Neo4j 2026

Search for Neo4j 2026 in the Azure Marketplace. Select the SecureAnyCloud entry and choose Create.

In Networking, allow SSH (22) from your address. Add inbound rules for TCP 7473 and TCP 7687 from your client networks.

First boot takes one to two minutes after the VM is running. During this time, the VM generates its certificate and password, creates the databases and starts Neo4j.

RG="neo4j-prod"; LOCATION="eastus"; VM_NAME="neo4j-01" IMAGE_URN="sac1647283583153:neo4j-2026-ubuntu-24-04:default:latest" CLIENT_CIDR="<your-mgmt-cidr>" az group create --name "$RG" --location "$LOCATION" az network nsg create -g "$RG" --name neo4j-nsg az network nsg rule create -g "$RG" --nsg-name neo4j-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "$CLIENT_CIDR" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name neo4j-nsg --name allow-neo4j --priority 110 \
  --source-address-prefixes "$CLIENT_CIDR" --destination-port-ranges 7473 7687 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn "$IMAGE_URN"
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --admin-username azureuser --ssh-key-values ~/.ssh/id_rsa.pub \
  --nsg neo4j-nsg --public-ip-sku Standard

First boot takes a minute or two. If you connect as soon as the VM shows as running, wait for the per-VM setup to finish before you continue:

bash sudo cloud-init status --wait

The command prints status: done. Then systemctl is-active neo4j-firstboot.service reports active.

ssh azureuser@<vm-ip>

The login banner shows the Neo4j Browser and Bolt addresses for this VM. Confirm that Neo4j is running and listening only on the HTTPS and Bolt ports:

systemctl is-active neo4j.service neo4j-firstboot.service
sudo ss -Htln '( sport = :7473 or sport = :7474 or sport = :7687 )'

Both services report active. Neo4j listens on port 7473 (HTTPS) and port 7687 (Bolt with TLS) on all addresses. Nothing listens on 7474.

The neo4j password is unique to this VM. It is written to a root-only file (mode 0600) at first boot. Print only the field names, never the password itself:

sudo grep -oE '^[A-Z0-9_]+=' /root/neo4j-credentials.txt

The command lists these fields:

• NEO4J_HOST: the address Neo4j advertises, which is the VM's public IP, or its private IP when it has none
• NEO4J_USER: neo4j
• NEO4J_PASSWORD: the per-VM password
• NEO4J_BROWSER_URL, NEO4J_HTTPS_URL and NEO4J_BOLT_URI

Read the password with sudo sed -n 's/^NEO4J_PASSWORD=//p' /root/neo4j-credentials.txt when you need it. Keep it safe, because it is the database administrator's password.

The VM's certificate covers its public and private IP addresses, its host name, localhost and 127.0.0.1.

Neo4j's HTTP API (the Query API at /db/neo4j/query/v2) refuses an anonymous request, a wrong password and the documented default neo4j/neo4j. Each gets 401 Unauthorized.

Save the VM's certificate so curl can verify the connection:

sudo cat /var/lib/neo4j/certificates/sac/public.crt > /tmp/neo4j.crt
H=$(sudo sed -n 's/^NEO4J_HOST=//p' /root/neo4j-credentials.txt) Q='{"statement":"RETURN 1 AS one"}' curl -s --cacert /tmp/neo4j.crt --resolve "$H:7473:127.0.0.1" -o /dev/null -w 'anonymous: HTTP %{http_code}\n' -H 'Content-Type: application/json' -d "$Q" "https://$H:7473/db/neo4j/query/v2" curl -s --cacert /tmp/neo4j.crt --resolve "$H:7473:127.0.0.1" -u 'neo4j:wrong-password' -o /dev/null -w 'wrong password: HTTP %{http_code}\n' -H 'Content-Type: application/json' -d "$Q" "https://$H:7473/db/neo4j/query/v2" curl -s --cacert /tmp/neo4j.crt --resolve "$H:7473:127.0.0.1" -u 'neo4j:neo4j' -o /dev/null -w 'neo4j/neo4j: HTTP %{http_code}\n' -H 'Content-Type: application/json' -d "$Q" "https://$H:7473/db/neo4j/query/v2"

Each request returns HTTP 401. Neo4j locks an account for a few seconds after three failed logins in a row, so wait a moment before you use the real password. With the per-VM password, the query runs:

sleep 6
H=$(sudo sed -n 's/^NEO4J_HOST=//p' /root/neo4j-credentials.txt) printf 'user = "neo4j:%s"\n' "$(sudo sed -n 's/^NEO4J_PASSWORD=//p' /root/neo4j-credentials.txt)" | \
  curl -s --cacert /tmp/neo4j.crt --resolve "$H:7473:127.0.0.1" -K - -w '\nHTTP %{http_code}\n' \
  -H 'Content-Type: application/json' -d '{"statement":"RETURN 1 AS one"}' "https://$H:7473/db/neo4j/query/v2"

The response is HTTP 202 with "data":{"fields":["one"],"values":[[1]]}. The password is passed to curl on standard input, so it does not appear in the process list.

cypher-shell reads the password from the NEO4J_PASSWORD environment variable. Set it in each new shell, as below.

Bolt requires TLS, so use the bolt+ssc:// scheme on the VM itself. The connection is encrypted, but the self-signed certificate is not checked:

export NEO4J_PASSWORD="$(sudo sed -n 's/^NEO4J_PASSWORD=//p' /root/neo4j-credentials.txt)" echo "CALL dbms.components() YIELD name, versions, edition RETURN name, versions[0] AS version, edition;" | \
  cypher-shell -a bolt+ssc://localhost:7687 -u neo4j --format plain

The command prints "Neo4j Kernel", "2026.10.1", "community". A plain, unencrypted connection is refused:

export NEO4J_PASSWORD="$(sudo sed -n 's/^NEO4J_PASSWORD=//p' /root/neo4j-credentials.txt)" echo "RETURN 1;" | cypher-shell -a bolt://localhost:7687 -u neo4j --format plain 2>&1 | head -3 || true

Create a small graph and query it:

export NEO4J_PASSWORD="$(sudo sed -n 's/^NEO4J_PASSWORD=//p' /root/neo4j-credentials.txt)" cat <<'EOF' | cypher-shell -a bolt+ssc://localhost:7687 -u neo4j --format plain MERGE (alice:Person {name: 'Alice'}) MERGE (bob:Person {name: 'Bob'}) MERGE (carol:Person {name: 'Carol'}) MERGE (graphs:Topic {name: 'Graph databases'}) MERGE (alice)-[:KNOWS]->(bob) MERGE (bob)-[:KNOWS]->(carol) MERGE (alice)-[:INTERESTED_IN]->(graphs) MERGE (carol)-[:INTERESTED_IN]->(graphs); MATCH (p:Person)-[:KNOWS*1..2]->(friend:Person) WHERE p.name = 'Alice' RETURN friend.name AS reachable_from_alice ORDER BY reachable_from_alice; EOF

The query returns Bob and Carol. Carol is reached through Bob, which is a two-hop traversal.

With TCP 7473 and 7687 open to your address in the network security group, open https://<vm-ip>:7473/browser/ in your browser.

If you prefer to keep those ports closed, use an SSH tunnel and open https://localhost:7473/browser/ instead. The VM's certificate also covers localhost:

ssh -N -L 7473:localhost:7473 -L 7687:localhost:7687 azureuser@<vm-ip>

The certificate is self-signed and unique to the VM, so your browser warns once. Accept it for this host. For production, see Step 9.

In the Connect to instance dialog, choose neo4j+s:// as the protocol. Enter the VM's address and port 7687 as the connection URL (localhost:7687 through the tunnel). Keep neo4j as the database user, and enter the per-VM password:

If the connection fails with a security or certificate message, your browser has not yet accepted the certificate for the Bolt port. Open https://<vm-ip>:7687 (or https://localhost:7687) once in a new tab and accept the warning. The page itself then shows an error, which is expected. Connect again.

Once connected, type Cypher in the editor at the top and choose Run. The graph from Step 6 is drawn as nodes and relationships, with a summary of the labels and relationship types:

Queries that return values are shown as a table, here the two-hop traversal from Alice:

:sysinfo lists the databases (neo4j and system), the address they are served on and their status:

Every Neo4j driver (Python, Java, JavaScript, .NET, Go) connects over Bolt on port 7687 with TLS.

With the self-signed certificate, use the neo4j+ssc:// scheme. The connection is encrypted, but the certificate is not checked.

To verify the server, copy /var/lib/neo4j/certificates/sac/public.crt from the VM and add it to the client's trust store. Alternatively, replace the certificate with one from your own certificate authority. Then use neo4j+s://.

For example, in Python (pip install neo4j):

from neo4j import GraphDatabase driver = GraphDatabase.driver("neo4j+ssc://<vm-ip>:7687", auth=("neo4j", "<NEO4J_PASSWORD>")) with driver.session() as session: print(session.run("MATCH (n) RETURN count(n) AS nodes").single()["nodes"]) driver.close()

Create a separate user for each application instead of sharing the neo4j administrator. Community Edition users all have full access, so keep the list short.

For example, run this in cypher-shell or Neo4j Browser connected to the system database: CREATE USER app SET PASSWORD 'a-long-random-password' CHANGE NOT REQUIRED;

To change the neo4j password, run ALTER CURRENT USER SET PASSWORD FROM 'current-password' TO 'new-password'; in Neo4j Browser or cypher-shell. Then update /root/neo4j-credentials.txt yourself, because the file is not rewritten.

Neo4j advertises one address to its clients. The Bolt routing table and Neo4j Browser use it. On first boot, the address is the VM's public IP address from the Azure metadata service, or its private IP when the VM has no public IP.

After you point a DNS record at the VM, set the name and issue a new certificate for it:

sudo neo4j-set-hostname neo4j.<your-domain>

The command regenerates the self-signed certificate, records the name in /etc/sac/neo4j-hostname and restarts Neo4j.

For production, replace the self-signed certificate with your own CA-issued certificate. Put private.key and public.crt in /var/lib/neo4j/certificates/sac/ and restart Neo4j.

Print Neo4j's memory recommendation for this VM size with:

sudo -u neo4j neo4j-admin server memory-recommendation 2>/dev/null | grep -E '^server\.memory'

Copy the server.memory.heap.initial_size, server.memory.heap.max_size and server.memory.pagecache.size lines into /etc/neo4j/neo4j.conf. Then run sudo systemctl restart neo4j.

Option A: AWS Marketplace console

• Open the SecureAnyCloud Hardened Neo4j & Graph and RDF Databases AMIs listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• Choose Launch your software. In Version, choose Neo4j 2026 Community on Ubuntu 24.04 - YYYY-MM-DD, and choose your Region.
• Instance type: m5.large is recommended.
• Key pair: choose your EC2 key pair.
• Security group: allow TCP 22 from your own address, and TCP 7473 and 7687 from your clients.
• Choose Launch. First boot takes one to two minutes after the instance is reachable. During this time, the instance generates its certificate and password, creates the databases and starts Neo4j.

Option B: AWS CLI

Run this command on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page. Replace the key pair, security group and subnet with your own:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=neo4j}]'

The AMI already requires IMDSv2, so you do not need --metadata-options. The data volume is part of the AMI and is created with the instance.

ssh -i my-key-pair.pem ubuntu@<vm-ip>

The login banner shows the Neo4j Browser and Bolt addresses for this instance.

Confirm that Neo4j is running and listening only on the HTTPS and Bolt ports:

systemctl is-active neo4j.service
sudo ss -Htln '( sport = :7473 or sport = :7474 or sport = :7687 )'

The service reports active. Neo4j listens on 0.0.0.0:7473 (HTTPS) and 0.0.0.0:7687 (Bolt with TLS). Nothing listens on 7474.

The data volume is mounted at /var/lib/neo4j/data:

findmnt -no SOURCE,FSTYPE,SIZE /var/lib/neo4j/data

The neo4j password is unique to this instance. It is written to a root-only file at first boot. Print only the field names, never the password itself:

sudo grep -oE '^[A-Z0-9_]+=' /root/neo4j-credentials.txt

The command lists these fields:

• NEO4J_HOST: the hostname Neo4j advertises
• NEO4J_USER: neo4j
• NEO4J_PASSWORD: the per-instance password
• NEO4J_BROWSER_URL, NEO4J_HTTPS_URL and NEO4J_BOLT_URI

Read the password with sudo sed -n 's/^NEO4J_PASSWORD=//p' /root/neo4j-credentials.txt when you need it. Keep it safe, because it is the database administrator's password.

Neo4j's HTTP API (the Query API at /db/neo4j/query/v2) refuses an anonymous request, a wrong password and the documented default neo4j/neo4j. Each gets 401 Unauthorized.

Save the instance's certificate so curl can verify the connection:

sudo cat /var/lib/neo4j/certificates/sac/public.crt > /tmp/neo4j.crt
H=$(sudo sed -n 's/^NEO4J_HOST=//p' /root/neo4j-credentials.txt) Q='{"statement":"RETURN 1 AS one"}' curl -s --cacert /tmp/neo4j.crt --resolve "$H:7473:127.0.0.1" -o /dev/null -w 'anonymous: HTTP %{http_code}\n' -H 'Content-Type: application/json' -d "$Q" "https://$H:7473/db/neo4j/query/v2" curl -s --cacert /tmp/neo4j.crt --resolve "$H:7473:127.0.0.1" -u 'neo4j:wrong-password' -o /dev/null -w 'wrong password: HTTP %{http_code}\n' -H 'Content-Type: application/json' -d "$Q" "https://$H:7473/db/neo4j/query/v2" curl -s --cacert /tmp/neo4j.crt --resolve "$H:7473:127.0.0.1" -u 'neo4j:neo4j' -o /dev/null -w 'neo4j/neo4j: HTTP %{http_code}\n' -H 'Content-Type: application/json' -d "$Q" "https://$H:7473/db/neo4j/query/v2"

Each request returns HTTP 401. Neo4j locks an account for a few seconds after three failed logins in a row, so wait a moment before you use the real password. With the per-instance password, the query runs:

sleep 6
H=$(sudo sed -n 's/^NEO4J_HOST=//p' /root/neo4j-credentials.txt) printf 'user = "neo4j:%s"\n' "$(sudo sed -n 's/^NEO4J_PASSWORD=//p' /root/neo4j-credentials.txt)" | \
  curl -s --cacert /tmp/neo4j.crt --resolve "$H:7473:127.0.0.1" -K - -w '\nHTTP %{http_code}\n' \
  -H 'Content-Type: application/json' -d '{"statement":"RETURN 1 AS one"}' "https://$H:7473/db/neo4j/query/v2"

The response is HTTP 202 with "data":{"fields":["one"],"values":[[1]]}. The password is passed to curl on standard input, so it does not appear in the process list.

cypher-shell reads the password from the NEO4J_PASSWORD environment variable. Set it in each new shell, as below.

Bolt requires TLS, so use the bolt+ssc:// scheme on the instance itself. The connection is encrypted, but the self-signed certificate is not checked:

export NEO4J_PASSWORD="$(sudo sed -n 's/^NEO4J_PASSWORD=//p' /root/neo4j-credentials.txt)" echo "CALL dbms.components() YIELD name, versions, edition RETURN name, versions[0] AS version, edition;" | \
  cypher-shell -a bolt+ssc://localhost:7687 -u neo4j --format plain

The command prints "Neo4j Kernel", "2026.10.1", "community". A plain, unencrypted connection is refused:

export NEO4J_PASSWORD="$(sudo sed -n 's/^NEO4J_PASSWORD=//p' /root/neo4j-credentials.txt)" echo "RETURN 1;" | cypher-shell -a bolt://localhost:7687 -u neo4j --format plain 2>&1 | head -3 || true

Create a small graph and query it:

export NEO4J_PASSWORD="$(sudo sed -n 's/^NEO4J_PASSWORD=//p' /root/neo4j-credentials.txt)" cat <<'EOF' | cypher-shell -a bolt+ssc://localhost:7687 -u neo4j --format plain MERGE (alice:Person {name: 'Alice'}) MERGE (bob:Person {name: 'Bob'}) MERGE (carol:Person {name: 'Carol'}) MERGE (graphs:Topic {name: 'Graph databases'}) MERGE (alice)-[:KNOWS]->(bob) MERGE (bob)-[:KNOWS]->(carol) MERGE (alice)-[:INTERESTED_IN]->(graphs) MERGE (carol)-[:INTERESTED_IN]->(graphs); MATCH (p:Person)-[:KNOWS*1..2]->(friend:Person) WHERE p.name = 'Alice' RETURN friend.name AS reachable_from_alice ORDER BY reachable_from_alice; EOF

The query returns Bob and Carol. Carol is reached through Bob, which is a two-hop traversal.

Open https://<public-dns>:7473/browser/ in your browser. The certificate is self-signed and unique to the instance, so your browser warns once. Accept it for this host. For production, see Step 9.

The Connect to instance dialog already shows this instance's address (the hostname Neo4j advertises) and port 7687. Choose neo4j+s:// as the protocol. Keep neo4j as the database user, and enter the per-instance password:

If the connection fails with a security or certificate message, your browser has not yet accepted the certificate for the Bolt port. Open https://<public-dns>:7687 once in a new tab and accept the warning. The page itself then shows an error, which is expected. Connect again.

Once connected, type Cypher in the editor at the top and choose Run. The graph from Step 6 is drawn as nodes and relationships, with a summary of the labels and relationship types:

Queries that return values are shown as a table, here the two-hop traversal from Alice:

:sysinfo lists the databases (neo4j and system), the address they are served on and their status:

Every Neo4j driver (Python, Java, JavaScript, .NET, Go) connects over Bolt on port 7687 with TLS.

With the self-signed certificate, use the neo4j+ssc:// scheme. The connection is encrypted, but the certificate is not checked.

To verify the server, copy /var/lib/neo4j/certificates/sac/public.crt from the instance and add it to the client's trust store. Alternatively, replace the certificate with one from your own certificate authority. Then use neo4j+s://.

For example, in Python (pip install neo4j):

from neo4j import GraphDatabase driver = GraphDatabase.driver("neo4j+ssc://<public-dns>:7687", auth=("neo4j", "<NEO4J_PASSWORD>")) with driver.session() as session: print(session.run("MATCH (n) RETURN count(n) AS nodes").single()["nodes"]) driver.close()

Create a separate user for each application instead of sharing the neo4j administrator. Community Edition users all have full access, so keep the list short.

For example, run this in cypher-shell or Neo4j Browser connected to the system database: CREATE USER app SET PASSWORD 'a-long-random-password' CHANGE NOT REQUIRED;

To change the neo4j password, run ALTER CURRENT USER SET PASSWORD FROM 'current-password' TO 'new-password'; in Neo4j Browser or cypher-shell. Then update /root/neo4j-credentials.txt yourself, because the file is not rewritten.

Neo4j advertises one hostname to its clients. The Bolt routing table and Neo4j Browser use it. On first boot, the hostname is the instance's public DNS name from the EC2 metadata service.

After you point a DNS record at the instance, set the name and issue a new certificate for it:

sudo neo4j-set-hostname neo4j.example.com

The command regenerates the self-signed certificate, records the name in /etc/sac/neo4j-hostname and restarts Neo4j.

For production, replace the self-signed certificate with your own CA-issued certificate. Put private.key and public.crt in /var/lib/neo4j/certificates/sac/ and restart Neo4j.

Print Neo4j's memory recommendation for this instance size with:

sudo -u neo4j neo4j-admin server memory-recommendation 2>/dev/null | grep -E '^server\.memory'

Copy the server.memory.heap.initial_size, server.memory.heap.max_size and server.memory.pagecache.size lines into /etc/neo4j/neo4j.conf. Then run sudo systemctl restart neo4j.

To grow the data disk, enlarge its EBS volume in the EC2 console. Then run sudo resize2fs on the device that findmnt /var/lib/neo4j/data shows.