Search for SharePoint’s  `When a file is created (properties only)` trigger.
5. Select it and click `Create`.

Step 2: Configure the SharePoint trigger

1. Set `Site Address` to the SharePoint site.
2. Set `Library Name` to the required document library.
3. Use the folder picker to select the dedicated outbound `Folder`.

A folder such as `/Shared Documents/To SFTP` provides a controlled release location. Files added elsewhere in the library will not start this flow.

Step 3: Retrieve the SharePoint file content

The properties-only trigger identifies the file but does not supply the complete binary content needed for the SFTP upload.

1. Add a new action right below the trigger.
2. Search for `Get file content` and select this action from the `SharePoint` connector.
3. Use the same `Site Address`.
4. Map `Identifier` from the trigger to `File Identifier` using expressions and the `Dynamic Content` page.

Step 4: Create the file in SFTP To Go

1. Add the `Create file` action from the `SFTP-SSH` connector.
2. Set `Folder Path` to the permitted outbound folder.
3. Set `File Name` to `File name with extension` from the SharePoint trigger.
4. Set `File Content` to the output from `Get file content`.
5. Select `Save`.

Upload a small test file to the selected SharePoint folder. In the tested setup, the SharePoint trigger used polling, so the run did not start immediately. Wait for the run to appear, then confirm that it succeeds and that the file appears in the correct SFTP To Go folder with its original name and usable content.

Transfer OneDrive files to SFTP

The OneDrive route uses the same basic sequence but with the `OneDrive for Business` connector.

Step 1: Create the OneDrive trigger

1. Create an `Automated cloud flow`.
2. Search for  `When a file is created (properties only)` and select the trigger from the `OneDrive for Business` connector.
3. Select the dedicated outbound folder.

Use the properties-only trigger and retrieve the content in a separate action. Microsoft documents that the content-returning `When a file is created` trigger skips files larger than `50 MB`. The properties-only trigger does not carry that documented skip condition, although later actions and wider flow limits can still constrain the practical file size.

Step 2: Retrieve the OneDrive file

1. Add the `Get file content` action from the `OneDrive for Business` connector.
2. Map the file identifier returned by the trigger.

Step 3: Create the SFTP file

1. Add the `Create file` action from the `SFTP-SSH` connector.
2. Set `Folder Path` to the restricted outbound folder.
3. Map the file name returned by the OneDrive trigger into `File Name`.
4. Map the result from `Get file content` into `File Content`.
5. Select `Save`.

Create a representative test file directly in the selected OneDrive folder, then confirm that the run succeeds and the file appears in the intended SFTP To Go destination. Microsoft notes that files moved within OneDrive are not treated as newly created files by the file-created trigger, so test with the same method the production process will use.

Send only approved files

If a document must be approved before delivery, don’t just monitor a general working folder. Either continue to the SFTP action only when the approval outcome is `Approved`, or move approved files into a dedicated release folder monitored by the transfer flow.

A release folder keeps draft documents away from the transfer process and gives reviewers a visible queue of files ready for external delivery.

Automate inbound transfers

An inbound flow starts when an external user or system uploads a file through SFTP or FTPS. SFTP To Go sends a webhook to Power Automate. Power Automate then retrieves the file through `SFTP-SSH` and creates it in SharePoint or OneDrive.

SFTP To Go’s native file automations can also prepare an incoming file before Power Automate retrieves it. For example, an automation can decrypt or copy the uploaded file into a dedicated processing folder and then send the webhook from that stage of the workflow. Power Automate can monitor the processed location rather than acting on the original upload.

Step 1: Create the Power Automate webhook trigger

1. In Power Automate, select `Create`.
2. Select `Instant cloud flow`.
3. Choose `When an HTTP request is received`.
4. Name the flow and select `Create`.

Before saving, add an action to capture the incoming webhook data. Power Automate requires at least one trigger and one action.

1. In the HTTP trigger, set `Who can trigger the flow?` to `Anyone`.
2. Below the trigger, add the `Compose` action from `Data Operation`.
3. In `Inputs`, open the expression editor, enter `triggerBody()`, and confirm the expression.
4. Leave the trigger’s `Request Body JSON Schema` blank for now.
5. Select `Save`.
6. Return to the HTTP trigger and copy the generated `HTTP URL`.

Once the `Get file content using path` action is configured, you can remove `Compose` and select `Save` again.

Treat the URL as a secret. Anyone who obtains it may be able to start the flow. Do not publish it or include it in screenshots. If the organization prohibits anonymous HTTP triggers, use an approved authenticated relay or another endpoint design.

Step 2: Create the SFTP To Go webhook

1. Open `Webhooks` in SFTP To Go.
2. Add a webhook.
3. Enter a descriptive name.
4. Paste the Power Automate `HTTP URL` into the endpoint field.
5. Select the `file.created` event.
6. Limit the webhook to the intended inbound path.
7. Add a file-only path filter so directory creation does not start the workflow.
8. Save the webhook.

Configure the SFTP To Go webhook for file-created events and the inbound path.

Filtering at the webhook reduces unnecessary Power Automate runs and keeps activity outside the selected inbound folder away from this workflow.

Step 3: Generate the request schema

1. Upload one small test file to the inbound folder.
2. Open the Power Automate run started by the webhook.
3. Copy the JSON request body from the trigger output.
4. Return to the HTTP trigger.
5. Select `Use sample payload to generate schema`.
6. Paste the request body and save the flow.

Generate the request schema from an actual SFTP To Go webhook payload.

Using an actual payload exposes fields such as `Topic` and `Data.Path` for later actions.

Step 4: Retrieve the inbound file

Add the `Get file content using path` action from the `SFTP-SSH`  connector. Use the path returned in `Data.Path`, adjusted for the home directory used by the `SFTP-SSH` connection.

Use the webhook path in SFTP-SSH Get file content using path.

Test this with the credential intended for the workflow. If Power Automate returns `404 path does not exist`, compare the webhook path with the credential’s home directory. The path may repeat the home-directory prefix or refer to a location outside the credential’s visible root.

Now that `Get file content using path` is configured, delete the temporary `Compose` action and select `Save`.

Step 5.1: Create the file in SharePoint

1. Add the `Create file` action from the `SharePoint` connector.
2. Select the destination `Site Address`.
3. Select the document library `Folder Path` with the folder picker where possible.
4. In `File Name`, use the final segment of the webhook path.
5. In `File Content`, select the output from `Get file content using path`.
6. Select `Save`.

A typical expression for the file name is:

`last(split(triggerBody()?[‘Data’]?[‘Path’], ‘/’))`

Map the SharePoint destination, extracted file name, and SFTP file content.

Use the SharePoint folder picker where possible. A manually entered path can resolve to the document library root instead of the intended folder.

Step 5.2: Create the file in OneDrive

1. Add the `Create file` action from the `OneDrive for Business` connector.
2. Select the required destination `Folder Path`.
3. Use the extracted name from `Data.Path` for `File Name`.
4. Map the output from the SFTP retrieval action into `File Content`.
5. Select `Save`.

Microsoft documents that characters not allowed in OneDrive file names may be replaced with underscores. Test the naming conventions used by the external system before using the flow for business files.

Test and monitor

A successful transfer of one small file proves only the basic route. Test each workflow with the sizes, names, and arrival patterns expected in production.

Use Power Automate run history to confirm that each expected transfer completed.

Prevent loops and duplicate transfers

Do not point inbound and outbound flows at folders that feed each other. A file copied from SFTP into Microsoft 365 could otherwise start the outbound flow and return to SFTP, where it starts the inbound flow again.

• Use different folders for inbound and outbound transfers.
• Monitor a release folder instead of an entire SharePoint library or OneDrive account.
• Filter the webhook to one inbound path.
• Move processed files to an archive when the workflow requires it.
• Record a unique transfer identifier when stronger duplicate prevention is needed.
• Configure retries with the destination’s duplicate rule in mind.

Handle failed transfers

Power Automate records the trigger, inputs, outputs, duration, and status of each run. Start troubleshooting at the first failed action.

• Authentication failures usually point to a connection that needs to be repaired.
• An SFTP `404` usually points to path or home-directory handling.
• A SharePoint `List not found` or `GetTable` error can mean that the flow uses `Create item` instead of `Create file`.
• OneDrive access errors can result from account ownership, file locks, tenant controls, or policies that prevent the connector from downloading file content.

For production workflows, add a failure branch with `Configure run after`. It can notify the responsible person or create an exception record when a transfer fails, times out, or is skipped. The notification should identify the flow, source file, destination, run, and error without exposing passwords, private keys, or the webhook URL.

Practical use cases

Customer and supplier file exchange

Give each organization a separate credential and exchange folder. Power Automate can route inbound orders, invoices, statements, and data files into the correct SharePoint library or OneDrive folder. Approved responses can then be published to the corresponding outbound folder.

Scheduled report delivery

A scheduled flow can retrieve a report from SharePoint or OneDrive and create it in SFTP To Go at a defined time. Use date-based file names or a clear replacement rule so one scheduled run does not silently overwrite another unless that is intentional.

Approved document delivery

Teams can prepare and review documents in Microsoft 365, then release only the approved versions through SFTP or FTPS. This keeps draft work inside SharePoint or OneDrive while giving the receiving system a conventional transfer endpoint.

Legacy system integration

Older applications may support SFTP or FTPS but have no direct SharePoint or OneDrive integration. The managed endpoint gives the application a standard file-transfer interface. Power Automate handles the Microsoft 365 side without requiring the external application to use Microsoft APIs.

Prepare the workflow for production

Before enabling the workflow for business files, document:

• Who owns each flow and credential
• Which location is the source of truth
• How long files remain in the exchange folders
• What happens when a file name already exists
• The maximum expected file size and batch volume
• Who receives failure notifications
• How failed runs are safely retried
• Whether processed source files are retained, moved, or deleted

The examples in this guide copy files. They do not delete the source. If the process requires files to be moved or archived, add that action only after the destination file has been created successfully.

Review Microsoft 365 data-loss prevention rules, tenant policies, licensing, and connector availability with the administrators responsible for the environment. Test the finished flow in the actual tenant rather than assuming that a prototype will behave identically in production.

Frequently asked questions

Can SharePoint or OneDrive provide SFTP access directly?

Not through this workflow. External users connect to SFTP To Go, while Power Automate copies files between the managed endpoint and SharePoint or OneDrive.

Can external users connect with FTPS instead of SFTP?

Yes. External users can use the explicit FTPS connection details provided for the SFTP To Go endpoint. Power Automate still uses Microsoft’s `SFTP-SSH` connector for its connection to the managed storage.

Which Power Automate connector should I use for SFTP To Go?

Use `SFTP-SSH` for the flows in this guide. Test the connection with `List files in folder` before building the complete workflow.

Should SharePoint and OneDrive use the same flow?

Usually not. They use different connectors and have different ownership and limitation details. Separate flows keep their paths, permissions, monitoring, and failures easier to manage.

How do I stop the same file from transferring twice?

Use dedicated folders, narrow trigger filters, and a defined duplicate rule. Depending on the process, you can archive processed files, record a unique source identifier, check whether the destination already contains the name, or route duplicates for review.

Why does the SFTP action say that the path does not exist?

Compare the configured path with the home directory of the credential used by `SFTP-SSH`. Remove a repeated home-directory prefix and confirm that the credential has permission to access the target folder.

What file size can the workflow handle?

There is no single reliable limit for every workflow. The practical maximum depends on the trigger, connector actions, tenant policies, content overhead, runtime, concurrency, and path.

The tested SharePoint flows moved files up to about `80 MB`, but that is a test result rather than a universal connector limit or an SFTP To Go storage limit. Microsoft documents a `50 MB` skip condition for the content-returning OneDrive file-created trigger. Use properties-only triggers where appropriate and test the largest files and busiest batch the process expects.

Does this create a true two-way synchronization?

No. Each flow creates event-driven copies in one direction. Continuous synchronization, historical backfills, renames, deletions, and conflict resolution require additional logic.

Sources and further reading

• SFTP To Go: Connect Power Automate to SFTP
• SFTP To Go: SharePoint to SFTP Sync
• SFTP To Go: SFTP to SharePoint Sync
• Microsoft Learn: SFTP-SSH connector
• Microsoft Learn: SharePoint connector
• Microsoft Learn: OneDrive for Business connector
• Microsoft Learn: Power Automate limits

About the author