Sitefinity Cloud is a fully managed, AI-powered cloud-native CMS designed for modern digital teams. Built on Microsoft Azure, it leverages native services for auto-scaling, load balancing and global availability. It provides scalable enterprise infrastructure optimally configured for security, scalability and performance.

Sitefinity Cloud CMS offers enterprise-grade SLA (99.95% uptime), DDoS protection and continuous security patching. With a strong compliance posture, it includes certifications like ISO 27001, SOC 2 and features such as global CDN, WAF, monitoring and audit logs. The infrastructure maturity of Sitefinity CMS is above average compared to competitors who rely on less integrated hosting stacks or DIY Azure/AWS setups. 

How does Progress® Sitefinity® Cloud reduce total cost of ownership compared to self hosting? 

Operations, security hardening, observability, autoscaling and platform upgrades are managed for you—so budgets shift from undifferentiated infrastructure to content and experience delivery. 

The service offers fully managed CI/CD pipelines and deployment automation tools for rapid deployment, streamlined upgrades, rollback and environment parity. Customers choose their level of control, from fully managed options to more hands-on configurations. 

Learn more or download Sitefinity Cloud Solution Overview

Sitefinity Cloud CMS is designed with flexible and composable pricing to meet your unique consumption needs.

Starting with the Cloud Base package, you can begin small and scale up as your requirements grow. With the help of add-ons and pay-as-you-go options, you can adjust your package to align perfectly with your usage.

For those seeking additional advanced features, enterprise-level setups or enhanced support, Sitefinity Cloud CMS offers value features/packages and enterprise-level support options. This means you can grow without the fear of outgrowing your initial setup or making an immense upfront investment, providing a scalable and adaptable solution tailored to your business. 

Yes, Sitefinity Cloud has a dynamically scaling infrastructure alongside a consumption-based pricing model to swiftly adapt to capacity requirements and traffic demands, enhancing cost-efficiency and overall performance. 

Sitefinity Cloud is built on a containerized architecture using Azure Kubernetes Service (AKS), which enables scalable, secure and efficient deployment of digital experiences. 

Yes - Moving your on-premises, or third party hosted site to Sitefinity Cloud is easy. Check out the Sitefinity Cloud requirements and the How To Move Your CMS to the Cloud guide.  

You can also purchase Sitefinity Cloud via Microsoft Azure Marketplace. Your Account Manager will assess environments, migration path and subscription setup in Azure Marketplace.

Reach out to our technical team that can provide you with a technical assessment and assist with planning your migration to the cloud. 

Yes - Thanks to Sitefinity Cloud's architecture, you have full access to your Sitefinity project source code and database backups in case you'd like to move Sitefinity to on-premises. Moving Sitefinity to on-premises would require a new perpetual Sitefinity license as well as guidance from the Sitefinity Cloud team. 

The initial training materials can be found within our comprehensive documentation for Sitefinity Cloud. These materials outline step-by-step instructions related to setup, development, deployment, and troubleshooting.

To access the Sitefinity Cloud Management Portal, first you'll provide us a list of user email addresses that need access to Sitefinity Cloud. These users will receive email invitations with Sitefinity Cloud access. More details on logging in can be found here. To access the Sitefinity Cloud backend, use the same credentials as you use for the Sitefinity Cloud Management Portal.

“401 – Uh-oh, you do not have access” after accepting the initial invite in the Sitefinity Cloud Management portal. The issue occurs if you are authenticated with multiple Azure DevOps organizations in the same browser. Open an incognito window and try logging in again.

Sitefinity Cloud has a permission that allows only specified users to promote content to the Production environment. Additional permissions are included in Sitefinity CMS.

MFA is enabled for all users in Sitefinity Cloud. Every new user invited will be prompted to register for MFA and has a 14-day grace period to do so. MFA registration requires the Microsoft Authenticator app using notifications. Once you have registered, you're free to choose between notifications or a text code to sign in with MFA.

Access to any Sitefinity Cloud environment and environment-specific areas can be restricted through an IP whitelist. The list of IPs is provided by the customer.

In case of multiple dynamic IPs for individual users, the customer can use a VPN service to provide a single outbound IP address. The VPN service would be a responsibility of the customer and is not provided as part of Sitefinity Cloud.

To use Azure AD Multi-Factor Authentication in Sitefinity Cloud you need the Microsoft Authenticator app. Select the notifications option during the initial registration. Once you have registered you can opt for either notifications or text code for MFA. The “Text message to phone” and “Call to phone” options are not supported. To configure MFA with the Microsoft Authenticator app using notifications, you can refer to the following guide.

The account locks from sign-in attempts for one minute after 10 failed attempts. The account locks again after each subsequent failed sign-in attempt, with lockout time growing after each subsequent attempt.

Note: This is applicable if the Developer Extensions toggle is enabled.

To offer consistency across environments and in line with the best practices for Continuous Integration and Continuous Delivery in Sitefinity Cloud, the Sitefinity configurations are in read-only file system mode. This means that changes to the file system configuration need to be made on the local development environment and then promoted across Sitefinity Cloud environments via the CI/CD pipeline.

Starting with Sitefinity 14.3.8022, customers can specify which configurations, sections, or properties should be editable directly on Sitefinity Cloud environments. The changes are applied at runtime, stored in the database and can be persisted even if the DB is replaced.

For more information on managing configurations in Sitefinity Cloud, refer to the following documentation article: Manage the configurations - Sitefinity CMS Develop and Deploy (progress.com).

Visit SupportLink to log the case and select Sitefinity Cloud as the product.

Note: This is applicable if the Developer Extensions toggle is enabled.

These screens make database schema modifications, therefore, these changes are done only on the development environment and then promoted via the Export for deployment functionality. When running Export for Deployment, the database schema changes are exported on the file system in the ~/App_Data/Sitefinity/Configuration/Deployment folder. The exported files should then be added to the project and committed to the source code.

Afterwards, the changes can be promoted to Staging and then to Production. Every time Sitefinity starts, it checks the ~/App_Data/Sitefinity/Configuration/Deployment folder and applies any changes detected there. For more information, see https://www.progress.com/documentation/sitefinity-cms/cloud/deploy-database-changes

The workflow looks like this:

1. Schema changes are made on the Development environment
2. Use Export for Deployment locally in the Development environment.
3. Include Deployment folder in the Sitefinity project, if missing, and add new files in the folder.
4. Commit the changes in the source code.
5. Deploy to Staging.
6. Promote to Production, if all changes work as expected on Staging.
7. For more information, see Export and deploy code changes.

Deployment runs on Microsoft Azure with integrated SIEM, Cloudflare CDN/WAF at the edge and managed observability for application and infrastructure events. 

In case of downtime or security incidents, an On-Duty engineer from Progress will acknowledge the issue within 15 minutes and start troubleshooting. Progress will open a ticket on behalf of the customer where detailed information will be provided every 20 minutes until the issue is resolved. If the downtime issue is caused by custom code deployed by the customer, Progress will assist with identifying the issue and provide suggestions for the fix.

Every Sitefinity release goes through Veracode scans, including both static and dynamic code analysis. Veracode reports are not publicly available as per internal guidelines.

The entire cloud infrastructure is continuously monitored by the Sitefinity Security team. The main goal is to maintain the highest possible security level. Customers are welcome to do their own security testing as well. To help provide a high level of industry security and architecture, Progress Sitefinity Cloud complies with different regulatory standards.

In Sitefinity Cloud, the application's security is treated with highest priority. Complex mechanisms for securing your project are available on both application and infrastructure level. Check out the security documentation to learn more.  

Yes, Sitefinity Cloud is SOC2-certified and HIPAA-compliant. The platform provides built-in tools and workflows that enable organizations to address GDPR and HIPAA requirements and other data privacy laws.  

SOC2 and HIPAA-compliance reports can be downloaded from the Progress Security Center.

Sitefinity helps safeguard Personally Identifiable Information (PII) and Protected Health Information (PHI) by utilizing field mapping, PII/PHI removal workflows and data obfuscation during database restore to a non-production environment to help organizations maintain compliance and ensure personal and data privacy.

The Sitefinity Cloud documentation summarizes the regulatory certifications that Progress Software has been awarded as a company and the ones that Progress Sitefinity Cloud complies with as a product.

What is SOC2?

SOC 2 is an independent audit report that provides detailed information and assurance of the security, availability, integrity, confidentiality and privacy controls an organization has implemented in its products and internal workflows.

What is HIPAA

HIPAA is a federal law that requires the creation of standards to protect sensitive patient health information from being disclosed without the patient's consent or knowledge.

Note: This is applicable if the Developer Extensions toggle is enabled.

When restoring from production to staging or when triggering a database backup on demand, the system obfuscates personal identifiable information. This is a security measure to protect personal data from being exposed, in case there is development or other work that has to be completed or reviewed by 3rd parties. Database obfuscation can be disabled on demand, after explicit consent is received via email. 

Note: This is applicable if the Developer Extensions toggle is enabled.

Whenever Sitefinity labels are updated, a new resource file (.resx) is created in the file system under App_Data\Sitefinity\GlobalResources. This new file should be added to the Visual Studio project and deployed. For more information, see the documentation article on code deployment.

If you have multiple versions of Visual Studio (e.g. 2017 and 2019), setting a default one is not available in Azure DevOps. To select the preferred Visual Studio version, perform the repo clone operation in Visual Studio instead of using the Azure DevOps Web UI. Open Visual Studio, connect to your project in Team Explorer, and select the repo to be cloned.

The caching of static files is controlled in the web.config file, in the staticContent section. By default, the maximum caching period is 31 days. This affects both browsers and CDNs. To invalidate the cache for static resources, you need a cache-busting strategy for the required types. Sitefinity has a built-in cache busting mechanism for JavaScript files that are stored in resource package folders. However, it does not cover CSS files or files outside of these folders.

• One option is to reuse the WidgetContent and AppendVersion methods. For more information, see class UrlHelpers in the Sitefinity GitHub repository.
• An alternative approach is to use the URL path. For more information, see Cache busting in ASP.NET.

Should you choose to migrate, you'll have the option to manually request a data export from Sitefinity Cloud.

The information on what data Sitefinity Insight obtains is overviewed in this documentation. You have the ability to control what data that is being tracked. No data, including statistic or "roll-up" information is shared with other tenants and/or users.

The locations where Sitefinity Cloud can be provisioned are listed here.

After you log the case in SupportLink, within 15 minutes, Progress will open a support ticket and provide information outlining any issues discovered by Progress's monitoring tools. You'll be able to include specific people on the ticket to receive automatic notifications. You'll receive updates on the case from Progress every two hours.

Automated backups of the database on each environment are made every minute. These backups are kept for a period of 35 days, enabling you to restore your website database to a desired point in time within that period. You can request a restoration to a point in time by contacting the Sitefinity support team.

If the Developer Extensions toggle is enabled, Sitefinity Cloud environment databases are automatically exported to .bacpac files on a weekly basis. You can access these files and use them to restore the database locally for development and testing purposes. Databases can also be exported on demand. 

For more information check out this database documentation.  

Yes - With our platform, customers can get the Sitefinity project, set it up locally, extend it, and then push the new code to the code repository within Sitefinity Cloud. The new code will be built by Sitefinity Cloud's CI process and deployed on the Staging environment by Sitefinity Cloud's CD process.

Progress employees don't have any access to the services included in the customer's Sitefinity Cloud account. In cases of emergency that require troubleshooting, the customer can provide Progress explicit consent to access particular services of their tenant.

Access to the website/database is restricted within Azure's permissions. Progress employees and customers do not have access to the web application and database/s. The customer can permit such access in a rare event where Progress employees need to intervene manually. Access to the staging environment is restricted on firewall level by IP/s whitelist. By default, users have access to database backups with obfuscated PII for local website development/debugging.

Other than that, Sitefinity Cloud customers can access the following Azure resources:

• Blob Storage containers with database backups
Database backups created via the AcquireDatabaseBackup pipeline are stored in dedicated Azure Blob Storage containers. The following documentation article provides details on how to access the Sitefinity Cloud database backups.


• Application Insights with logs from the application
The logs from the Sitefinity application are persisted in Application Insights. The following documentation article provides details on how to access the Sitefinity Cloud application logs in Application Insights.


• Search Services (read access)
Sitefinity Cloud has the Azure Search Service set up as the default search service in Sitefinity. It allows you to directly inspect the content inside the search indexes using the search explorer in the Azure portal, as well as configure different scoring profiles for the search index, which can be used from the Sitefinity application.


• Application Metrics Dashboards
A set of predefined dashboards in the Azure portal enabling customers to monitor their project’s key application metrics. The dashboards can be accessed through the links on the Overview page of the project in your Azure DevOps organization.

Yes, Sitefinity Cloud supports external code repositories outside of your Azure DevOps organization. We are using a service connection to connect external repos to the CI/CD and the automatic upgrade pipelines.

Depending on the type of repository, there are different options for authentication, including personal access tokens (PATs), username/password credentials, etc.

In terms of permissions, the connection requires read and write permissions in order to have both the CI/CD and automatic upgrade pipelines working properly.

The CI/CD pipeline requires read permissions and the automatic upgrade pipeline requires both read and write permissions. Write permissions in the auto upgrade pipeline are required to create the branch with the code changes from the upgrade.

Direct access to the databases across environments is restricted. By default, users have access to database backups with obfuscated PII for local website development and debugging.

Yes - Sitefinity Cloud provides out-of-the-box Continuous Integration (CI) and Continuous Deployment (CD) processes to drive operational efficiency and productivity.

Yes. To facilitate the needs of customizing the CI/CD process, Sitefinity Cloud offers a mechanism for extending the existing CI/CD pipeline and include custom tasks for the following events: 

• Pre-build tasks in CI stage 
• Post-build tasks in CI stage 
• Post-deployment tasks in CD stage 
  
  
   

Sitefinity Cloud includes two environments: Staging and Production. Both environments are within Azure cloud. For further info please refer to the cloud environments documentation. 

If the need arises, the connection between Sitefinity and Sitefinity Insight can be disabled.

Progress Software is committed to providing 99.95% uptime of production websites on Sitefinity Cloud.

A 99.95% SLA translates to a maximum downtime of approximately 21 minutes per month, excluding scheduled maintenance and conditions defined in the SLA terms.

What support and SLAs do I get with Sitefinity Cloud purchased via Azure Marketplace? 

Support and SLA entitlements are identical to direct purchase. They are tied to your Sitefinity Cloud subscription tier, not the checkout channel.

This SLA applies to the availability of the production environment hosted in Sitefinity Cloud.

Changes to Sitefinity are released as NuGet packages that you can decide whether or not to apply. The infrastructure provided by Sitefinity Cloud can be used to test, verify, accept, or reject the changes. This includes the staging environment, combined with the control provided by the deployment pipeline. Progress cannot offer the ability to test, verify, and accept or reject changes to Sitefinity Cloud services that are directly provided by Microsoft, such as Azure DevOps.

Sitefinity Cloud is provided as a service by default and is always running on the latest version without the need for any customer involvement. 

For the ASP.NET Core renderer application which is customizable and under customer control, an automated process runs daily checks for updates and executes a step-by-step upgrade routine. You're duly notified via email and have full control over when to merge and promote the upgrade.

Customers can purchase additional load balanced environments as needed to support a variety of use cases.

These environments can function as development spaces for developers to test and experiment, content authoring hubs where editors can make and preview changes safely and staging areas for running approval workflows before syncing and publishing to production. They also enable teams to branch off projects for new initiatives and support a wide range of other scenarios — offering the flexibility and scalability to adapt to each organization’s specific requirements.   

An SMTP service is not offered natively as part of Sitefinity Cloud. To enable email notifications via the Sitefinity Cloud web application, you need to configure Notification Profiles. Integration is available with many popular SMTP relay service providers (such as SendGrid and Microsoft Office 365), as well as internal SMTP servers, as long as they are configured to allow SMTP relay from Sitefinity Cloud. If your configuration requires whitelisting your Sitefinity Cloud IP addresses, you can obtain them by contacting Sitefinity Cloud Technical Support.

First, notify Progress of the users that need access. Then, Progress will send Sitefinity Cloud invitation through email to all of your required users.

All of the Azure services that Sitefinity Cloud leverages are within an Azure subscription which is owned and managed by Progress.

The Sitefinity Cloud Base package includes options for pre-committed page views and API calls, along with consumption-based add-ons and pay-as-you-go solutions for surpassing limits.

Refer to the Sitefinity Cloud Packages page for up-to-date information on the current usage guidelines.

Page views are counted as HTTP requests that match the following criteria: 

• Host: must be a Production domain 
• Method: GET 
• Response code: 200 (OK) 
• Bot filter: Likely human (requests that are determined to be from bots are not counted) 
• Content type: html 
• User agent does not contain "AppInsights" (excludes uptime health checks) 
• URL path is not part of Sitefinity Admin UI or media documents 

API calls are counted as HTTP requests that match the following criteria:

• Host: must be a Production domain 
• Content type: xml OR json 
• User agent does not contain "AppInsights" (excludes uptime health checks) 
• URL path is not part of Sitefinity system APIs used for Admin UI 

Page views and annual quotas are assessed yearly, allowing customers to offset their peak usage in one or more months and spread it across the entire billing cycle.   

Instead of calculating the overages every month based on the predefined quota, usage is also assessed annually. The result is a consumption-based model that offers flexibility and enables our customers to handle peaks in traffic for certain months and settle their balance at the end of the billing cycle.

To illustrate this, if your website exceeds the quota in March by 200,000 page views but due to seasonality, you do not reach your quota in August, your peak usage will be offset by the lower resource utilization in the summer. If you regularly exceed tier quota for page views or API calls, by 200,000 units each month, you will be asked to either prepay the difference or settle the balance at the end of the billing cycle. Alternatively, you can also upgrade your service to a higher bundle package by contacting your Account Manager.

Page view discrepancies between Sitefinity Cloud and Google Analytics are expected. The two systems collect and filter data using different methods and criteria.

How Sitefinity Cloud counts page views

In Sitefinity Cloud, page views are based on server-side HTTP requests that meet strict production criteria.

A request is counted as a page view when it:

• Targets a Production domain
• Uses the GET method
• Returns a 200 (OK) response
• Has content type html
• Is identified as likely human traffic
• Does not originate from uptime health checks
• Is not part of the Sitefinity Admin UI or media documents

Traffic identified as AI agents or automated bots is excluded. In addition, Sitefinity Cloud includes WAF and bot protection that may block suspicious traffic before it reaches the application layer.

This means Sitefinity Cloud reflects validated server-side traffic, after filtering and protection mechanisms are applied.

For full technical criteria, refer to the Page Views and API Calls documentation in the Management Portal.

How Google Analytics counts page views

Google Analytics collects data client-side through JavaScript tracking tags embedded in each page.

When a visitor loads a page:

• A JavaScript tag runs in the browser
• Data is sent to Google’s collection servers
• Cookies are used to track sessions and users

Google Analytics 4 automatically excludes known bots and spiders. However:

• Users who block JavaScript are not tracked
• Users who reject cookies may not be fully tracked
• Ad blockers or privacy tools can prevent tracking entirely
• Traffic blocked by WAF before page load may never trigger the tag

Google Analytics measures browser activity. Sitefinity Cloud measures validated server requests.

Why numbers differ

Common causes of variance include:

• Server-side filtering vs client-side tracking
• Bot protection and WAF blocking
• Cookie consent rejection
• Ad blockers and browser privacy settings
• JavaScript disabled in the browser
• Differences in bot detection logic

Because the two systems operate at different layers of the stack, deviations in reported page views are normal.

If reconciliation is required, review:

• Host filtering
• HTTP status codes
• Production vs non-production domains
• Bot filtering settings in both systems
• Time zone and date range alignment

Differences do not indicate data loss. They reflect fundamentally different measurement approaches.

You can track usage and resource utilization in the Sitefinity Cloud dashboard. Monthly usage reports contain a summary of your Sitefinity Cloud usage including the number of page views and API calls.

Customers with increased consumption needs can upgrade their quota for pre-committed page views by contacting their account manager. This can be done at any time or at the end of the designated period, in line with the renewal. 

Sitefinity Cloud runs on enterprise-grade infrastructure from Microsoft Azure. The platform is designed to offer redundancy, uptime and elevated security.

Our Sitefinity Cloud Engineers and Platform architects continuously develop the platform to provide unmatched reliability and performance. To deliver always-on experiences to our customers, we don’t allow direct access to the underlying infrastructure.   

While Sitefinity Cloud customers cannot directly add additional services, they can add those in Azure/AWS/Google Cloud subscriptions of their own. We can provide what is necessary for the integrations to those services – e.g. configure a VNet tunnel. 

Sitefinity Cloud enables customers to configure the platform to match their needs by adding functional and service add-ons. 
 

Direct access to Cloudflare is not allowed. However, the Sitefinity Cloud team can apply custom configurations upon request. Sitefinity Cloud customers who have purchased the Advanced Security Add-on have access to all HTTP and WAF logs from Cloudflare in Azure.

 Sitefinity Cloud leverages a custom-developed Cloudflare worker function that supports customizable edge rules.

 Custom rules meeting the following criteria can be added directly to the CDN edge:

• URL or URL component (e.g., pathname, query) matches a regex
• IP is part of a safelist or blocklist
• Request header value matches a regex
• Response status code matches a regex
  

These rules can be used to configure the following actions:

• Redirect
• Rewrite
• Transform the URL (e.g., replace all occurrences of '+' with '-')
• Set custom response headers
• Set custom response cookies
• Customize CDN cache (e.g., bypass the cache or set mandatory cache duration)
• Use custom origin

Sitefinity Cloud supports Azure Cognitive Search and Elasticsearch out of the box. Alternatively, Sitefinity Cloud customers can use Hawksearch or a self-hosted Elasticsearch instance. For more information, refer to our site search integration page and the following documentation resources covering search.

Each customer environment is logically isolated using Kubernetes namespaces, dedicated databases and secure ingress paths. Network-level isolation and integrated security features help protect against external threats. 

How is PII handled in lower environments? 

When restoring production data to staging or development, PII is automatically obfuscated to help prevent exposure during non‑production use.

Yes. Progress Sitefinity Cloud has achieved the Microsoft Solutions Partner designation with Certified Software under the Microsoft AI Cloud Partner Program. This recognition confirms that Sitefinity Cloud meets Microsoft’s interoperability standards and demonstrates proven customer success.

A single Integration Hub connector includes 500,000 tasks.

A “task” represents an executed automation workflow step triggered by events such as form submissions or content action.

Sitefinity Integration Hub can be triggered by multiple CMS events, including:

Form submissions

• Content publishing events
• Workflow transitions
• Data synchronization scenarios
• Sending data to external systems
• Sending data to Sitefinity Insight

Integration Hub enables event-driven automation between Sitefinity and third-party systems such as CRM, marketing automation or ERP platforms.

This allows Sitefinity to act as both a source and a destination for data workflows.