Microsoft Azure: CLI (Azure PowerShell)¶

Deploy the RTA with the Azure PowerShell Az module. This mirrors the Azure CLI flow (a server-side azcopy into a managed disk, then a generalized Gen2 image and a VM) for Windows-centric workflows.

Before you start

Review the Microsoft Azure overview. You'll need the VHD read SAS URL from your engagement lead, the Az module, azcopy, and your SSH public key.

Quick deploy¶

The recommended one-line script validates your SAS, reads the exact VHD size, auto-detects your subscription and region from the subnet, then creates the Gen2 disk, image, and VM (no public IP). Download then run so the parameters pass cleanly:

irm https://rtadocs.srt.sophos.com/platforms/azure/deploy-rta-azure.ps1 -OutFile deploy-rta-azure.ps1
./deploy-rta-azure.ps1 `
  -Sas '<SAS_URL>' `
  -ResourceGroup rg-rta `
  -Subnet '<FULL_SUBNET_RESOURCE_ID>' `
  -SshKey ~/.ssh/your_key.pub

Override the VM size with -Size Standard_D4s_v3 (default Standard_D2s_v3). Get your full subnet resource ID with:

(Get-AzVirtualNetworkSubnetConfig -Name <subnet> `
   -VirtualNetwork (Get-AzVirtualNetwork -Name <vnet> -ResourceGroupName <rg>)).Id

Prefer to run it by hand? Use the step-by-step path below.

Option 2: step by step (deploy directly to a managed disk)¶

The Quick deploy script above is Option 1; use Option 2 only to run each step by hand. The script does all of it for you.

$RG  = "rg-rta"; $LOC = "eastus"
$SubnetId = "<FULL_SUBNET_RESOURCE_ID>"        # full subnet resource ID (see Quick deploy)
$SAS = "<SAS_URL>"

New-AzResourceGroup -Name $RG -Location $LOC

# 1. Empty Gen2 upload disk (exact byte size)
$diskConfig = New-AzDiskConfig -Location $LOC -OsType Linux -HyperVGeneration V2 `
  -CreateOption Upload -UploadSizeInBytes 42949673472 -SkuName Standard_LRS
New-AzDisk -ResourceGroupName $RG -DiskName rta-disk -Disk $diskConfig

# 2-4. Write SAS, server-side copy, revoke
$grant = Grant-AzDiskAccess -ResourceGroupName $RG -DiskName rta-disk `
  -Access Write -DurationInSecond 86400
azcopy copy "$SAS" "$($grant.AccessSAS)" --blob-type PageBlob
Revoke-AzDiskAccess -ResourceGroupName $RG -DiskName rta-disk

# 5. Generalized Gen2 image from the disk
$disk = Get-AzDisk -ResourceGroupName $RG -DiskName rta-disk
$img  = New-AzImageConfig -Location $LOC -HyperVGeneration V2
Set-AzImageOsDisk -Image $img -OsType Linux -OsState Generalized -ManagedDiskId $disk.Id
New-AzImage -ResourceGroupName $RG -ImageName rta-image -Image $img

# 6. VM with SSH public key (no password auth). The admin username is your
#    choice (Azure requires one); it's only for break-glass SSH.
$cred = New-Object System.Management.Automation.PSCredential( `
  "azureuser", (ConvertTo-SecureString "PlaceholderNotUsed!1" -AsPlainText -Force))
$vm = New-AzVMConfig -VMName Sophos-RTA -VMSize Standard_D2s_v3
$vm = Set-AzVMOperatingSystem -VM $vm -Linux -ComputerName Sophos-RTA `
  -Credential $cred -DisablePasswordAuthentication
$vm = Set-AzVMSourceImage -VM $vm -Id (Get-AzImage -ResourceGroupName $RG -ImageName rta-image).Id
$vm = Add-AzVMSshPublicKey -VM $vm `
  -KeyData (Get-Content ~/.ssh/your_key.pub -Raw) `
  -Path "/home/azureuser/.ssh/authorized_keys"

# Attach to your existing subnet (full ID, works cross-RG), no public IP, no inbound rule
$nic = New-AzNetworkInterface -ResourceGroupName $RG -Name "Sophos-RTA-nic" `
  -Location $LOC -SubnetId $SubnetId
$vm = Add-AzVMNetworkInterface -VM $vm -Id $nic.Id
New-AzVM -ResourceGroupName $RG -Location $LOC -VM $vm

Gen2 / UEFI throughout, Secure Boot off, never Add-AzVhd

The disk (-HyperVGeneration V2) and the image (New-AzImageConfig -HyperVGeneration V2) must both be Gen2 / UEFI. Add-AzVhd creates a Gen1 disk that boots to a black screen. Do not enable Trusted Launch / Secure Boot. Leave the security type default. The password in the credential object is a placeholder; password auth is disabled and only the SSH key is used.

Verify¶

(Get-AzVM -ResourceGroupName $RG -Name Sophos-RTA -Status).Statuses
# SSH from inside your network to the VM's private IP

Send us the activation code¶

The VHD is generic, so on first boot the appliance comes up in activation mode. Read the code from the boot-diagnostics screenshot.

The console shows the Appliance Registration screen: a one-time activation code (for example 4 5 D C V Y) under the prompt "Provide this code to your Sophos staging team." You do not log in to the appliance to read it.

Send that activation code to your Sophos engagement lead so they can activate the appliance on the Sophos side. Once activated, the console switches from the registration screen to the appliance's live status dashboard, and no further action is needed on your end.

Registration needs outbound 443 to get.remotetesting.secureworks.com

Registration and activation use outbound TCP/443 (HTTPS) to get.remotetesting.secureworks.com, in addition to the OpenVPN tunnel to connect.remotetesting.secureworks.com covered under Network access below. Its IP addresses are not guaranteed to stay constant, so allowlist get.* by FQDN (not by IP). If that egress is blocked, the console shows a registration error ("ensure outbound HTTPS to get.remotetesting.secureworks.com") instead of an activation code.

See the overview troubleshooting for the benign cloud-init warning.

Network access¶

The appliance makes one connection to do its job: an outbound tunnel to the Sophos headend. Nothing inbound is ever required: you never open or forward any ports to the appliance.

Allow this outbound destination


Destination	`connect.remotetesting.secureworks.com`
IP addresses	`3.33.194.251` and `15.197.255.2` (static; these do not change)
Port / protocol	TCP 443, carrying OpenVPN (not HTTPS)
Direction	Outbound only

Allow egress on TCP/443 to that destination from the appliance's network. On a next-generation firewall or NAC-controlled network, an L3 "allow 443" rule is often not enough: Layer-7 application control, TLS/SSL decryption, or NAC can still drop the tunnel even when the port is open. See Connectivity troubleshooting for the exact firewall and NAC exceptions to request.

Troubleshooting¶

Deployed but something isn't right?

See this platform's troubleshooting guide for the most common issues here and how to fix them.