> For the complete documentation index, see [llms.txt](https://docs.couchdrop.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.couchdrop.io/managed-file-transfer/sftp/create-sftp-users.md).

# Create SFTP Users

Learn about allowed users for SFTP and FTP

To access Couchdrop over SFTP, each person, partner, or system needs a Couchdrop SFTP user account.

Users are separate from Couchdrop Administrators and can be given access to a specific folder location. This lets you provide SFTP access without exposing administrative access to your Couchdrop tenant.

Avoid using your owner account for SFTP connections. Owner accounts have elevated permissions, while SFTP credentials are often used by external systems, applications, or business partners.

## How to create a new SFTP User

{% hint style="warning" %}

### Before you start

To create an SFTP user, you will need:

* Administrator access to your Couchdrop tenant
* A unique username and password
* A folder location for the user to access
  {% endhint %}

Creating a new Inbound SFTP user is done in the management dashboard from Couchdrop and is a simple two step process.

{% stepper %}
{% step %}

### Create an SFTP user

In Couchdrop, select **SFTP & FTPs Users**, then click **Create New**. Select **SFTP User** and continue.

If you do not see this option, contact your Couchdrop administrator.
{% endstep %}

{% step %}

### Configure the user

Configure the new user by setting a **username**, selecting their [**home/root directory**](/administration/user-and-group-management/root-directory.md), and choosing an authentication method.

You can use an **autogenerated password**, set a **custom password**, or create an **RSA key pair** for SFTP and SCP authentication.

If [**Transfer Shield**](#transfer-shield) is enabled, you can select a **content rule group** to surface or block unexpected, non-compliant, or malicious files uploaded by this user.
{% endstep %}

{% step %}

### Save your new SFTP user credentials

Once the user has been created, Couchdrop will display the user credentials and provide the option to download credentials or share them directly from the platform. 

Sharing from Couchdrop is done via email from <noreply@couchdrop.io>.
{% endstep %}
{% endstepper %}

***

## User Settings

After creating a user, you can configure additional permissions, access and security controls, and Transfer Shield DLP from the user's settings.

### General User Settings

| Setting                                             | Description                                                                                                                                                                 |
| --------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Email Address**                                   | Set or update the email address associated with the user. Optional.                                                                                                         |
| **Password**                                        | Set or update the user's password.                                                                                                                                          |
| **User must create a new password at next sign-in** | Requires the user to replace the configured password the next time they sign in.                                                                                            |
| **Public Key Authentication**                       | Adds a public key for SFTP or SCP authentication. Couchdrop supports [RSA, DSA, and ECDA public keys](/administration/user-and-group-management/passwords-and-rsa-keys.md). |

### File Permissions

| Setting                           | Description                                                                                                   |
| --------------------------------- | ------------------------------------------------------------------------------------------------------------- |
| **Home Directory**                | Sets the home or root directory for the user. This determines the highest-level location the user can access. |
| **Global filesystem permissions** | Controls the user's overall file access permissions. Read only, write only, reader/write.                     |
| **Delete allowed**                | Allows the user to delete files within locations they can access.                                             |

### Access & Security Controls

| Setting            | Description                                                                                                          |
| ------------------ | -------------------------------------------------------------------------------------------------------------------- |
| **Network ACLs**   | You can restrict a user so they can only connect from approved IP addresses or networks.                             |
| **Expiry**         | Controls whether the user expires. Select **Never Expire** or configure the user to expire after a specified period. |
| **Allow FTP/FTPS** | Allows the user to connect using [FTP or FTPS](/managed-file-transfer/ftp-and-ftps.md).                              |

### Transfer Shield

Transfer Shield lets you define the type of content expected from a user and apply controls when uploaded files do not match those expectations.

| Setting                           | Description                                                                          |
| --------------------------------- | ------------------------------------------------------------------------------------ |
| **Enable Content Classification** | Files uploaded by the user are classified using the Transfer Shield DLP engine.      |
| **Block unclassified files**      | Denies a file if Transfer Shield cannot classify it for any reason.                  |
| **Content Rule Groups**           | Applies a selected Transfer Shield content rule group to files uploaded by the user. |

Transfer Shield can be used to block files or surface them for approval when their content does not match what you expect from that user.

***

## How to bulk create SFTP users

If you need to provision multiple SFTP users, you do not need to create each user individually.

Couchdrop supports bulk and automated user provisioning for larger deployments. Depending on your environment, you can use:

* **Bulk import** - [create multiple users in one operation](broken://pages/22BtNvXJWLvJhljcAMOS).
* **SCIM provisioning** - automatically provision and manage users from a [supported identity provider](/administration/scim-and-sso.md).
* **API** - automate user provisioning using the [Couchdrop API](https://developers.couchdrop.io/administration/managing-users#create-or-modify-a-user) from your own systems.

For ongoing identity lifecycle management, use SCIM rather than manually creating users.

***

## Frequently asked questions

<details>

<summary>Can different SFTP users access different folders?</summary>

Yes. Each user can be configured with access to specific folders and storage locations.

</details>

<details>

<summary>Can I use SSH keys instead of passwords?</summary>

Yes. Couchdrop supports SSH public key authentication for SFTP users.

</details>

<details>

<summary>Can I use my own storage?</summary>

Yes. Most Couchdrop customers connect their existing cloud or on-premises storage rather than using Couchdrop hosted storage exclusively.

</details>

<details>

<summary>Can I bulk create SFTP users?</summary>

Yes. Couchdrop supports bulk import via CSV, SCIM provisioning, and automated user creation via the [Couchdrop Management API](https://developers.couchdrop.io).&#x20;

</details>