Azure Arc for On-Premises Servers¶
Azure Arc lets you manage servers outside Azure (on-premises or in another cloud) with the same Azure tools as your managed VMs: Update Manager, monitoring, Defender for Cloud and Azure Policy. Use it when the environment already has infrastructure. If you need new or refreshed infrastructure at distributed locations, look at Azure Local instead.
Optional and platform-specific
Arc onboarding is not part of the core MCP hub and spoke. Whether your platform supports it, and through which module or pipeline, differs per platform. This page lists the questions to settle and the usual building blocks. Details change with Microsoft's releases: always check the Azure Arc documentation.
What you can do with an Arc-enabled server¶
| Capability | Notes |
|---|---|
| Update Manager | Patch the server with a maintenance configuration, as for managed VMs. |
| Monitoring | Install the monitoring agent to send logs to a Log Analytics workspace. |
| Defender for Cloud | Connect the non-Azure machine through the portal or programmatically with an extension. |
| Azure Policy | Audit the state of the server with machine configuration policies. |
| Run command | Run PowerShell remotely on the machine. |
| SSH login | With a private key or with Entra ID. Check whether Bastion supports Arc servers in your situation. |
| Windows Admin Center | Needs an active Software Assurance licence. Remote Desktop and PowerShell in Windows Admin Center ask for local credentials, not Entra ID. |
| Azure Site Recovery | Replicate VMware VMs, Hyper-V VMs, physical servers and Azure Stack VMs to Azure for business continuity. |
Onboard a server¶
- In the Azure portal, use the wizard to create the onboarding script. Choose subscription, resource group and region.
- Run the PowerShell script on the machine. The person who runs it needs rights on the subscription, and the machine needs outbound access to Azure on port 443.
- For many servers, use a service principal for scripted installations of the agent.
Onboarding itself is free. Some services that you use on top of it are not, for example Update Manager is charged per Arc-enabled server. Check the current prices.
Network connectivity¶
All Arc connections are outbound TCP over HTTPS. By default the agent uses the default route to the internet. You have three options:
| Option | Notes |
|---|---|
| Public endpoint (default) | Make sure the on-premises firewall does not block outbound traffic. Allow the service tags AzureActiveDirectory, AzureTrafficManager, AzureResourceManager, AzureArcInfrastructure and Storage (plus WindowsAdminCenter if you use it) or the matching IP addresses, and the URLs in the network requirements (for example download.microsoft.com and packages.microsoft.com). |
| Proxy server / Arc gateway | The agent talks to a local Arc proxy, then your enterprise proxy, then the Arc gateway. The Arc gateway is still in preview at the time of the source. It can't be combined with ExpressRoute, site-to-site VPN or private endpoints. |
| Private endpoint (Arc Private Link Scope) | Sends traffic over ExpressRoute or a site-to-site VPN. One private endpoint can serve many servers. Not all traffic uses it: Azure Resource Manager, Entra ID and the control plane still go over the public endpoints, so allow those in your NSG or firewall. Steps: create the private link scope, then configure DNS forwarding on-premises. |
Onboard through the Managed VM module¶
Where the platform offers it, the Managed VM module (or its pipeline) can also onboard on-premises VMs:
- A JSON file lists the machines and the features to switch on (Defender, monitoring, updates, and so on).
- A DevOps pipeline deploys it.
- The module enables Update Manager, monitoring and alerting, and Defender for Cloud for those servers.
Ask your platform team whether this is available and what the request looks like.