Quickstart: Create SQL Server on a Windows virtual machine in the Azure portal

To deploy a conventional SQL Server on Azure VM, on the Basics tab, provide the following information:

1. In the Project Details section, select your Azure subscription, and then select Create new to create a new resource group. Type SQLVM-RG for the name.

   

2. Under Instance details:

   1. Type SQLVM for the Virtual machine name.
   2. Choose a ___location for your Region.
   3. For the purpose of this quickstart, leave Availability options set to No infrastructure redundancy required. To find out more information about availability options, see Availability.
   4. In the Image list, select the image with the version of SQL Server and operating system you want. For example, you can use an image with a label that begins with Free SQL Server License.
   5. Choose to See all sizes for the Size of the virtual machine, and select the A2 Basic offering. Be sure to clean up your resources once you're done with them to prevent any unexpected charges.

   

3. Under Administrator account, provide a username such as azureuser and a password. The password must be at least 12 characters long and meet the defined complexity requirements.

   

4. Under Inbound port rules, choose Allow selected ports, and then select RDP (3389) from the dropdown.

   

To deploy your SQL Server to an Azure confidential VM, on the Basics tab, provide the following information:

1. In the Project Details section, select your Azure subscription, and then select Create new to create a new resource group. Type SQLVM-RG for the name.

   

2. Under Instance details:

   1. Type SQLVM for the Virtual machine name.
   2. Choose a ___location for your Region. To validate region supportability, look for the ECadsv5-series or DCadsv5-series in VM products Available by Azure region.
   3. For Security type, choose Confidential virtual machines from the dropdown. If this option is grayed out, it's likely the chosen region doesn't currently support confidential VMs. Choose a different region from the drop-down.
   4. For the purpose of this quickstart, leave Availability options set to No infrastructure redundancy required. To find out more information about availability options, see Availability.
   5. In the Image list, choose the SQL Server 2022 Enterprise on Windows Server 2022 Database Engine Only image. To change the SQL Server image, select See all images, and then filter by Security type = Confidential VMs to identify all SQL Server images that support confidential VMs.
   6. Leave the size at the default of Standard_EC2ads_v5. However, to see all available sizes, select See all sizes to identify all the VM sizes that support confidential VMs, as well as the sizes that don't.

   

3. Under Administrator account, provide a username such as azureuser and a password. The password must be at least 12 characters long and meet the defined complexity requirements.

   

4. Under Inbound port rules, choose Allow selected ports, and then select RDP (3389) from the dropdown.

   

Disks

Configure confidential OS disk encryption. This is optional for test VMs but recommended for production environments. For greater details, review the Quickstart: Deploy a confidential VM.

1. On the tab Disks, configure the following settings:

   1. Under Disk options, enable Confidential compute encryption if you want to encrypt your VM's OS disk during creation.
   2. For Confidential compute encryption type, select the type of encryption to use.
   3. If Confidential disk encryption with a customer-managed key is selected, create a Confidential disk encryption set before creating your confidential VM.

2. (Optional) If necessary, create a Confidential disk encryption set as follows.

   1. Create an Azure Key Vault. For the pricing tier, select Premium (includes support for HSM backed keys), or create an Azure Key Vault managed Hardware Security Module (HSM).

   2. In the Azure portal, search for and select Disk Encryption Sets.

   3. Select Create.

   4. For Subscription, select which Azure subscription to use.

   5. For Resource group, select or create a new resource group to use.

   6. For Disk encryption set name, enter a name for the set.

   7. For Region, select an available Azure region.

   8. For Encryption type, select Confidential disk encryption with a customer-managed key.

   9. For Key Vault, select the key vault you already created.

   10. Under Key Vault, select Create new to create a new key.

       Note

       If you selected an Azure managed HSM previously, use PowerShell or the Azure CLI to create the new key instead.

   11. For Name, enter a name for the key.

   12. For the key type, select RSA-HSM.

   13. Select your key size.

   14. Select Create to finish creating the key.

   15. Select Review + create to create a new disk encryption set. Wait for the resource creation to complete successfully.

   16. Go to the disk encryption set resource in the Azure portal.

   17. Select the pink banner to grant permissions to Azure Key Vault.

       Important

       You must perform this step to successfully create the confidential VM.