Skip to content

Microsoft Azure

Deploy the Sophos Remote Testing Appliance (RTA) as a virtual machine in your own Microsoft Azure subscription. We publish the appliance as a managed VHD and share it with you through a time-limited, read-only SAS URL; you copy it into your subscription and build a VM from it.

How delivery works on Azure

You receive one thing from your engagement lead, in the "Your RTA image is ready" email:

Item What it is
VHD read SAS URL A read-only blob SAS for rta-generic-latest.vhd. It is the input to every method below (azcopy, the CLI, PowerShell, and the portal flow). Time-limited (7 days); request a fresh one if it has expired. It is the disk image itself, tens of gigabytes, so do not open it in a browser.

The published image is a fixed-size, MB-aligned, Gen2 / UEFI Linux VHD. It is a generic image with no engagement identity baked in: cloud-init provisions the admin user, SSH key, hostname, and networking on first boot, so you do not supply any seed/cidata disk.

First boot: activation

Because the VHD is generic, the appliance comes up in activation mode: its console (the Azure boot diagnostics screenshot) shows an Appliance Registration screen with a one-time activation code. Give the code to your Sophos engagement lead to activate the appliance. Once activated, it provisions itself, brings up the outbound VPN tunnel, and the console switches to the live status dashboard. (Azure downscales the console screenshot, so the text can look blurry, but that's cosmetic.)

Gen2 only, one disk only

  • Gen2 / UEFI: the disk and the VM must both be Gen2. The legacy Add-AzVhd path creates a Gen1 disk that boots to a black screen. Use the upload-to-managed-disk flow in the guides below.
  • One OS disk only: do not attach a cidata/seed disk. The generic image configures its OS (user, SSH key, hostname, networking) on first boot via the Azure datasource, then shows the activation screen.

What you'll need

Requirements

Resource Minimum Recommended
VM size Gen2-capable, 2 vCPU / 4 GB Standard_D2s_v5 (2 vCPU / 8 GB), or Standard_D4s_v5 for more headroom
Boot disk 40 GB 40 GB
Networking Outbound internet; no public IP / no inbound rules Existing VNet/subnet with VPN reach to targets

Not supported: Arm64, Generation 1-only, and confidential sizes

  • Arm64 sizes (a p after the vCPU count, for example Standard_D2ps_v5, and the Grace GB200/GB300 sizes) cannot run the appliance: its image is x86_64.
  • Generation 1-only sizes (for example Standard_D2_v3, Standard_A2_v2, Standard_NP10s) cannot boot it: the image is Gen2 / UEFI.
  • Confidential sizes only run confidential VMs, which these guides do not create: AMD SEV-SNP DCas/DCads/ECas/ECads v5 and v6 (for example Standard_DC2as_v5), Intel TDX DCes/DCeds/ECes/ECeds v6 (for example Standard_DC2es_v6), and the NCC sizes (for example Standard_NCC40ads_H100_v5).

The deploy scripts refuse these sizes before creating anything.

v6 and newer sizes use NVMe disks

v6 and newer sizes (for example Standard_D2s_v6, Standard_D2s_v7), and the older Lsv4/Lasv4/Laosv4/Laosv5/Liaosv5, FXmsv2/FXmdsv2, Mbsv3/Mbdsv3, and Eibsv5/Eibdsv5 families, have NVMe disks only. Azure cannot create such a VM straight from the image these guides build, so the deploy scripts create it as Standard_D2s_v5, let it boot once, then stop it and move it to your size; it takes a couple of minutes longer, and your subscription needs quota for Standard_D2s_v5 in that region too. In the portal, pick a v5 or older size outside those NVMe-only families.

One script does the whole deployment. Pick the tab for the computer you are deploying from. You also need azcopy installed.

Uses the Azure CLI. Log in with az login, then run:

curl -fsSL https://rtadocs.srt.sophos.com/platforms/azure/deploy-rta-azure.sh | bash

Flags for automation, and the step-by-step equivalent, are on the CLI (az) page.

Uses the Azure PowerShell Az module. One-time setup, then log in:

Set-ExecutionPolicy -Scope CurrentUser RemoteSigned   # Windows blocks modules by default
Install-Module Az -Scope CurrentUser
Connect-AzAccount

Then paste this into PowerShell:

& ([scriptblock]::Create((irm https://rtadocs.srt.sophos.com/platforms/azure/deploy-rta-azure.ps1)))

Parameters for automation, and the step-by-step equivalent, are on the CLI (Azure PowerShell) page.

Either script validates your SAS first, lets you pick your subscription, resource group, and subnet, detects your SSH key, then creates the Gen2 disk, image, and VM with no public IP. It then waits a few minutes for the appliance to report its activation code in the serial log and prints it; if the code does not show up there in time, it prints where to read it on the console instead.

If your organization's Azure Policy requires tags on new resources, the script asks for them, or you can pass them up front. See Required tags for the bash or PowerShell script.

Choose a deployment method

  • GUI (Azure Portal)

    Point-and-click: copy the VHD server-side with one azcopy line, then create the disk, image, and VM in the portal.

  • CLI (az)

    az end-to-end. The fastest path: a server-side copy straight into a managed disk, no storage account of your own required.

  • CLI (Azure PowerShell)

    The same flow using the Az module, for Windows-centric workflows.

  • AI assistant (LLM)

    A copy-paste prompt that has your AI assistant drive the az CLI deployment, pausing for your confirmation at each step.