Storage accounts with SFTP enabled but unused
File transfer switched on but never used
Why it happens
Turning on SFTP adds an hourly charge that runs whether or not a file moves. Usually enabled for one transfer and left on.
SFTP on Blob Storage carries a flat hourly charge for the endpoint, separate from storage and transactions. It gets enabled for one integration and left on.
Paste this into Resource Graph Explorer in the Azure portal.
resources
| where type =~ 'microsoft.storage/storageaccounts'
// Scope below matches CloudFinOpsPro policy DEFAULTS: exclusions.protectTag, environment.tagKeys,
// environment.allowedTagValues, and allowUntagged false so an untagged resource counts as production.
// If your policy.yaml differs, edit the three lines below or this will disagree with your own agent.
| where tolower(tostring(coalesce(tags['cfop:protect'], ''))) !in ('true', 'yes', '1')
| extend cfopEnv = tolower(trim(' ', tostring(coalesce(tags['Environment'], tags['environment'], tags['env'], ''))))
| where cfopEnv in ('dev', 'development', 'test', 'qa', 'sandbox', 'nonprod', 'non-prod', 'staging')
| where properties.isSftpEnabled == true
| project name, resourceGroup, location,
sku = tostring(sku.name)The hourly charge applies whenever the feature is enabled, used or not. Azure Monitor publishes no dimension that separates SFTP from ordinary blob traffic, so the Transactions metric cannot confirm SFTP specifically. Zero transactions of any kind means the endpoint is certainly unused. If the account is busy, only resource logs (StorageBlobLogs, Protocol column) can tell you whether any of it was SFTP.
Applies to microsoft.storage/storageaccountsWhat the agent does about it
A storage account with `properties.isSftpEnabled == true` that recorded no transactions of any kind in the evaluation window, so its hourly SFTP charge is buying nothing.
It will not fix this one
It finds it and tells you what to change. The change itself is yours to make, because it is not one the agent should make on your behalf.
Related checks
Hot-tier blob data that nothing has touched
Blob data held in the Hot access tier on an account that recorded no transactions at all over the window, where the Cool tier would bill less for the same bytes.
Geo-redundant storage account outside production
A storage account replicated to a second region. Geo-redundancy roughly doubles the per-GB storage rate against locally redundant storage, and read-access variants cost more again.
Expired or orphaned snapshot
A snapshot past its retention window whose source disk no longer exists.