SQL Server 2025 Express

In the Azure Portal, open Marketplace, search for SQL Server 2025 Express, and select the SecureAnyCloud publisher entry. Select Create to begin the wizard.

On the Basics tab, choose your subscription, target resource group, and region. Set the virtual machine name. Choose SSH public key as the authentication type, set the username to a name of your choice (the examples below use azureuser), and paste your SSH public key. Standard_D2s_v5 is the recommended starting size.

On the Disks tab, set the OS disk type to Standard SSD or Premium SSD. SQL Server data lives at /var/opt/mssql/data on the root disk by default. For production workloads, attach a separate Premium SSD data disk and bind mount it over /var/opt/mssql/data before you start the service.

On the Networking tab, select your existing virtual network and subnet. Attach a network security group that allows inbound TCP 22 from your management IP range, and inbound TCP 1433 only from application server subnets or the virtual network CIDR.

Do not expose port 1433 to the public internet. The SA password is written in plain text on the virtual machine by design, so you can read it without a second trip. An internet-exposed SQL Server port would make brute-force attacks trivial.

On the Management, Monitoring, and Advanced tabs, the defaults are appropriate. Select Review + create, wait for validation to pass, then select Create. Deployment takes around two minutes.

To use the command line instead, accept the Marketplace terms once, then deploy from the Marketplace image URN:

RG="mssql-prod" LOCATION="eastus" VM_NAME="mssql-01" ADMIN_USER="azureuser" IMAGE_URN="sac1647283583153:mssql-2025-express-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create \
  --resource-group "$RG" \
  --name mssql-vnet \
  --address-prefix 10.80.0.0/16 \
  --subnet-name mssql-subnet \
  --subnet-prefix 10.80.1.0/24 az network nsg create --resource-group "$RG" --name mssql-nsg az network nsg rule create \
  --resource-group "$RG" --nsg-name mssql-nsg \
  --name allow-ssh-mgmt --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" \
  --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create \
  --resource-group "$RG" --nsg-name mssql-nsg \
  --name allow-sql-vnet --priority 110 \
  --source-address-prefixes VirtualNetwork \
  --destination-port-ranges 1433 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:mssql-2025-express-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" \
  --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_D2s_v5 \
  --admin-username "$ADMIN_USER" \
  --ssh-key-values "$SSH_KEY" \
  --nsg mssql-nsg \
  --vnet-name mssql-vnet \
  --subnet mssql-subnet \
  --storage-sku Premium_LRS \
  --location "$LOCATION"

When the virtual machine is running, connect over SSH. Use the private IP address from inside the virtual network, or the public IP if you have configured a bastion or direct management access. The default admin user is azureuser.

ssh azureuser@<vm-ip>

The mssql-firstboot.service runs automatically on first boot and completes within about 90 seconds. By the time your SSH session is open, first boot is typically already done. Confirm the service status:

sudo systemctl status mssql-server.service --no-pager

You should see active (running). Confirm that the first-boot sentinel exists:

sudo test -f /var/opt/mssql/.firstboot-done && echo FIRSTBOOT_DONE

Confirm that the TCP listener is bound on port 1433:

sudo ss -tln | grep 1433

First boot generated the SA and SecureAnyCloud passwords randomly on this specific virtual machine and wrote them to a file that only root can read. Read them with:

sudo cat /stage/scripts/mssql-credentials.log

The output contains lines similar to:

SA_USER=sa SA_PASSWORD=<SA_PASSWORD> SAC_USER=sac SAC_PASSWORD=<SAC_PASSWORD> SAC_DATABASE=sac

Store the values in your secret store. You can shred the credentials file once you have saved the passwords. Keeping it root-protected at mode 0600 is a reasonable default for the life of the virtual machine.

The mssql-tools18 package installs sqlcmd at /opt/mssql-tools18/bin/sqlcmd. Verify that the binary is on PATH:

sudo ls -l /opt/mssql-tools18/bin/sqlcmd

Connect to the server as SA, reading the password directly from the credentials file:

SA_PASS=$(sudo awk -F= '/^SA_PASSWORD=/{print $2}' /stage/scripts/mssql-credentials.log) /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "$SA_PASS" -C -Q "SELECT @@VERSION;"

The server reports Microsoft SQL Server 2025.

Query the running edition:

SA_PASS=$(sudo awk -F= '/^SA_PASSWORD=/{print $2}' /stage/scripts/mssql-credentials.log) /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "$SA_PASS" -C -Q "SELECT SERVERPROPERTY('Edition') AS Edition;" -h -1 -W

You should see Express Edition (64-bit).

The image ships Standard binaries in evaluation mode. Apply your product key to activate the license. Replace YOUR_STANDARD_LICENSE_KEY with the key from your Microsoft Volume Licensing agreement:

sudo /opt/mssql/bin/mssql-conf setpid YOUR_STANDARD_LICENSE_KEY
sudo systemctl restart mssql-server.service

After the restart, verify that the license is active:

SA_PASS=$(sudo awk -F= '/^SA_PASSWORD=/{print $2}' /stage/scripts/mssql-credentials.log) /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "$SA_PASS" -C -Q "SELECT SERVERPROPERTY('LicenseType') AS LicenseType;" -h -1 -W

The value PER_CORE confirms a perpetual Standard license. The value EVAL means the 180-day evaluation period is still active.

The SecureAnyCloud database and SecureAnyCloud login are ready to use from first boot. Run a round-trip query as the SecureAnyCloud user:

CL_PASS=$(sudo awk -F= '/^SAC_PASSWORD=/{print $2}' /stage/scripts/mssql-credentials.log) /opt/mssql-tools18/bin/sqlcmd -S localhost -U sac -P "$CL_PASS" -C -d sac -h -1 -W -Q "CREATE TABLE ##probe (id INT, val NVARCHAR(64)); INSERT INTO ##probe VALUES (1, N'sac-ok'); SELECT val FROM ##probe WHERE id=1; DROP TABLE IF EXISTS ##probe;"

The output includes sac-ok, which confirms that the SecureAnyCloud user has the expected permissions on the SecureAnyCloud database.

From any host inside the same virtual network that has sqlcmd or SQL Server Management Studio installed, connect on port 1433 with the SA or SecureAnyCloud credentials. A typical sqlcmd invocation from a remote client looks like this:

sqlcmd -S <private-ip>,1433 -U sa -P '<SA_PASSWORD>' -C -d sac

SQL Server Management Studio and Azure Data Studio connect the same way, using the virtual machine's private IP and the SA or SecureAnyCloud credentials.

To connect from a management workstation outside the virtual network, use Azure Bastion or an SSH tunnel. Do not open port 1433 to the public internet.

These are the paths of the main server components:

• SQL Server daemon: /opt/mssql/bin/sqlservr
• sqlcmd client: /opt/mssql-tools18/bin/sqlcmd
• bcp bulk copy utility: /opt/mssql-tools18/bin/bcp
• mssql-conf configuration tool: /opt/mssql/bin/mssql-conf
• SQL Server data directory: /var/opt/mssql/data/
• SQL Server log directory: /var/opt/mssql/log/
• Systemd unit: /lib/systemd/system/mssql-server.service
• First-boot systemd unit: /etc/systemd/system/mssql-firstboot.service
• First-boot script: /usr/local/sbin/mssql-firstboot.sh
• Credentials file: /stage/scripts/mssql-credentials.log
• First-boot sentinel: /var/opt/mssql/.firstboot-done

Inspect the running mssql-server package version:

dpkg -l mssql-server mssql-tools18 | awk '/^ii/{print $2, $3}'

The image uses this filesystem layout:

• / (32 GB): root filesystem, which includes /var/opt/mssql
• /boot (1 GB): operating system kernel files
• /var/opt/mssql/data (on root): SQL Server data directory
• /var/opt/mssql/log (on root): SQL Server transaction logs and error logs

For production workloads, attach a separate Premium SSD data disk, format it with xfs, and bind mount it over /var/opt/mssql/data before you start the service. Place the transaction log directory on a separate disk for IO isolation.

This layout keeps database IO off the OS disk and lets you resize and snapshot the data and log volumes independently.

systemd starts and stops SQL Server through the mssql-server.service unit.

Check service status:

sudo systemctl status mssql-server.service --no-pager

Stop SQL Server:

sudo systemctl stop mssql-server.service && echo "mssql-server stopped"

Start SQL Server:

sudo systemctl start mssql-server.service && echo "mssql-server started"

Restart SQL Server:

sudo systemctl restart mssql-server.service && echo "mssql-server restarted"

View the SQL Server error log:

sudo tail -n 50 /var/opt/mssql/log/errorlog

Cannot connect to SQL Server on port 1433

• Verify that the service is running: sudo systemctl status mssql-server.service
• Verify that the listener is bound: sudo ss -tln | grep 1433
• Check the error log: sudo tail -n 50 /var/opt/mssql/log/errorlog
• Confirm that the network security group allows TCP 1433 from your client source IP.
• Confirm that the virtual machine NIC is in the expected subnet with the NSG attached.

Authentication errors after connecting

• Read the SA password again: sudo awk -F= '/^SA_PASSWORD=/{print $2}' /stage/scripts/mssql-credentials.log
• Verify that the first-boot sentinel exists: ls -la /var/opt/mssql/.firstboot-done. If it is absent, mssql-firstboot.service did not complete, so check its journal.
• Check the first-boot journal: sudo journalctl -u mssql-firstboot.service --no-pager

First-boot service did not run

• Check the first-boot service status: sudo systemctl status mssql-firstboot.service --no-pager
• Review the journal: sudo journalctl -u mssql-firstboot.service --no-pager -n 100
• Verify that SQL Server started: sudo systemctl status mssql-server.service
• If SQL Server failed to start, check the error log: sudo tail -n 100 /var/opt/mssql/log/errorlog

License evaluation expiry

• Run SELECT SERVERPROPERTY('LicenseType') to see the current state. EVAL means the 180-day evaluation is still active.
• Apply your Standard product key: sudo /opt/mssql/bin/mssql-conf setpid <your-product-key> then sudo systemctl restart mssql-server.service
• After the restart, confirm that the new state is PER_CORE.

Service fails to start

• Check the systemd journal: sudo journalctl -u mssql-server.service --no-pager -n 100
• Check the SQL Server error log: sudo tail -n 100 /var/opt/mssql/log/errorlog
• Check filesystem space: df -h /var/opt/mssql
• Verify data directory ownership: sudo ls -la /var/opt/mssql/data | head. Files should be owned by mssql:mssql.

• Rotate the SA password on a schedule with ALTER LOGIN [sa] WITH PASSWORD=N'<new-password>';
• Create application-specific logins with minimal privileges. Never connect application code as SA.
• Restrict port 1433 to trusted application server subnets only in your NSG.
• Disable the SA login once named logins are in place: ALTER LOGIN [sa] DISABLE;
• Back up regularly with native BACKUP DATABASE statements or SQL Agent jobs.
• Keep SQL Server updated by running sudo apt-get update && sudo apt-get upgrade mssql-server periodically. The official packages.microsoft.com APT repository is already configured on this image.
• Shred the credentials file once the passwords are stored in your secret store: sudo shred -u /stage/scripts/mssql-credentials.log

SQL Server 2025 Express Edition is Microsoft proprietary software. After the 180-day evaluation period, production use requires a valid per-core Standard license. Microsoft Server and SQL Server are registered trademarks of Microsoft Corporation.

SecureAnyCloud provides commercial support for this image, separately from the upstream Microsoft product. Contact us at any time for support questions, architectural advice, capacity planning, or migration help.

E-mail: sales@secureanycloud.com

Website: secureanycloud.com

Support hours: 24/7 with a guaranteed 24-hour response SLA

Deploy on Azure

Launch SQL Server 2025 Express on Ubuntu 24.04 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Launch SQL Server 2025 Express on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for SQL Server 2025.

Select the SecureAnyCloud listing and choose Select. On the subscription summary, pick the SQL Server 2025 Express on Ubuntu 24.04 delivery option and choose Continue.

Pick an instance type that suits your workload (see Prerequisites). Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and either create or select a security group that allows inbound port 22 from your management network. Add port 1433 to the security group if you want external clients to connect to SQL Server directly. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation generates the SA password and starts SQL Server. It takes a minute or two after the instance state becomes Running and the status checks pass.

The following command launches an instance from the SecureAnyCloud SQL Server 2025 Express Marketplace AMI into an existing subnet and security group.

Replace <ami-id> with the AMI ID shown on the Marketplace listing for the Express delivery option. Replace <key-name> with your EC2 key pair name and <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens inbound port 22, and optionally 1433 for external SQL connections.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.xlarge \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --metadata-options HttpTokens=required \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":40,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=mssql-01}]'

On success, the command prints a JSON document. Note the instance ID, then retrieve the instance's public address when it is running:

aws ec2 describe-instances \
  --instance-ids <instance-id> \
  --query "Reservations[].Instances[].PublicIpAddress" \
  --output text

Connect over SSH with the key pair you selected and the public IP address from step 2. This delivery option is built on Ubuntu 24.04, so the SSH login user is ubuntu:

ssh ubuntu@<your-instance-ip>

Wait until the instance has passed both EC2 status checks before you connect. The first-boot service runs before the SSH daemon is ready, so SQL Server is initialised by the time you can log in.

The first-boot service generates a fresh SA password for this instance and writes it, with the connection details, to /root/mssql-credentials.txt. Only the root user can read the file. Display it from your SSH session:

sudo cat /root/mssql-credentials.txt

The file looks like this, with unique passwords on your instance:

# SQL Server 2025 Express Edition -- Per-Instance Credentials
# Generated: Wed Jun 04 09:00:00 UTC 2026
# Instance IP: 3.86.159.217
# SA_USER=SA SA_PASSWORD=<set-at-first-boot> SAC_USER=sac SAC_PASSWORD=<set-at-first-boot> SAC_DATABASE=sac
#
# Connect: sqlcmd -S 3.86.159.217 -U SA -P 'Az6b3036366161212d18!fec2e071' -C

Keep this file secure, because it contains the SA password for the SQL Server instance. The SecureAnyCloud login has db_owner membership on the SecureAnyCloud database, so it suits application connections.

The sqlcmd command-line utility is preinstalled at /opt/mssql-tools18/bin/sqlcmd. Connect to the local SQL Server instance with the SA password from the credentials file:

SA_PASS=$(sudo grep '^SA_PASSWORD=' /root/mssql-credentials.txt | cut -d= -f2-) /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -P "${SA_PASS}" -C

The -C flag trusts the server certificate, because the image uses a self-signed certificate. From the 1> prompt, you can run T-SQL statements. Type GO to execute a batch and exit to quit.

To verify the SQL Server version and confirm the Express edition, run:

SA_PASS=$(sudo grep '^SA_PASSWORD=' /root/mssql-credentials.txt | cut -d= -f2-) /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -P "${SA_PASS}" -C -Q "SELECT @@VERSION"

Output from this instance:

Microsoft SQL Server 2025 (RTM-CU5-GDR) (KB5095565) - 17.0.4050.1 (X64) May 15 2026 12:06:45 Copyright (C) 2025 Microsoft Corporation Express Edition (64-bit) on Linux (Ubuntu 24.04.4 LTS) <X64>

SQL Server runs as a systemd service. Check its status with:

sudo systemctl status mssql-server --no-pager

The expected output looks like this:

mssql-server.service - Microsoft SQL Server Database Engine Loaded: loaded (/usr/lib/systemd/system/mssql-server.service; enabled; preset: enabled) Active: active (running) since Wed 2026-06-04 09:00:35 UTC; 16s ago Docs: https://docs.microsoft.com/en-us/sql/linux Main PID: 6640 (sqlservr) Tasks: 87 Memory: 503.9M (peak: 503.9M) CPU: 8.057s

Manage the service with standard systemctl commands:

sudo systemctl stop mssql-server
sudo systemctl start mssql-server
sudo systemctl restart mssql-server

Connect to SQL Server and create a database with the following commands:

SA_PASS=$(sudo grep '^SA_PASSWORD=' /root/mssql-credentials.txt | cut -d= -f2-) /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -P "${SA_PASS}" -C -Q "IF DB_ID('myapp') IS NULL CREATE DATABASE [myapp];" /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -P "${SA_PASS}" -C -d myapp -Q "IF OBJECT_ID('customers') IS NULL CREATE TABLE customers (id INT IDENTITY PRIMARY KEY, name NVARCHAR(100), email NVARCHAR(200), created_at DATETIME2 DEFAULT GETDATE()); INSERT INTO customers (name, email) VALUES ('Alice Smith', 'alice@example.com'); INSERT INTO customers (name, email) VALUES ('Bob Jones', 'bob@example.com'); SELECT id, name, email, created_at FROM customers;"

Sample output looks like this:

id name email created_at -- ----------- ------------------ -------------------------- 1 Alice Smith alice@example.com 2026-06-04 09:05:00.0000000 2 Bob Jones bob@example.com 2026-06-04 09:05:00.1000000 (2 rows affected)

Express edition: backup compression is not supported. Omit WITH ... COMPRESSION from the BACKUP command and use WITH INIT only. Databases are also capped at 10 GB.

SQL Server listens on port 1433. To connect from a remote machine, add port 1433 to the instance security group inbound rules. Then connect with any SQL Server compatible client, such as SQL Server Management Studio, Azure Data Studio, DBeaver, or sqlcmd on another machine:

/opt/mssql-tools18/bin/sqlcmd -S <your-instance-ip>,1433 -U SA -P "<SA_PASSWORD>" -C

For production deployments, enable SSL/TLS with a trusted certificate. See the Microsoft documentation on SQL Server on Linux encryption.

The mssql-conf utility manages SQL Server configuration. View the current settings:

sudo /opt/mssql/bin/mssql-conf list

Set the maximum server memory (replace 8192 with your desired limit in MB):

sudo /opt/mssql/bin/mssql-conf set memory.memorylimitmb 8192
sudo systemctl restart mssql-server

The first-boot service removes the build-time memory cap automatically, so SQL Server starts with no explicit memory limit on your instance, within the edition's own buffer-pool ceiling. Set an explicit limit only if you need to share the host with other workloads.

Create the backup directory and back up the SecureAnyCloud database to a local file:

sudo mkdir -p /var/opt/mssql/backup
sudo chown mssql:mssql /var/opt/mssql/backup
SA_PASS=$(sudo grep '^SA_PASSWORD=' /root/mssql-credentials.txt | cut -d= -f2-) /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -P "${SA_PASS}" -C -Q \
  "BACKUP DATABASE [sac] TO DISK = N'/var/opt/mssql/backup/sac.bak' WITH INIT;"

Restore from a backup file:

SA_PASS=$(sudo grep '^SA_PASSWORD=' /root/mssql-credentials.txt | cut -d= -f2-) /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U SA -P "${SA_PASS}" -C -Q \
  "RESTORE DATABASE [sac] FROM DISK = N'/var/opt/mssql/backup/sac.bak' WITH REPLACE;"