SQL Server 2025 Enterprise

In the Azure Portal, open Marketplace, search for SQL Server 2025 Enterprise and select the SecureAnyCloud publisher entry. Select Create to start the wizard.

On the Basics tab, choose your subscription, target resource group and region, and set the virtual machine name. Choose SSH public key as the authentication type, enter a username (the examples below use azureuser) and paste your SSH public key. Standard_D2s_v5 is the recommended starting size.

On the Disks tab, set the OS disk type to Standard SSD or Premium SSD. By default, SQL Server data lives at /var/opt/mssql/data on the root disk. For production workloads, attach a separate Premium SSD data disk and bind mount it over /var/opt/mssql/data before you start the service.

On the Networking tab, select your existing virtual network and subnet. Attach a network security group that allows inbound TCP 22 from your management IP range and inbound TCP 1433 only from application server subnets or the virtual network CIDR. Do not expose port 1433 to the public internet. The SA password is stored in plain text on the virtual machine by design, so that you can read it without further steps. An internet-exposed SQL Server port would make brute-force attacks trivial.

On the Management, Monitoring and Advanced tabs, the defaults are appropriate. Select Review + create, wait for validation to pass, then select Create. Deployment takes around two minutes.

To deploy from the command line, accept the Marketplace terms once, then deploy from the Marketplace image URN.

RG="mssql-prod" LOCATION="eastus" VM_NAME="mssql-01" ADMIN_USER="azureuser" IMAGE_URN="sac1647283583153:mssql-2025-enterprise-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create \
  --resource-group "$RG" \
  --name mssql-vnet \
  --address-prefix 10.80.0.0/16 \
  --subnet-name mssql-subnet \
  --subnet-prefix 10.80.1.0/24 az network nsg create --resource-group "$RG" --name mssql-nsg az network nsg rule create \
  --resource-group "$RG" --nsg-name mssql-nsg \
  --name allow-ssh-mgmt --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" \
  --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create \
  --resource-group "$RG" --nsg-name mssql-nsg \
  --name allow-sql-vnet --priority 110 \
  --source-address-prefixes VirtualNetwork \
  --destination-port-ranges 1433 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:mssql-2025-enterprise-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" \
  --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_D2s_v5 \
  --admin-username "$ADMIN_USER" \
  --ssh-key-values "$SSH_KEY" \
  --nsg mssql-nsg \
  --vnet-name mssql-vnet \
  --subnet mssql-subnet \
  --storage-sku Premium_LRS \
  --location "$LOCATION"

When the virtual machine is running, connect over SSH. Use the private IP address from inside the virtual network, or the public IP address if you have configured a bastion or direct management access. The default admin user is azureuser.

ssh azureuser@<vm-ip>

The mssql-firstboot.service runs automatically on first boot and completes within about 90 seconds. It has typically finished by the time your SSH session opens. Confirm the service status.

sudo systemctl status mssql-server.service --no-pager

The status should be active (running). Confirm that the first-boot sentinel file exists.

sudo test -f /var/opt/mssql/.firstboot-done && echo FIRSTBOOT_DONE

Confirm that the TCP listener is bound on port 1433.

sudo ss -tln | grep 1433

First boot generates random SA and SecureAnyCloud passwords on this virtual machine and writes them to a root-only file. Read the file as root.

sudo cat /stage/scripts/mssql-credentials.log

The file contains lines similar to the following.

SA_USER=sa SA_PASSWORD=<SA_PASSWORD> SAC_USER=sac SAC_PASSWORD=<SAC_PASSWORD> SAC_DATABASE=sac

Store the values in your secret store. You can shred the credentials file once you have saved the passwords. Alternatively, keep the file root-protected at mode 0600 for the life of the virtual machine.

The mssql-tools18 package installs sqlcmd at /opt/mssql-tools18/bin/sqlcmd. Verify that the binary is on your PATH.

sudo ls -l /opt/mssql-tools18/bin/sqlcmd

Connect to the server as SA, reading the password directly from the credentials file.

SA_PASS=$(sudo awk -F= '/^SA_PASSWORD=/{print $2}' /stage/scripts/mssql-credentials.log) /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "$SA_PASS" -C -Q "SELECT @@VERSION;"

The server reports Microsoft SQL Server 2025.

Confirm the running edition.

SA_PASS=$(sudo awk -F= '/^SA_PASSWORD=/{print $2}' /stage/scripts/mssql-credentials.log) /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "$SA_PASS" -C -Q "SELECT SERVERPROPERTY('Edition') AS Edition;" -h -1 -W

The query returns Enterprise Edition (64-bit).

The image ships Enterprise Core binaries in evaluation mode. Apply your product key to activate the license. Replace YOUR_STANDARD_LICENSE_KEY with the key from your Microsoft Volume Licensing agreement.

sudo /opt/mssql/bin/mssql-conf setpid YOUR_STANDARD_LICENSE_KEY
sudo systemctl restart mssql-server.service

After the restart, verify that the license is active.

SA_PASS=$(sudo awk -F= '/^SA_PASSWORD=/{print $2}' /stage/scripts/mssql-credentials.log) /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "$SA_PASS" -C -Q "SELECT SERVERPROPERTY('LicenseType') AS LicenseType;" -h -1 -W

The value PER_CORE confirms a perpetual Standard license. The value EVAL means the 180-day evaluation period is still active.

The SecureAnyCloud database and SecureAnyCloud login are ready to use from first boot. Run a round-trip query as the SecureAnyCloud user.

CL_PASS=$(sudo awk -F= '/^SAC_PASSWORD=/{print $2}' /stage/scripts/mssql-credentials.log) /opt/mssql-tools18/bin/sqlcmd -S localhost -U sac -P "$CL_PASS" -C -d sac -h -1 -W -Q "CREATE TABLE ##probe (id INT, val NVARCHAR(64)); INSERT INTO ##probe VALUES (1, N'sac-ok'); SELECT val FROM ##probe WHERE id=1; DROP TABLE IF EXISTS ##probe;"

The output includes sac-ok, which confirms that the SecureAnyCloud user has the expected permissions on the SecureAnyCloud database.

From any host in the same virtual network that has sqlcmd or SQL Server Management Studio installed, connect on port 1433 with the SA or SecureAnyCloud credentials. The following example shows a sqlcmd connection from a remote client.

sqlcmd -S <private-ip>,1433 -U sa -P '<SA_PASSWORD>' -C -d sac

SQL Server Management Studio and Azure Data Studio connect the same way, using the virtual machine's private IP address and the SA or SecureAnyCloud credentials. From a management workstation outside the virtual network, use Azure Bastion or an SSH tunnel. Do not open port 1433 to the public internet.

The following table lists each component and its path.

Component Path

SQL Server daemon /opt/mssql/bin/sqlservr

sqlcmd client /opt/mssql-tools18/bin/sqlcmd

bcp bulk copy utility /opt/mssql-tools18/bin/bcp

mssql-conf configuration tool /opt/mssql/bin/mssql-conf

SQL Server data directory /var/opt/mssql/data/

SQL Server log directory /var/opt/mssql/log/

Systemd unit /lib/systemd/system/mssql-server.service

Firstboot systemd unit /etc/systemd/system/mssql-firstboot.service

Firstboot script /usr/local/sbin/mssql-firstboot.sh

Credentials file /stage/scripts/mssql-credentials.log

Firstboot sentinel /var/opt/mssql/.firstboot-done

Inspect the installed mssql-server package version.

dpkg -l mssql-server mssql-tools18 | awk '/^ii/{print $2, $3}'

The following table lists the mount points and what each one holds.

Mount point Size Description

/ 32 GB Root filesystem (includes /var/opt/mssql)

/boot 1 GB Operating system kernel files

/var/opt/mssql/data (on root) SQL Server data directory

/var/opt/mssql/log (on root) SQL Server transaction logs and error logs

For production workloads, attach a separate Premium SSD data disk, format it with xfs and bind mount it over /var/opt/mssql/data before you start the service. Place the transaction log directory on a separate disk for I/O isolation. This keeps database I/O off the OS disk and lets you resize and snapshot the data and log volumes independently.

systemd starts and stops SQL Server through the mssql-server.service unit.

Check the service status.

sudo systemctl status mssql-server.service --no-pager

Stop SQL Server.

sudo systemctl stop mssql-server.service && echo "mssql-server stopped"

Start SQL Server.

sudo systemctl start mssql-server.service && echo "mssql-server started"

Restart SQL Server.

sudo systemctl restart mssql-server.service && echo "mssql-server restarted"

View the SQL Server error log.

sudo tail -n 50 /var/opt/mssql/log/errorlog

Cannot connect to SQL Server on port 1433

Verify that the service is running: sudo systemctl status mssql-server.service

Verify that the listener is bound: sudo ss -tln | grep 1433

Check the error log: sudo tail -n 50 /var/opt/mssql/log/errorlog

Confirm that the network security group allows TCP 1433 from your client source IP.

Confirm that the virtual machine NIC is in the expected subnet with the NSG attached.

Authentication errors after connecting

Read the SA password again: sudo awk -F= '/^SA_PASSWORD=/{print $2}' /stage/scripts/mssql-credentials.log

Verify that the first-boot sentinel exists: ls -la /var/opt/mssql/.firstboot-done. If the file is absent, mssql-firstboot.service did not complete, so check its journal.

Check the first-boot journal: sudo journalctl -u mssql-firstboot.service --no-pager

First-boot service did not run

Check the first-boot service status: sudo systemctl status mssql-firstboot.service --no-pager

Read the journal: sudo journalctl -u mssql-firstboot.service --no-pager -n 100

Verify that SQL Server started: sudo systemctl status mssql-server.service

If SQL Server failed to start, check the error log: sudo tail -n 100 /var/opt/mssql/log/errorlog

License evaluation expiry

Run SELECT SERVERPROPERTY('LicenseType') to see the current state. The value EVAL means the 180-day evaluation is still active.

Apply your Standard product key, then restart the service: sudo /opt/mssql/bin/mssql-conf setpid <your-product-key> followed by sudo systemctl restart mssql-server.service

After the restart, confirm that the new state is PER_CORE.

Service fails to start

Check the systemd journal: sudo journalctl -u mssql-server.service --no-pager -n 100

Check the SQL Server error log: sudo tail -n 100 /var/opt/mssql/log/errorlog

Check filesystem space: df -h /var/opt/mssql

Verify data directory ownership: sudo ls -la /var/opt/mssql/data | head. The files should be owned by mssql:mssql.

Rotate the SA password on a schedule with ALTER LOGIN [sa] WITH PASSWORD=N'<new-password>';

Create application-specific logins with minimal privileges. Never connect application code as SA.

Restrict port 1433 to trusted application server subnets only in your NSG.

Disable the SA login once named logins are in place: ALTER LOGIN [sa] DISABLE;

Back up regularly with native BACKUP DATABASE statements or SQL Agent jobs.

Keep SQL Server updated by running sudo apt-get update && sudo apt-get upgrade mssql-server periodically. The official packages.microsoft.com APT repository is already configured on this image.

Shred the credentials file once the passwords are stored in your secret store: sudo shred -u /stage/scripts/mssql-credentials.log

SQL Server 2025 Enterprise Edition is Microsoft proprietary software. A valid per-core Standard license is required for production use after the 180-day evaluation period. Microsoft Server and SQL Server are registered trademarks of Microsoft Corporation.

SecureAnyCloud provides commercial support for this image, separate from the upstream Microsoft product. Contact us at any time for support questions, architectural advice, capacity planning or migration help.

Email: sales@secureanycloud.com

Website: secureanycloud.com

Support hours: 24/7 with guaranteed 24 hour response SLA

Deploy on Azure

Launch SQL Server 2025 Enterprise on Ubuntu 24.04 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Launch SQL Server 2025 Enterprise on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Sign in to the AWS Management Console, open the EC2 service and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for SQL Server 2025.

Select the SecureAnyCloud listing and choose Select. On the subscription summary, pick the SQL Server 2025 Enterprise on Ubuntu 24.04 delivery option and choose Continue.

Pick an instance type that suits your workload (see Prerequisites). Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and create or select a security group that allows inbound port 22 from your management network. Add port 1433 to the security group if you want external clients to connect to SQL Server directly. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialization generates the SA password and starts SQL Server. It takes a minute or two after the instance state becomes Running and the status checks pass.

The following command launches an instance from the SecureAnyCloud SQL Server 2025 Enterprise Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing for the Enterprise delivery option. Replace <key-name> with your EC2 key pair name and <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens inbound port 22, and optionally port 1433 for external SQL connections.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.xlarge \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --metadata-options HttpTokens=required \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":40,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=mssql-01}]'

On success, the command prints a JSON document. Note the instance ID, then retrieve the instance's public address once it is running.

aws ec2 describe-instances \
  --instance-ids <instance-id> \
  --query "Reservations[].Instances[].PublicIpAddress" \
  --output text

Connect over SSH with the key pair you selected and the public IP address from Step 2. This delivery option is built on Ubuntu 24.04, so the SSH login user is ubuntu.

ssh ubuntu@<your-instance-ip>

Wait for the instance to pass both EC2 status checks before you connect. The first-boot service runs before the SSH daemon is ready, so SQL Server is initialized by the time you can log in.

The first-boot service generates a fresh SA password for this instance and writes it, with the connection details, to /root/mssql-credentials.txt. Only the root user can read the file. Display it from your SSH session.

sudo cat /root/mssql-credentials.txt

The file has the following layout. The passwords on your instance are unique.

# SQL Server 2025 Enterprise Edition -- Per-Instance Credentials
# Generated: Wed Jun 04 09:00:00 UTC 2026
# Instance IP: 3.86.159.217
# SA_USER=SA SA_PASSWORD=<set-at-first-boot> SAC_USER=sac SAC_PASSWORD=<set-at-first-boot> SAC_DATABASE=sac
#
# Connect: sqlcmd -S 3.86.159.217 -U SA -P 'Az6b3036366161212d18!fec2e071' -C

Keep this file secure, because it contains the SA password for the SQL Server instance. The SecureAnyCloud login is a member of the db_owner role on the SecureAnyCloud database and is suitable for application connections.

The sqlcmd command-line utility is preinstalled at /opt/mssql-tools18/bin/sqlcmd. Connect to the local SQL Server instance with the SA password from the credentials file.

SA_PASS=$(sudo grep '^SA_PASSWORD=' /root/mssql-credentials.txt | cut -d= -f2-) /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -P "${SA_PASS}" -C

The -C flag trusts the server certificate, because the image uses a self-signed certificate. At the 1> prompt, you can run T-SQL statements. Type GO to execute a batch and exit to quit.

Verify the SQL Server version and confirm the Enterprise edition.

SA_PASS=$(sudo grep '^SA_PASSWORD=' /root/mssql-credentials.txt | cut -d= -f2-) /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -P "${SA_PASS}" -C -Q "SELECT @@VERSION"

The output looks like this.

Microsoft SQL Server 2025 (RTM-CU5-GDR) (KB5095565) - 17.0.4050.1 (X64) May 15 2026 12:06:45 Copyright (C) 2025 Microsoft Corporation Enterprise Edition (64-bit) on Linux (Ubuntu 24.04.4 LTS) <X64>

SQL Server runs as a systemd service. Check its status.

sudo systemctl status mssql-server --no-pager

The expected output looks like this.

mssql-server.service - Microsoft SQL Server Database Engine Loaded: loaded (/usr/lib/systemd/system/mssql-server.service; enabled; preset: enabled) Active: active (running) since Wed 2026-06-04 09:00:35 UTC; 16s ago Docs: https://docs.microsoft.com/en-us/sql/linux Main PID: 6640 (sqlservr) Tasks: 87 Memory: 503.9M (peak: 503.9M) CPU: 8.057s

Manage the service with standard systemctl commands.

sudo systemctl stop mssql-server
sudo systemctl start mssql-server
sudo systemctl restart mssql-server

Connect to SQL Server and create a database with the following commands.

SA_PASS=$(sudo grep '^SA_PASSWORD=' /root/mssql-credentials.txt | cut -d= -f2-) /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -P "${SA_PASS}" -C -Q "IF DB_ID('myapp') IS NULL CREATE DATABASE [myapp];" /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -P "${SA_PASS}" -C -d myapp -Q "IF OBJECT_ID('customers') IS NULL CREATE TABLE customers (id INT IDENTITY PRIMARY KEY, name NVARCHAR(100), email NVARCHAR(200), created_at DATETIME2 DEFAULT GETDATE()); INSERT INTO customers (name, email) VALUES ('Alice Smith', 'alice@example.com'); INSERT INTO customers (name, email) VALUES ('Bob Jones', 'bob@example.com'); SELECT id, name, email, created_at FROM customers;"

The sample output looks like this.

id name email created_at -- ----------- ------------------ -------------------------- 1 Alice Smith alice@example.com 2026-06-04 09:05:00.0000000 2 Bob Jones bob@example.com 2026-06-04 09:05:00.1000000 (2 rows affected)

SQL Server listens on port 1433. To connect from a remote machine, add port 1433 to the inbound rules of the instance security group. Then connect with any SQL Server-compatible client, such as SQL Server Management Studio, Azure Data Studio, DBeaver or sqlcmd on another machine.

/opt/mssql-tools18/bin/sqlcmd -S <your-instance-ip>,1433 -U SA -P "<SA_PASSWORD>" -C

For production deployments, enable SSL/TLS with a trusted certificate. See the Microsoft documentation on SQL Server on Linux encryption.

The mssql-conf utility manages SQL Server configuration. View the current settings.

sudo /opt/mssql/bin/mssql-conf list

Set the maximum server memory. Replace 8192 with your desired limit in MB.

sudo /opt/mssql/bin/mssql-conf set memory.memorylimitmb 8192
sudo systemctl restart mssql-server

The first-boot service removes the build-time memory cap automatically, so SQL Server starts with no explicit memory limit on your instance, within the edition's own buffer-pool ceiling. Set an explicit limit only if you need to share the host with other workloads.

Create the backup directory and back up the SecureAnyCloud database to a local file.

sudo mkdir -p /var/opt/mssql/backup
sudo chown mssql:mssql /var/opt/mssql/backup
SA_PASS=$(sudo grep '^SA_PASSWORD=' /root/mssql-credentials.txt | cut -d= -f2-) /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -P "${SA_PASS}" -C -Q \
  "BACKUP DATABASE [sac] TO DISK = N'/var/opt/mssql/backup/sac.bak' WITH INIT, COMPRESSION;"

Restore from a backup file.

SA_PASS=$(sudo grep '^SA_PASSWORD=' /root/mssql-credentials.txt | cut -d= -f2-) /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -P "${SA_PASS}" -C -Q \
  "RESTORE DATABASE [sac] FROM DISK = N'/var/opt/mssql/backup/sac.bak' WITH REPLACE;"