Getting Started

Getting Started with SonarQube on Azure

2026-07-30 · sonarqube docs · azure

The CloudSOE SonarQube image gives you a complete SonarQube stack — SonarQube Community Build with a local PostgreSQL database — on a hardened Ubuntu base, with the kernel and ulimit tuning SonarQube’s embedded Elasticsearch requires already applied. The image contains no baked-in passwords: on first boot your VM generates a unique password for both the SonarQube admin account and the database, and writes it to a root-protected file.

What you’ll need

  • An Azure subscription
  • An SSH public key (password login is disabled in the image)
  • About ten minutes

Step 1 — Create the VM

  1. Find the CloudSOE SonarQube offer in the Azure Marketplace and click Create.
  2. Choose a resource group, region and VM name.
  3. Pick a size with at least 4 GB RAM — for example Standard_B2s for evaluation or Standard_D2as_v4 for steady use. SonarQube runs a web server, compute engine, Elasticsearch and PostgreSQL on one box.
  4. Under Administrator account, select SSH public key, pick a username (e.g. azureuser) and paste your key.
  5. Create or attach a public IP. For production, make it Static so your CI configuration doesn’t break across stop/start.

Step 2 — Open the firewall ports

In the VM’s network security group, allow inbound:

PortProtocolPurpose
22TCPSSH administration
9000TCPSonarQube web interface

Restrict both to your own IP range (or your CI runners’ range) where possible.

Step 3 — Let first boot finish

On the very first boot the sonarqube-firstboot service:

  • generates a unique password meeting SonarQube’s password policy,
  • sets it on the PostgreSQL sonar database role and in SonarQube’s database configuration,
  • waits for SonarQube to come up, then replaces the default admin/admin login with the generated password,
  • saves everything to a root-protected credentials file.

SonarQube itself takes a couple of minutes to start (Elasticsearch indexing). You can watch:

ssh <admin-user>@<public-ip>
systemctl status sonarqube-firstboot sonar

Step 4 — Retrieve your credentials

SSH in with the admin username you chose at deployment. The login banner (MOTD) shows the URL and points at the credentials file:

cat /opt/default-sonar-login.txt

This file (mode 600) holds the generated password for the SonarQube admin account and the PostgreSQL sonar user.

Step 5 — Log in and run your first analysis

From your own machine (an Azure VM often cannot reach its own public IP from inside), browse to http://<public-ip>:9000 and sign in as admin with the generated password. Create a project (Projects → Create Project → Local project), generate a token, and point a scanner at your server from your build machine:

sonar-scanner \
  -Dsonar.host.url=http://<public-ip>:9000 \
  -Dsonar.token=<your-token>

Next steps