# How to Run OpenClaw on Azure (Linux VM + Azure CLI Guide)

> Deploy OpenClaw on an Azure Linux VM to run your AI agent on secure Microsoft cloud infrastructure. This guide shows you how to set up and install everything step by step.

**Published:** Mar 27, 2026 | **Author:** Alex Chen | **Read time:** 12 min read

Deploy OpenClaw on Azure Linux VM using Azure CLI. Learn how to set up Azure VM, install OpenClaw, and run your AI agent with this complete setup guide.

---

- OpenClaw on Azure' subtitle="Deploy OpenClaw on an Azure Linux VM to run your AI agent on secure Microsoft cloud infrastructure. This guide shows you how to set up and install everything step by step." readTime="12 min read" publishDate="Mar 27, 2026" author="Alex Chen" /> Running [OpenClaw](/blog/what-is-openclaw) on Azure allows you to host your AI agent on secure Microsoft cloud infrastructure instead of your local machine. This means your OpenClaw agent can run 24/7, scale easily, and stay online even when your computer is turned off. Azure is one of the best platforms for running OpenClaw because it provides: Secure infrastructure

Running [OpenClaw](/blog/what-is-openclaw) on Azure allows you to host your AI agent on secure Microsoft cloud infrastructure instead of your local machine.

This means your OpenClaw agent can run 24/7, scale easily, and stay online even when your computer is turned off.

Azure is one of the best platforms for running OpenClaw because it provides:

In this guide, you will learn how to deploy OpenClaw on Azure Linux VM with secure defaults.

Running [OpenClaw](/blog/what-is-openclaw) on Azure allows you to host your AI agent on secure Microsoft cloud infrastructure instead of your local machine.

This means your OpenClaw agent can run 24/7, scale easily, and stay online even when your computer is turned off.

Azure is one of the best platforms for running OpenClaw because it provides:

- Always-on runtime
- Scalable resources
- Enterprise-ready deployment
- Remote access from anywhere

In this guide, you will learn how to deploy OpenClaw on Azure Linux VM with secure defaults.


## OpenClaw on Azure Requirements




| Component | Requirement | Recommended |
| --- | --- | --- |
| CPU | 2 vCPU | 4–8 vCPU |
| RAM | 4 GB | 8–16 GB |
| Storage | 30 GB SSD | 64–128 GB SSD |
| Operating System | Ubuntu 22.04 | Ubuntu 24.04 LTS |
| Network | Stable Internet | High-Speed Internet |
| Azure VM Type | B2s / B1ms | B2as v2 / D4s v3 |

## How to Deploy OpenClaw on Azure (Step-by-Step)


### Step 1: Install Azure CLI

First, install Azure CLI.

**Linux**

**macOS**

**Windows** — Download Azure CLI installer from Microsoft website.


### Step 2: Sign In to Azure CLI

Login to Azure:

The `ssh` extension is required for Azure Bastion native SSH tunneling. Register the required Azure resource providers (one-time only):

Verify both show `Registered` before continuing:


### Step 3: Set Deployment Variables

Run these in your terminal to set all variables used throughout this guide:

Change `LOCATION` to the Azure region closest to you. The Bastion subnet must be at least `/26`.


### Step 4: Set Up Your SSH Key

Use an existing key if you have one:

If you don't have an SSH key yet, generate one:


### Step 5: Create the Resource Group

All Azure resources for this setup will live in one resource group:


```bash
{`az group create -n "\$" -l "\$"`}
```


### Step 6: Create the Network Security Group

The NSG locks down SSH so only Azure Bastion can reach the VM. Direct internet SSH is blocked:


```bash
{`az network nsg create \\
  -g "\$" -n "\$" -l "\$"

# Allow SSH from Bastion subnet only
az network nsg rule create \\
  -g "\$" --nsg-name "\$" \\
  -n AllowSshFromBastionSubnet --priority 100 \\
  --access Allow --direction Inbound --protocol Tcp \\
  --source-address-prefixes "\$" \\
  --destination-port-ranges 22

# Block SSH from the public internet
az network nsg rule create \\
  -g "\$" --nsg-name "\$" \\
  -n DenyInternetSsh --priority 110 \\
  --access Deny --direction Inbound --protocol Tcp \\
  --source-address-prefixes Internet \\
  --destination-port-ranges 22

# Block SSH from other VNet sources
az network nsg rule create \\
  -g "\$" --nsg-name "\$" \\
  -n DenyVnetSsh --priority 120 \\
  --access Deny --direction Inbound --protocol Tcp \\
  --source-address-prefixes VirtualNetwork \\
  --destination-port-ranges 22`}
```

Rules run lowest priority number first — Bastion is allowed at 100, everything else is blocked at 110 and 120.

Azure networking, NSG rules, and Bastion setup can be complex for beginners. If you'd prefer to avoid manual configuration, [Ampere.sh](https://www.ampere.sh) provides a fully managed OpenClaw deployment.


### Step 7: Create the VNet and Subnets

Create the virtual network with the VM subnet, attach the NSG, then add the Bastion subnet:


```bash
{`az network vnet create \\
  -g "\$" -n "\$" -l "\$" \\
  --address-prefixes "\$" \\
  --subnet-name "\$" \\
  --subnet-prefixes "\$"

# Attach NSG to VM subnet
az network vnet subnet update \\
  -g "\$" --vnet-name "\$" \\
  -n "\$" --nsg "\$"

# Azure Bastion requires this exact subnet name
az network vnet subnet create \\
  -g "\$" --vnet-name "\$" \\
  -n AzureBastionSubnet \\
  --address-prefixes "\$"`}
```


### Step 8: Create the Virtual Machine


```bash
{`az vm create \\
  -g "\$" -n "\$" -l "\$" \\
  --image "Canonical:ubuntu-24_04-lts:server:latest" \\
  --size "\$" \\
  --os-disk-size-gb "\$" \\
  --storage-sku StandardSSD_LRS \\
  --admin-username "\$" \\
  --ssh-key-values "\$" \\
  --vnet-name "\$" \\
  --subnet "\$" \\
  --public-ip-address "" \\
  --nsg ""`}
```

This creates a secure VM without public IP.


### Step 9: Deploy Azure Bastion

Bastion Standard SKU with tunneling is required to use `az network bastion ssh` from the CLI:


```bash
{`az network public-ip create \\
  -g "\$" -n "\$" -l "\$" \\
  --sku Standard --allocation-method Static

az network bastion create \\
  -g "\$" -n "\$" -l "\$" \\
  --vnet-name "\$" \\
  --public-ip-address "\$" \\
  --sku Standard --enable-tunneling true`}
```

Bastion takes 5–10 minutes to provision (up to 30 minutes in some regions). Wait for it to complete before the next step.


### Step 10: SSH Into the VM via Azure Bastion

Once Bastion is ready, connect to the VM:


```bash
{`VM_ID="$(az vm show -g "\$" -n "\$" --query id -o tsv)"

az network bastion ssh \\
  --name "\$" \\
  --resource-group "\$" \\
  --target-resource-id "\$" \\
  --auth-type ssh-key \\
  --username "\$" \\
  --ssh-key ~/.ssh/id_ed25519`}
```

You are now inside the VM.


### Step 11: Install OpenClaw

Run the OpenClaw installer inside the VM:

The installer detects Ubuntu, installs Node.js if missing, installs OpenClaw, and launches the onboarding wizard. During onboarding, choose your AI provider and set up your messaging channel.

After onboarding, connect a messaging channel — Telegram, [WhatsApp](/blog/connect-openclaw-whatsapp), Discord, Microsoft Teams, [Slack](https://www.ampere.sh/openclaw-for-slack), or any other supported app — to start chatting with your agent.


### Step 12: Verify the Installation

Run these in the Bastion SSH session to confirm everything is working:

If anything looks wrong:


## Cleanup

To delete everything created by this guide:


```bash
{`az group delete -n "\$" --yes --no-wait`}
```

This removes the VM, VNet, NSG, Bastion, public IP, and all associated resources.


## Common Issues and Fix



| Issue | Fix |
| --- | --- |
| Azure CLI not found | 1 |
| Provider not registered | 2 |
| VM creation fails (quota) | 3 |
| Bastion SSH fails | 4 |
| openclaw: command not found | 5 |
| OpenClaw not starting | 6 |
| Gateway shows error | 7 |
| Agent not responding | 8 |

If you prefer to avoid these setup issues entirely, you can deploy OpenClaw on Ampere.sh in 60 seconds. No manual configuration, no debugging, and no infrastructure management required.


## Skip the Azure Setup?

Running OpenClaw on Azure gives you powerful cloud infrastructure, but managing servers and configurations can still take time. With Ampere.sh, deploy OpenClaw in 60 seconds and run your agents 24/7.

[Deploy on Ampere.sh →](https://www.ampere.sh/setup)


## Frequently Asked Questions

### What is OpenClaw on Azure?

OpenClaw on Azure means running your OpenClaw AI agent on a Microsoft Azure virtual machine instead of your local computer. This allows your agent to run 24/7 with better performance and reliability.

### Do I need Azure CLI to run OpenClaw on Azure?

Yes. Azure CLI is required to create and manage Azure resources like virtual machines, networking, and security configurations during deployment.

### Which operating system is best for OpenClaw on Azure?

Ubuntu 22.04 or Ubuntu 24.04 LTS is recommended. These versions are stable, lightweight, and officially supported for OpenClaw deployments.

### Can I run OpenClaw 24/7 on Azure?

Yes. Azure virtual machines run continuously, allowing OpenClaw to stay online and available at all times.

### Can I connect OpenClaw to messaging apps on Azure?

Yes. After installation, you can connect OpenClaw to Telegram, Slack, Microsoft Teams, WhatsApp, and more.

### Is OpenClaw on Azure secure?

Yes. Using Network Security Groups, private networking, and Azure Bastion improves security significantly.

### Can I run multiple OpenClaw agents on Azure?

Yes. You can deploy multiple virtual machines or run multiple agents on one VM depending on available resources.

### Can beginners deploy OpenClaw on Azure?

Yes. The setup is beginner-friendly and takes around 20–30 minutes with the step-by-step guide.