Is There Native SharePoint SFTP Support?
SharePoint does not natively support SFTP (SSH File Transfer Protocol). This matters because SFTP is the standard protocol for encrypting files in transit between systems, and it is a baseline requirement for compliance with regulations including HIPAA, GDPR, PCI DSS, GLBA, and SOX.
The short answer: SharePoint does not natively support SFTP or OpenPGP file encryption. For organizations that need scheduled, automated, and encrypted file transfers to and from SharePoint, a managed file transfer (MFT) solution fills the gap that Microsoft’s own tools leave open.
SharePoint is designed for human collaboration: creating, editing, and sharing documents through a browser or the OneDrive sync client. Out of the box, it does not offer:
- An SFTP server endpoint for receiving files from external systems
- An SFTP client for pushing files to SFTP-enabled trading partners
- Scheduling for recurring, machine-to-machine file transfers
- OpenPGP encryption for files in transit or at rest
When a business process requires moving files between SharePoint and an SFTP server (sending payroll files to a benefits provider or receiving EDI data from a retail partner, for example), a bridge is needed. That bridge is a managed file transfer (MFT) solution.
How Diplomat MFT adds SFTP to SharePoint: Diplomat MFT from Coviant Software sits between SharePoint and any SFTP endpoint, translating the connection and applying encryption automatically. It supports SFTP, FTPS, and HTTPS, meaning it can connect SharePoint to virtually any trading partner or external system that requires a secure transport protocol.
Learn More: Diplomat MFT SharePoint SFTP Integration
SharePoint File Transfer Automation: What Works, and What Breaks
SharePoint automation means different things at different scales. Understanding which tool fits which scenario is essential before committing to an approach.
The Four Approaches to SharePoint File Transfer Automation
SharePoint native sync and manual upload
- What it is: Drag-and-drop uploads through the browser or the OneDrive sync client.
- Good for: Ad hoc document sharing, human collaboration, one-off file moves.
- Breaks when: Transfers need to recur on a schedule, files must be encrypted before upload, or an audit trail of every transfer is required.
Microsoft Power Automate flows
- What it is: Low-code, trigger-based workflows such as “when a file lands in this library, copy it there.”
- Good for: Simple, low-volume file routing between Microsoft 365 services.
- Breaks when: Transfer volumes increase, flows fail silently with no alert, credentials are scattered across multiple connectors, and there is no unified audit log or OpenPGP encryption layer. When a regulated transfer breaks at 2am, no one is paged.
Custom PowerShell scripts and the Microsoft Graph API
- What it is: Developer-written scripts that push and pull files via the Graph API.
- Good for: One-off integrations where a development team has time to build and maintain the solution.
- Breaks when: Error handling, retries, encryption, secret rotation, and logging all become the internal team’s permanent responsibility. Every Graph API change requires a developer fix. This is the brittle-script problem that MFT solves.
Managed file Transfer (MFT)
- What it is: A purpose-built solution for scheduled, automated, encrypted, and audited file transfers.
- Good for: Any recurring, regulated, or cross-system SharePoint transfer, or for organizations operating in highly regulated industries such as financial services, healthcare, government, retail, and logistics. When file transfers cannot fail, leak data, and when security must be proven to auditors, use enterprise-grade MFT.
The pattern is consistent: each approach is fine for its intended job, but risk compounds as transfers become recurring, regulated, or cross-cloud. That is where a dedicated MFT solution earns its place. This diagram shows how a healthcare organization transfers sensitive PII using manual workflows and identifies the security gaps associated with Power Automate, DIY scripts, and manual processes.
What Enterprise-Grade SharePoint Automation Looks Like
A mature SharePoint automation workflow includes:
- Scheduled transfers of any frequency: hourly, daily, or event-triggered
- Automatic retry and error alerting if a transfer fails
- Support for multiple protocols (SFTP, FTPS, AS2, HTTPS)
- A full audit trail exportable for compliance reporting
- No-code job configuration, so operations teams can build and modify workflows without developer involvement
- Integration with cloud storage including AWS S3, Azure Blob, and on-premises systems from a single control plane
Learn More: See How Diplomat MFT Automates SharePoint File Transfers
SharePoint File Encryption: Closing the Gap Between Collaboration and Compliance
SharePoint encrypts data at rest within the Microsoft 365 environment, but that encryption does not follow the file when it leaves SharePoint. For organizations subject to HIPAA, GDPR, PCI DSS, GLBA, or SOX, this gap represents a direct compliance risk.
The Two Encryption Requirements for SharePoint File Transfers
Encryption in transit (SFTP and FTPS)
Every file moving between SharePoint and an external system, whether an SFTP server, an AWS S3 bucket, an on-premises directory, or a trading partner, should travel over an encrypted channel. SFTP and FTPS provide this protection. Without it, files can be intercepted or compromised in transit.
File-level encryption (OpenPGP)
SFTP encrypts the channel. OpenPGP encrypts the file itself. When a file must remain encrypted after delivery (a payroll file sitting on a vendor’s SFTP server, for example), OpenPGP ensures it cannot be read without the recipient’s private key. This standard is expected by many healthcare, financial, and government trading partners.
SharePoint does not apply either type of encryption automatically when files are moved outside its environment. A dedicated MFT solution does.
Compliance Frameworks That Require File Encryption for SharePoint Transfers
Regulation Encryption Requirements
- HIPAA PHI must be encrypted in transit and at rest when moving outside controlled environments
- GDPR Personal data must be protected with appropriate technical safeguards during transfer
- PCI DSS Cardholder data must be encrypted over open networks using strong cryptography
- GLBA Financial institutions must safeguard customer data, including during file transfer
- SOX Financial data integrity must be maintained; audit trails of file access and movement are required
How Diplomat MFT Applies Encryption to Every SharePoint Transfer
Diplomat MFT applies OpenPGP encryption automatically to files moving to and from SharePoint. Configuration is no-code simple. An operations administrator sets the encryption policy once, and it applies to every transfer in the job without developer involvement. Every encrypted transfer is logged in a full, exportable audit trail.
Key capabilities:
- Automatic OpenPGP encryption and decryption management on every SharePoint transfer
- SFTP and FTPS support for encrypted transport channels
- PGP key management integrated directly into the transfer workflow
- Audit logs tied to every transfer event, exportable for regulators and internal review
When SharePoint Needs a Dedicated MFT Engine
The three problems converge in the same scenarios: SharePoint’s lack of native SFTP support, inadequate automation tooling at scale, and the encryption gap for regulated data.
Organizations that need Diplomat MFT alongside SharePoint typically have at least one of the following conditions:
- Files moving between SharePoint and external SFTP servers on a recurring schedule
- Regulated data (PHI, PII, financial records, or payment data) passing through SharePoint as part of a business process
- A regulatory or industry standard compliance requirement to encrypt files in transit and demonstrate this to auditors
- Existing Power Automate flows or PowerShell scripts that are failing silently or becoming too costly to maintain
- Multi-cloud transfers connecting SharePoint to AWS S3, Azure Blob, or on-premises systems
Why organizations trust Diplomat MFT: Diplomat MFT has recorded zero CVEs in over 20 years of deployment and has never been breached. It is trusted by banks, hospitals, government agencies, and logistics companies where file transfers cannot fail and data cannot leak. It is rated a G2 Leader and High Performer in the managed file transfer category.
Next Steps
If SharePoint file transfers at your organization are regulated, recurring, or cross-system, Diplomat MFT is built for that exact scenario. No scripts to maintain, no silent failures, and encryption applied on every transfer automatically.
Learn More: Automate Secure SharePoint File Transfers with Diplomat MFT
Ready to see it in action? Book a SharePoint transfer demo and see how Diplomat MFT handles your specific workflow.
# # #
Frequently Asked Questions
Can SharePoint send files to an SFTP server?
Not natively. SharePoint does not include an SFTP client. A managed file transfer solution such as Diplomat MFT bridges SharePoint to any SFTP endpoint, handling the protocol translation, scheduling, and encryption automatically.
What is the best way to automate file transfers from SharePoint?
For low-volume, non-regulated file routing, Power Automate is a reasonable starting point. For recurring, regulated, or high-volume transfers, a dedicated MFT solution provides the scheduling, error handling, audit trail, and encryption that Power Automate flows cannot reliably deliver at scale.
How do I encrypt files going to and from SharePoint?
Two layers are required. SFTP or FTPS encrypts the transfer channel. OpenPGP encrypts the file itself, so it remains protected after delivery. Diplomat MFT applies both automatically, with no-code configuration and a full audit log on every transfer.
Which compliance frameworks require encrypted SharePoint file transfers?
HIPAA, GDPR, PCI DSS, GLBA, and SOX all include requirements that affect how sensitive files must be handled when moving to or from SharePoint. Each mandates encryption in transit and, in most cases, documented audit trails.