OrangeHRM

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point. Size up for larger or busier teams.

In the network security group (NSG), allow inbound 22/tcp from your management network. Also allow 80/tcp for the console, and 443/tcp once you add TLS. OrangeHRM serves plain HTTP on port 80 out of the box, so terminate TLS in front of it with your own domain for production. The bundled MariaDB is never exposed. It listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal and choose Create a resource. Search the Marketplace for OrangeHRM by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then choose Review + create and Create.

Step 2 - Deploy with the Azure CLI (alternative)

Prefer the command line? Create the VM from the SecureAnyCloud OrangeHRM image with your resource group, image URN, size and SSH key. Open ports 22 and 80 on the network security group, then browse to the public IP.

Run the commands below:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:orangehrm-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-rg \
  --name orangehrm \
  --image sac1647283583153:orangehrm-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group my-rg --name orangehrm --port 80 --priority 900

Step 3 - Confirm the services and retrieve the admin password

Connect over SSH as azureuser. All three services and the first-boot unit are active, with nginx listening on port 80 and MariaDB bound to the loopback interface only. Check them:

systemctl is-active nginx php8.3-fpm mariadb orangehrm-firstboot ss -tlnp | grep -E ':80 |:3306 '

On the first boot of every VM, the image generates a unique administrator password. It records the password, together with the sign-in URL, in a root-only file. Read the file with sudo:

sudo cat /root/orangehrm-credentials.txt

Step 4 - Sign in to OrangeHRM

Browse to http://<your-vm-ip>/. Sign in with the user Admin and the password from the credentials file. OrangeHRM presents its own sign-in page, and you can reach it by the VM public IP or your own domain.

Step 5 - The HR dashboard

After you sign in, OrangeHRM opens the dashboard. It shows the Time at Work widget, My Actions and Quick Launch. The module menu runs down the left: Admin, PIM, Leave, Time, Recruitment, My Info, Performance, Directory, Maintenance, Claim and Buzz.

Step 6 - Manage employees in PIM

Open the PIM module to manage the employee directory. Use Add Employee to add a person with their name and job details. Then search and filter the employee list by name, employment status, job title and sub unit.

Step 7 - Administer users and modules

Open the Admin module to manage system users and roles, job titles, the organization structure, qualifications, nationalities and configuration. The single Admin account ships with the image. Add HR and ESS users here as your team grows.

Security model - no default credentials

OrangeHRM's demo default Admin / admin123 is a well-known credential, and this image removes any known credential. The single Admin account is rotated to a unique per-VM secret on every first boot and stored as a modern bcrypt hash. Common guesses (admin123, admin, password, blank and others) do not authenticate.

The web installer is removed after setup so it can never run again. nginx denies direct HTTP access to the configuration, source, library and other sensitive directories. Every build proves, before the image is captured, that the per-VM admin authenticates through the real OrangeHRM login form while the default and weak guesses are rejected. To run the same check, use:

bash /usr/local/sbin/orangehrm-cred-roundtrip.sh

Where your data lives

The MariaDB database and the OrangeHRM configuration live on a dedicated Azure data disk, not on the OS disk. MariaDB's data directory is bind-mounted from the data disk onto /var/lib/mysql. OrangeHRM's lib/confs directory is bind-mounted from the same disk. Your employees, leave, time records and configuration therefore survive a VM resize or OS disk swap, and stay on managed, snapshot-friendly storage.

OrangeHRM stores employee attachments and photos in the database, so they live on the same disk. Check the mounts and the health endpoint:

curl -sI http://127.0.0.1/healthz | head -1 findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data findmnt -no SOURCE,TARGET /var/lib/mysql

Production - add your own domain and TLS

OrangeHRM serves plain HTTP on port 80 out of the box, so you can sign in immediately. Before you rely on it for day-to-day HR operations, put it behind your own domain and TLS so the console is served over HTTPS.

Point a DNS record at the VM, and open 443/tcp on the NSG. Then terminate TLS in front of nginx with a certificate from your own certificate authority (for example Let's Encrypt). Keep MariaDB on the loopback interface, take regular snapshots of the data disk, and restrict SSH to your management network.

Support

SecureAnyCloud builds and maintains this image, with 24/7 support. OrangeHRM Open Source Edition is licensed under the GNU General Public License version 3. SecureAnyCloud is not affiliated with or endorsed by OrangeHRM, Inc. This image ships only the free Open Source edition.

Deploy on Azure

Launch OrangeHRM on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com