Azure Arc: Managing Hybrid Resources

Most organisations operate in a hybrid environment: some workloads run in Azure, others on on-premises servers, and some on other cloud providers. Managing these disparate environments with separate tools creates operational silos — different policies, different monitoring, different access controls. Azure Arc solves this by extending the Azure management plane to any infrastructure, letting you manage on-premises and multi-cloud resources using the same Azure portal, CLI, policies, and RBAC you use for Azure-native resources.

Azure Arc is a set of technologies that projects non-Azure resources into Azure Resource Manager (ARM) so they appear as Azure resources with resource IDs. Currently, Arc supports: Servers (Windows/Linux VMs on-premises or other clouds), Kubernetes clusters (any CNCF-conformant Kubernetes), SQL Server instances, Azure data services (SQL Managed Instance and PostgreSQL on Arc), and VMware vSphere and Azure Stack HCI virtual machines.

To onboard a Windows or Linux server to Arc, you install the Azure Connected Machine agent on the server. The agent registers the machine with ARM and keeps a persistent outbound connection to Azure (no inbound ports required). After registration, the server appears in the Azure portal under Azure Arc > Servers with a full ARM resource ID. You can generate an interactive or automated onboarding script from the portal that includes your subscription and resource group details.

Once a server is Arc-enabled, you can assign Azure Policy definitions to it just like a native Azure VM. For example, you can audit whether the Log Analytics agent is installed, enforce that specific Windows security baselines are applied, or automatically deploy the Defender for Cloud agent. Policy assignments at a management group or subscription scope automatically evaluate all Arc-enabled servers in that scope, giving you a unified compliance view across on-premises and cloud.

Arc-enabled servers can send logs and metrics to Azure Monitor using the Azure Monitor Agent (AMA). You create a Data Collection Rule (DCR) specifying which performance counters and event logs to collect and which Log Analytics workspace to send them to. The same DCR can target both Arc-enabled servers and native Azure VMs, providing a consistent monitoring configuration. Once data flows, the same KQL queries and alert rules you use for Azure VMs work for Arc servers too.

Enabling Microsoft Defender for Servers on an Arc-enabled server installs the Defender for Endpoint agent and provides the same threat protection, vulnerability scanning, and security recommendations that cloud VMs receive. This is particularly valuable for on-premises Windows Server 2012 and 2019 machines that cannot use cloud-native security products without Arc. The security posture score in Defender for Cloud reflects all resources — both Azure and Arc-managed — giving you a unified view.

Azure Arc-enabled Kubernetes onboards any CNCF-conformant Kubernetes cluster (on-premises, GKE, EKS, Rancher) to Azure. You install the Arc agents via a Helm chart, after which the cluster appears in ARM. From Azure you can deploy applications using GitOps (Flux or Argo CD managed by Azure), apply Azure Policy for Kubernetes (OPA Gatekeeper), and view cluster health in Azure Monitor. The control plane runs on the cluster itself — Azure only receives status and telemetry, not full API server access.

GitOps is a deployment pattern where the desired state of your Kubernetes workloads is defined in a Git repository, and an agent on the cluster continuously reconciles the cluster state to match the repository. With Arc-enabled Kubernetes, you configure a FluxConfiguration resource in Azure pointing to your Git repo. The Flux operator on the cluster pulls manifests from the repo and applies them — enabling declarative, auditable, and automated application deployment across any number of clusters from a single Git source of truth.

Azure Arc-enabled SQL Server onboards on-premises SQL Server instances (2012–2022) to ARM. Benefits include: Azure Extended Security Updates (ESU) for free when connected to Arc (for SQL Server 2012/2014 out of mainstream support), Microsoft Defender for SQL threat detection, Entra ID authentication for on-premises SQL, and Azure Monitor integration for database performance metrics. Arc does not change how SQL Server runs — it only adds management capabilities.

Azure Arc resource bridge is a lightweight virtual appliance deployed in a VMware vSphere or Azure Stack HCI environment. It creates a management connection that lets you view, start, stop, and resize VMware VMs from the Azure portal without migrating them. This is particularly useful for organisations beginning their cloud journey who want to standardise on Azure management tooling while running VMs on-premises. You can also apply Arc policies and monitor these VMs with Azure Monitor through the resource bridge connection.

The Azure Connected Machine agent and Kubernetes Arc onboarding are free. Charges apply for specific value-add services: Defender for Servers, Azure Monitor agent data ingestion, and Arc-enabled data services (SQL Managed Instance, PostgreSQL). The only prerequisites for server onboarding are: the server must have outbound HTTPS access to Azure endpoints (or use a proxy), a supported OS (Windows Server 2008 R2+ or many Linux distributions), and an Azure subscription with the Microsoft.HybridCompute resource provider registered.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this lesson you learned: Azure Arc extends the Azure management plane to on-premises servers, Kubernetes clusters, and SQL Server instances by projecting them into ARM, the Azure Connected Machine agent onboards servers with only outbound HTTPS connectivity, and GitOps with Flux enables declarative application deployment across Arc-enabled Kubernetes clusters. Next up we explore Azure ExpressRoute and VPN Gateway for private connectivity between on-premises and Azure.