ThingsBoard

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is the recommended starting point. ThingsBoard runs a Java virtual machine alongside a local PostgreSQL server, and production workloads benefit from memory headroom.

For NSG inbound rules, allow 22/tcp from your management network. Allow 8080/tcp from the networks that your operators and devices will connect from. ThingsBoard serves plain HTTP on port 8080. For anything beyond a private network, put it behind a TLS-terminating reverse proxy (see "Putting ThingsBoard behind TLS") and expose the proxy instead.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource and search the Marketplace for ThingsBoard by SecureAnyCloud. Select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22). Then choose Review + create and Create.

First-boot initialization takes approximately one to two minutes after the VM starts. During that time, ThingsBoard rotates every seeded account password, rotates the database password, sets the base URL and starts the platform.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:thingsboard-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name thingsboard \
  --image sac1647283583153:thingsboard-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name thingsboard --port 8080 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active postgresql thingsboard java -version ss -tlnp | grep ':8080'

Both services report active, ThingsBoard runs on OpenJDK 21, and the platform is listening on TCP 8080:

active active openjdk version "21.0.11" 2026-04-21 LISTEN 0 100 *:8080 *:*

On the very first boot, allow a minute or two for ThingsBoard to finish starting before the endpoint responds. A Java application with demo data starts slowly the first time.

Step 5 - Retrieve your credentials

On first boot, ThingsBoard rotates its seeded logins to values unique to your VM. The three primary accounts are written to a root-only file:

sudo cat /root/thingsboard-credentials.txt

TB_SYSADMIN_USERNAME=sysadmin@thingsboard.org TB_SYSADMIN_PASSWORD=<generated-per-VM> TB_TENANT_USERNAME=tenant@thingsboard.org TB_TENANT_PASSWORD=<generated-per-VM> TB_CUSTOMER_USERNAME=customer@thingsboard.org TB_CUSTOMER_PASSWORD=<generated-per-VM> THINGSBOARD_URL=http://<vm-address>:8080/

The system administrator (sysadmin@thingsboard.org) manages tenants and system-wide settings. The tenant administrator (tenant@thingsboard.org) manages devices, dashboards, rule chains and customers. The customer (customer@thingsboard.org) sees the dashboards and devices assigned to it.

Step 6 - Secure by default

An IoT platform manages devices and their data, so the image ships with no usable default credential. You can confirm the rotation from the shell. The publicly documented default password sysadmin is rejected, while the per-VM password from the credentials file authenticates and returns a JSON Web Token.

SYS=$(sudo grep '^TB_SYSADMIN_PASSWORD=' /root/thingsboard-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'default password: HTTP %{http_code}\n' -X POST -H 'Content-Type: application/json' \
  -d '{"username":"sysadmin@thingsboard.org","password":"sysadmin"}' http://127.0.0.1:8080/api/auth/login
curl -s -o /dev/null -w 'per-VM password: HTTP %{http_code}\n' -X POST -H 'Content-Type: application/json' \
  -d "{\"username\":\"sysadmin@thingsboard.org\",\"password\":\"$SYS\"}" http://127.0.0.1:8080/api/auth/login

default password: HTTP 401 per-VM password: HTTP 200

The 401 for the built-in default and 200 for the per-VM password prove the first-boot rotation. Every other seeded account is rotated in the same way, including the tenant, the customer and the demo customer users. The local PostgreSQL password is rotated in lockstep.

Step 7 - Sign in to the web UI

Open http://<vm-public-ip>:8080/ in a browser. Sign in with the system administrator login from your credentials file to manage the platform. Use the tenant administrator login to work with devices, dashboards and rule chains.

After you sign in as the tenant administrator, you land on the Home page. It summarizes your devices and alarms, offers a getting-started checklist, and links to solution templates and the device library.

Step 8 - Manage devices

Open Entities > Devices to see the devices provisioned on the platform. The image ships with a set of demo devices, so you can explore dashboards and rules immediately. They include thermostats, a Raspberry Pi and a DHT11 sensor, plus test devices assigned to demo customers.

Choose Add device to provision your own. Then connect it over MQTT, HTTP or CoAP with its access token.

Step 9 - The visual rule engine

ThingsBoard processes every incoming message through a rule chain. A rule chain is a visual flow of nodes that filter, transform, enrich, store and act on telemetry.

Open Rule chains to see the Root Rule Chain that all device messages enter, plus the demo Thermostat chain. Open a chain to edit its nodes on the drag-and-drop canvas, wire in alarm rules or branch messages to external systems.

Step 10 - The REST API

The ThingsBoard REST API drives everything the UI does. Authenticate with a POST to /api/auth/login to obtain a JWT, then pass it as an X-Authorization: Bearer header. This example reads the demo device inventory for the tenant:

TEN=$(sudo grep '^TB_TENANT_PASSWORD=' /root/thingsboard-credentials.txt | cut -d= -f2-)
T=$(curl -s -X POST -H 'Content-Type: application/json' \
  -d "{\"username\":\"tenant@thingsboard.org\",\"password\":\"$TEN\"}" \
  http://127.0.0.1:8080/api/auth/login | jq -r .token)
curl -s -H "X-Authorization: Bearer $T" \
  'http://127.0.0.1:8080/api/tenant/devices?pageSize=100&page=0' | jq '.totalElements'

The login returns a token and a refreshToken. The authenticated call reports the number of devices in the tenant:

9

The full REST API is served under http://<vm-address>:8080/api/. It covers devices, assets, dashboards, telemetry, rule chains, alarms and administration. The interactive Swagger documentation is available at http://<vm-address>:8080/swagger-ui/.

Putting ThingsBoard behind TLS

The image serves the UI and REST API over plain HTTP on port 8080, which is appropriate for a private network. For anything exposed more widely, terminate TLS in front of ThingsBoard with your own reverse proxy (nginx, Caddy or Azure Application Gateway) that forwards to http://127.0.0.1:8080/. Expose 443 instead of 8080.

Set the same public address as the platform base URL under Settings > General, so that generated links and notifications use it. You can likewise front or firewall the MQTT (1883) and CoAP (5683) device transports to suit your deployment.

Server components

Component Version Purpose

ThingsBoard CE 4.3 IoT platform: device management, telemetry, dashboards, rule engine

PostgreSQL 16 Backing store for entities and time series data

OpenJDK 21 Java runtime for the ThingsBoard service

Ubuntu 24.04 LTS Base operating system

Filesystem layout

Mount Size Purpose

/ 29 GB Root filesystem (ThingsBoard, PostgreSQL data, OS)

/boot 881 MB Operating system kernel files

/boot/efi 105 MB UEFI boot partition (Gen2 Hyper-V)

/swapfile 2 GB Swap file sized for the 4 GB memory envelope

/mnt varies Azure temporary resource disk

Key directories:

Path Purpose

/usr/share/thingsboard ThingsBoard installation (binaries, schema, install scripts)

/etc/thingsboard/conf ThingsBoard configuration (thingsboard.conf, thingsboard.yml)

/var/log/thingsboard ThingsBoard log files

/root/thingsboard-credentials.txt Per-VM logins written at first boot (mode 0600)

Managing the service

sudo systemctl status thingsboard
sudo systemctl restart thingsboard
sudo journalctl -u thingsboard -f

ThingsBoard configuration lives in /etc/thingsboard/conf/thingsboard.conf (environment overrides, including the JVM heap and the SQL datasource) and /etc/thingsboard/conf/thingsboard.yml. Restart the service after any change.

Backup and maintenance

ThingsBoard keeps all of its data in its PostgreSQL backing database. This includes devices, dashboards, rule chains, telemetry and time series. Back it up regularly:

sudo -u postgres pg_dump thingsboard > /tmp/thingsboard-db-$(date +%F).sql

Ship the dump to Azure Blob Storage or another object store. Alternatively, snapshot the OS disk in Azure for a coordinated point-in-time backup.

Keep the OS patched with sudo apt update && sudo apt upgrade. To upgrade ThingsBoard itself, follow the vendor upgrade notes for your target version, and always take a database backup first.

Troubleshooting

• The UI does not load yet. On first boot, ThingsBoard takes a minute or two to start. Check progress with sudo journalctl -u thingsboard -f. Confirm the port with ss -tlnp | grep ':8080'.
• A login is rejected. The seeded passwords are rotated per VM. Use the values from sudo cat /root/thingsboard-credentials.txt, not the documented defaults. If you changed a password in the UI, use the new one.
• The service will not start. Confirm that PostgreSQL is up (systemctl is-active postgresql) and inspect sudo journalctl -u thingsboard --no-pager | tail -50. On a memory-constrained VM, make sure the swap file is active with swapon --show.

Security notes

• Restrict the NSG so that 8080/tcp is reachable only from the networks that need it, and 22/tcp only from your management network.
• Put ThingsBoard behind a TLS-terminating reverse proxy before you expose it to the internet. Set the platform base URL to the public HTTPS address.
• Sign in and review the seeded accounts under Customers and Users. Delete or repurpose the demo entities you do not need. Their passwords are already rotated to random values on this image.
• Keep the OS and ThingsBoard patched, and back up the PostgreSQL database regularly.

Support

SecureAnyCloud backs this image with 24/7 support. Contact us by email and chat for help with deployment, device connectivity (MQTT, HTTP, CoAP), dashboard and rule chain design, reverse proxy and TLS termination, and PostgreSQL administration. Email sales@secureanycloud.com.

For general ThingsBoard questions, consult the documentation at https://thingsboard.io/docs/ and https://github.com/thingsboard/thingsboard. ThingsBoard is an open-source project, and ThingsBoard is a trademark of ThingsBoard, Inc. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch ThingsBoard on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com