Network and permissions
What the FileAgent host needs to reach, what should reach it, and how to apply least privilege everywhere — from storage accounts to console access.
Last updated July 17, 2026
#What the host needs to reach
Allow the FileAgent host to reach the systems you connect, plus a little outbound HTTPS:
| Destination | Typical access |
|---|---|
| SMB shares | SMB (port 445) |
| FTP / SFTP endpoints | FTP (21) / SFTP (22), or the custom port a partner provides |
| Amazon S3 / Azure Blob | Outbound HTTPS (443) |
| Licensing & updates | Outbound HTTPS (443) |
#What should reach the host
Inbound, only your administrators need to reach the console port. No inbound access from the internet is required. Reach the console from admin networks or a VPN, and enable IP allowlisting on supported plans to enforce it.
#Least privilege everywhere
Most file-workflow incidents come from over-permissioned accounts, not exotic exploits. Apply least privilege at every layer:
- Storage accounts get only the folder/bucket/container access a job needs — read on sources, write on destinations, delete only where Move/Sync-Mirror/Purge requires it.
- FileAgent users get the lowest role that does the work; scope access by job where available.
- The console is reachable only from admin networks.
- The host OS login list is kept short, and the host is patched regularly.
#Prefer secure transports
- Prefer SFTP over plain FTP where you have the choice.
- Verify SMB signing/encryption according to your Windows policy.
- Use your own trusted HTTPS certificate for the console.