EspoCRM

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting size. Scale up for more users or heavier workloads.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network, and 443/tcp (HTTPS) plus 80/tcp (which redirects to HTTPS) from your users.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for EspoCRM by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:espocrm:default:latest
az vm create \
  --resource-group <your-rg> \
  --name espocrm \
  --image sac1647283583153:espocrm:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name espocrm --port 443 --priority 1010

Step 3 - Connect to your VM

Connect over SSH:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that the four services behind EspoCRM report active, that the web interface answers HTTP 200 over HTTPS, and that the plain HTTP port redirects to it:

systemctl is-active nginx php8.3-fpm mysql espocrm-cron.timer curl -ks -o /dev/null -w 'web ui https -> %{http_code}\n' https://127.0.0.1/ curl -s -o /dev/null -w 'http redirect -> %{http_code}\n' http://127.0.0.1/

Expect four lines of active, then web ui https -> 200 and http redirect -> 301.

Step 5 - Retrieve your administrator credentials

On the first boot of every VM, a one-shot service (espocrm-firstboot.service) generates credentials that are unique to that VM: a fresh administrator password, a fresh MySQL password, and fresh application secret keys (cryptKey and hashSecretKey). It also generates a per-VM self-signed TLS certificate and sets the VM's own address as the site URL. No shared or default credentials ship in the image.

Read the credentials file:

sudo cat /root/espocrm-credentials.txt

The file (mode 0600, root only) contains the administrator username (espocrm.admin.user, which is admin), the administrator password (espocrm.admin.pass), the web interface URL and the database credentials.

The image is secure by default: a blank or guessed password is rejected, while the per-VM administrator from the credentials file authenticates successfully. You can verify both from the VM's own shell against EspoCRM's REST API. Each request sends an Espo-Authorization header (a base64 of username:password) to /api/v1/App/user and prints the HTTP status. A successful sign-in returns 200, and a rejected one returns 401:

U=$(sudo grep '^espocrm.admin.user=' /root/espocrm-credentials.txt | cut -d= -f2-)
P=$(sudo grep '^espocrm.admin.pass=' /root/espocrm-credentials.txt | cut -d= -f2-)
BAD=$(printf '%s:%s' "$U" password | base64 | tr -d '\n')
curl -ks -o /dev/null -w 'default password -> HTTP %{http_code}\n' -H "Espo-Authorization: $BAD" https://127.0.0.1/api/v1/App/user
GOOD=$(printf '%s:%s' "$U" "$P" | base64 | tr -d '\n')
curl -ks -o /dev/null -w 'per-VM admin -> HTTP %{http_code}\n' -H "Espo-Authorization: $GOOD" https://127.0.0.1/api/v1/App/user

Expect HTTP 401 for the default password and HTTP 200 for the per-VM admin password.

Step 6 - Sign in to the web interface

Browse to https://<vm-public-ip>/ and sign in with the administrator username (admin) and the password from the credentials file.

The image ships a per-VM self-signed certificate, so your browser shows a one-time certificate warning on first visit. Click through it, or install your own domain certificate into /etc/nginx/ssl/.

After you sign in, you land on the dashboard, which shows your activity stream and dashlets. Use the navigation menu to jump to any part of the CRM.

Step 7 - Manage your customer records

Use the navigation menu to manage Accounts, Contacts, Leads, Opportunities, Cases, Calendar, Emails, Documents and more. The application ships ready for your own data. Choose Leads, then Create Lead, fill in the name, email, status and source, and save. Each list view supports search, filtering, inline editing, mass actions and export.

Open any record to see its full detail view, with the overview and details panels, related activities, the assigned user and team, and the stream of updates. Leads convert into an Account, Contact and Opportunity in one action, so nothing is re-keyed as a relationship progresses.

Step 8 - Confirm the version and the stack

Check the EspoCRM, PHP and MySQL versions and the first-boot service:

sudo -u www-data php /var/www/espocrm/command.php version php -r 'echo PHP_VERSION."\n";' mysql --version systemctl is-active espocrm-firstboot.service

Expect EspoCRM 10.0.3, PHP 8.3.x, MySQL 8.0.x, and the first-boot service active.

First-boot service and security model

A one-shot espocrm-firstboot.service runs After=mysql.service and Before=nginx.service, so the per-VM credentials and TLS certificate are in place before the first page is served. It does the following:

• Rotates the MySQL password in lock-step with EspoCRM's stored database configuration.
• Regenerates the application cryptKey and hashSecretKey.
• Rotates the administrator password and sets the site URL from the VM's own address.
• Writes the credentials file at mode 0600 (root only), then drops a sentinel so the service runs exactly once.

Inspect the service status and the credentials file permissions:

systemctl status espocrm-firstboot.service --no-pager | head -6 sudo stat -c '%a %U:%G %n' /root/espocrm-credentials.txt

Administration from the CLI

Run admin tasks with EspoCRM's console command as the www-data user. For example, clear the cache after a configuration change:

sudo -u www-data php /var/www/espocrm/command.php clear-cache

Common operations include rebuild (apply schema changes), app-check (health check), and config:get <param> and config:set <param> <value> to inspect and change configuration.

Scheduled jobs such as email sending, reminders, webhooks and cleanup run through espocrm-cron.timer, which invokes php /var/www/espocrm/cron.php every minute. Leave that timer enabled.

Enabling HTTPS with your own domain

The image already serves HTTPS with a per-VM self-signed certificate. For production, point a real domain at the VM's public IP and open 443/tcp in the NSG. Then replace the self-signed certificate with a trusted one from Let's Encrypt, substituting your own domain:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.com

After the certificate is issued, set the new address as the site URL. EspoCRM then generates correct absolute links in emails and notifications:

sudo -u www-data php /var/www/espocrm/command.php config:set siteUrl https://your-domain.com
sudo -u www-data php /var/www/espocrm/command.php clear-cache

Backup and maintenance

The database lives in MySQL, and the application tree, including uploaded documents, lives under /var/www/espocrm. For a point-in-time backup, snapshot the OS disk in Azure. Alternatively, dump the database with the command below. The database password is in the credentials file.

sudo mysqldump espocrm > espocrm-backup.sql

Keep the OS patched with sudo apt update && sudo apt upgrade. Unattended security upgrades are enabled by default. To restart the stack, run sudo systemctl restart nginx php8.3-fpm mysql espocrm-cron.timer.

Support

This image is backed by 24/7 SecureAnyCloud support. Contact us by email or chat for help with EspoCRM deployment, upgrades, data modeling, custom entities and fields, workflows, roles and access control, portals, import and export, REST API integration, email configuration, performance tuning and database administration.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch EspoCRM on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com