Azure Synapse/ADF Copy Activity with SFTP destination via Self-Hosted Integration Runtime.

Kishor kumar Reddy Akki 50 Reputation points
2026-09-17T19:11:10.2666667+00:00

We are using Azure Synapse/ADF Copy Activity with SFTP destination via Self-Hosted Integration Runtime.

Error:

ErrorCode=SftpFailedToConnectToSftpServer

Inner Exception:

System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms

Source:

Renci.SshNet

Customer has confirmed:

  • SHIR is being used.
  • Windows FIPS policy is enabled.
  • FIPS cannot be disabled due to regulatory/security requirements.

Requesting confirmation whether the current SHIR/SFTP connector supports operation under Windows FIPS mode and whether there is a supported workaround, hotfix, updated SHIR version, or recommended architecture that allows SFTP transfers while maintaining FIPS compliance.*

Azure Synapse Analytics
Azure Synapse Analytics

An Azure analytics service that brings together data integration, enterprise data warehousing, and big data analytics. Previously known as Azure SQL Data Warehouse.

0 comments

2 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Andriy Bilous 12,276 Reputation points MVP
    2026-09-18T03:47:35.4366667+00:00

    Hello Kishor kumar Reddy Akki

    This is a documented limitation with Self-Hosted Integration Runtime (SHIR) when Windows FIPS mode is enabled.

    Microsoft specifically documents that Copy Activity can fail for connectors including SFTP with:

    This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.

    The documented workaround is to add: <enforceFIPSPolicy enabled="false"/> to diawp.exe.config and restart SHIR. However, this bypasses .NET FIPS enforcement for the SHIR process, so it does not meet a requirement where FIPS enforcement must remain enabled.
    Updating SHIR is generally recommended, but the current documentation still lists this FIPS issue.

    If not consider using Azure Integration Runtime instead of SHIR where network connectivity permits. The SFTP connector supports both Azure IR and SHIR, and Microsoft also documents Managed VNet IR as an option for private network access.

    Official documentation:

    ADF/Synapse connector troubleshooting – FIPS issue

    SFTP connector documentation

    Self-hosted Integration Runtime considerations

    Was this answer helpful?

  2. Maksood Ahmed 15 Reputation points Microsoft External Staff Moderator
    2026-09-29T11:57:42.9866667+00:00

    Hi Kishor,

    The error:

    “This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.”

    is consistent with the documented FIPS issue for a Self-hosted Integration Runtime (SHIR) running on a Windows server with FIPS enabled. Microsoft documents that FIPS mode can block cryptographic classes that Copy Activity depends on. [Troublesho...soft Learn | Learn.Microsoft.com], [Create a s...soft Learn | Learn.Microsoft.com]

    Microsoft provides the following workaround:

    1. On the SHIR server, open:

    C:\Program** Files\Microsoft Integration Runtime **<version>\Shared\diawp.exe.config

    1. Under the <runtime> section, add:

    <enforceFIPSPolicy** **enabled="false"/>

    Save the file and restart the Self-hosted Integration Runtime machine.

    Retry the SFTP Copy Activity. [Troublesho...soft Learn | Learn.Microsoft.com]

    However, in your scenario FIPS must remain enforced due to regulatory/security requirements. Therefore, I would not recommend applying this workaround unless your security/compliance team approves it.

    Instead, consider moving the SFTP Copy Activity away from the FIPS-enabled Windows SHIR. The SFTP connector supports Azure Integration Runtime as well as Self-hosted Integration Runtime. Microsoft also documents Managed Virtual Network Integration Runtime as an option for accessing an on-premises network. The appropriate option depends on how the SFTP server is network-restricted. [Copy and t...soft Learn | Learn.Microsoft.com]

    Therefore, if FIPS cannot be bypassed, I recommend evaluating Azure IR or Managed VNet IR for the SFTP connection rather than changing the FIPS policy on the existing SHIR.

    References:

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.