Azure Synapse/ADF Copy Activity with SFTP destination via Self-Hosted Integration Runtime.

Question

Azure Synapse/ADF Copy Activity with SFTP destination via Self-Hosted Integration Runtime.

Kishor kumar Reddy Akki 50

We are using Azure Synapse/ADF Copy Activity with SFTP destination via Self-Hosted Integration Runtime.

Error:

ErrorCode=SftpFailedToConnectToSftpServer

Inner Exception:

System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms

Source:

Renci.SshNet

Customer has confirmed:

SHIR is being used.
Windows FIPS policy is enabled.
FIPS cannot be disabled due to regulatory/security requirements.

Requesting confirmation whether the current SHIR/SFTP connector supports operation under Windows FIPS mode and whether there is a supported workaround, hotfix, updated SHIR version, or recommended architecture that allows SFTP transfers while maintaining FIPS compliance.*

0 comments

2 answers

Your answer

Answer 1

Hi Kishor,

The error:

“This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.”

is consistent with the documented FIPS issue for a Self-hosted Integration Runtime (SHIR) running on a Windows server with FIPS enabled. Microsoft documents that FIPS mode can block cryptographic classes that Copy Activity depends on. [Troublesho...soft Learn | Learn.Microsoft.com], [Create a s...soft Learn | Learn.Microsoft.com]

Microsoft provides the following workaround:

On the SHIR server, open:

C:\Program** Files\Microsoft Integration Runtime **<version>\Shared\diawp.exe.config

Under the <runtime> section, add:

<enforceFIPSPolicy** **enabled="false"/>

Save the file and restart the Self-hosted Integration Runtime machine.

Retry the SFTP Copy Activity. [Troublesho...soft Learn | Learn.Microsoft.com]

However, in your scenario FIPS must remain enforced due to regulatory/security requirements. Therefore, I would not recommend applying this workaround unless your security/compliance team approves it.

Instead, consider moving the SFTP Copy Activity away from the FIPS-enabled Windows SHIR. The SFTP connector supports Azure Integration Runtime as well as Self-hosted Integration Runtime. Microsoft also documents Managed Virtual Network Integration Runtime as an option for accessing an on-premises network. The appropriate option depends on how the SFTP server is network-restricted. [Copy and t...soft Learn | Learn.Microsoft.com]

Therefore, if FIPS cannot be bypassed, I recommend evaluating Azure IR or Managed VNet IR for the SFTP connection rather than changing the FIPS policy on the existing SHIR.

References:

Troubleshoot Azure Data Factory and Azure Synapse Analytics connectors [Troublesho...soft Learn | Learn.Microsoft.com]
Copy and transform data in SFTP server using Azure Data Factory or Azure Synapse Analytics [Copy and t...soft Learn | Learn.Microsoft.com]
Create and configure a self-hosted integration runtimehttps://learn.microsoft.com/en-us/azure/data-factory/create-self-hosted-integration-runtime?tabs=data-factory

Maksood Ahmed 15 Reputation points Microsoft External Staff Moderator

2026-10-01T11:00:33.8766667+00:00

Hi Kishor,Just following up on the SFTP Copy Activity issue. Since FIPS must remain enabled in your environment, could you please let us know whether you were able to evaluate Azure Integration Runtime or Managed VNet Integration Runtime as an alternative to the FIPS-enabled SHIR? Microsoft documents these connectivity options for the SFTP connector. citeturn9search9

If the issue is still occurring, please share the latest error so we can assist further.
Maksood Ahmed 15 Reputation points Microsoft External Staff Moderator

2026-10-02T07:52:38.5333333+00:00

Hi @Kishor kumar Reddy Akki ,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

As the issue is currently pending further updates and we have not received any recent communication, we will temporarily close the support request for now.

Please note that this closure does not prevent you from contacting us again. If additional assistance is required or new information becomes available, we will gladly continue working with you.

Thank you for your cooperation and understanding.

Sincerely,
Maksood

Answer 2

Andriy Bilous 12,276 MVP

Hello Kishor kumar Reddy Akki

This is a documented limitation with Self-Hosted Integration Runtime (SHIR) when Windows FIPS mode is enabled.

Microsoft specifically documents that Copy Activity can fail for connectors including SFTP with:

This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.

The documented workaround is to add: <enforceFIPSPolicy enabled="false"/> to diawp.exe.config and restart SHIR. However, this bypasses .NET FIPS enforcement for the SHIR process, so it does not meet a requirement where FIPS enforcement must remain enabled.
Updating SHIR is generally recommended, but the current documentation still lists this FIPS issue.

If not consider using Azure Integration Runtime instead of SHIR where network connectivity permits. The SFTP connector supports both Azure IR and SHIR, and Microsoft also documents Managed VNet IR as an option for private network access.

Official documentation:

ADF/Synapse connector troubleshooting – FIPS issue

SFTP connector documentation

Self-hosted Integration Runtime considerations

Maksood Ahmed 15 Reputation points Microsoft External Staff Moderator

2026-09-30T09:21:27.78+00:00

Hi @Kishor kumar Reddy Akki ,

Just following up on the FIPS-related SFTP Copy Activity issue.

Could you please confirm whether you were able to review the recommended options and check with your security/compliance team regarding the FIPS workaround?

If FIPS must remain enforced, please let us know whether you would like to evaluate Azure IR or Managed VNet IR as an alternative to the existing FIPS-enabled SHIR.

Please share the current status so we can proceed accordingly.