What is Azure Arc-enabled servers?

Azure Arc-enabled servers lets you manage Windows and Linux physical servers and virtual machines hosted outside of Azure, on your corporate network, or other cloud provider. For the purposes of Azure Arc, these machines hosted outside of Azure are considered hybrid machines. The management of hybrid machines in Azure Arc is designed to be consistent with how you manage native Azure virtual machines, using standard Azure constructs such as Azure Policy and applying tags. (For additional information about hybrid environments, see What is a hybrid cloud?)

When a hybrid machine is connected to Azure, it becomes a connected machine and is treated as a resource in Azure. Each connected machine has a Resource ID enabling the machine to be included in a resource group.

To connect hybrid machines to Azure, you install the Azure Connected Machine agent on each machine. This agent doesn't replace the Azure Log Analytics agent / Azure Monitor Agent. The Log Analytics agent or Azure Monitor Agent for Windows and Linux is required in order to:

• Proactively monitor the OS and workloads running on the machine
• Manage it using Automation runbooks or solutions like Update Management
• Use other Azure services like Microsoft Defender for Cloud

You can install the Connected Machine agent manually, or on multiple machines at scale, using the deployment method that works best for your scenario.

Supported cloud operations

When you connect your machine to Azure Arc-enabled servers, you can perform many operational functions, just as you would with native Azure virtual machines. Below are some of the key supported actions for connected machines.

• Govern:
  • Assign Azure machine configurations to audit settings inside the machine. To understand the cost of using Azure Machine Configuration policies with Arc-enabled servers, see Azure Policy pricing guide.
• Protect:
  • Protect non-Azure servers with Microsoft Defender for Endpoint, included through Microsoft Defender for Cloud, for threat detection, for vulnerability management, and to proactively monitor for potential security threats. Microsoft Defender for Cloud presents the alerts and remediation suggestions from the threats detected.
  • Use Microsoft Sentinel to collect security-related events and correlate them with other data sources.
• Configure:
  • Use Azure Automation for frequent and time-consuming management tasks using PowerShell and Python runbooks. Assess configuration changes for installed software, Microsoft services, Windows registry and files, and Linux daemons using Change Tracking and Inventory
  • Use Update Management to manage operating system updates for your Windows and Linux servers. Automate onboarding and configuration of a set of Azure services when you use Azure Automanage (preview).
  • Perform post-deployment configuration and automation tasks using supported Arc-enabled servers VM extensions for your non-Azure Windows or Linux machine.
• Monitor:
  • Monitor operating system performance and discover application components to monitor processes and dependencies with other resources using VM insights.
  • Collect other log data, such as performance data and events, from the operating system or workloads running on the machine with the Log Analytics agent. This data is stored in a Log Analytics workspace.

Log data collected and stored in a Log Analytics workspace from the hybrid machine contains properties specific to the machine, such as a Resource ID, to support resource-context log access.

Watch this video to learn more about Azure monitoring, security, and update services across hybrid and multicloud environments.

Supported regions

For a list of supported regions with Azure Arc-enabled servers, see the Azure products by region page.

In most cases, the location you select when you create the installation script should be the Azure region geographically closest to your machine's location. Data at rest is stored within the Azure geography containing the region you specify, which may also affect your choice of region if you have data residency requirements. If the Azure region your machine connects to has an outage, the connected machine isn't affected, but management operations using Azure may be unable to complete. If there's a regional outage, and if you have multiple locations that support a geographically redundant service, it's best to connect the machines in each location to a different Azure region.

Instance metadata information about the connected machine is collected and stored in the region where the Azure Arc machine resource is configured, including the following:

• Operating system name and version
• Computer name
• Computers fully qualified domain name (FQDN)
• Connected Machine agent version

For example, if the machine is registered with Azure Arc in the East US region, the metadata is stored in the US region.

Supported environments

Azure Arc-enabled servers support the management of physical servers and virtual machines hosted outside of Azure. For specific details about supported hybrid cloud environments hosting VMs, see Connected Machine agent prerequisites.

Agent status

The status for a connected machine can be viewed in the Azure portal under Azure Arc > Servers.

The Connected Machine agent sends a regular heartbeat message to the service every five minutes. If the service stops receiving these heartbeat messages from a machine, that machine is considered offline, and its status will automatically be changed to Disconnected within 15 to 30 minutes. Upon receiving a subsequent heartbeat message from the Connected Machine agent, its status will automatically be changed back to Connected.

If a machine remains disconnected for 45 days, its status may change to Expired. An expired machine can no longer connect to Azure and requires a server administrator to disconnect and then reconnect it to Azure to continue managing it with Azure Arc. The exact date upon which a machine expires is determined by the expiration date of the managed identity's credential, which is valid up to 90 days and renewed every 45 days.

Service limits

There's no limit to how many Arc-enabled servers and VM extensions you can deploy in a resource group or subscription. The standard 800 resource limit per resource group applies to the Azure Arc Private Link Scope resource type.

To learn more about resource type limits, see the Resource instance limit article.

Data residency

Azure Arc-enabled servers stores customer data. By default, customer data stays within the region the customer deploys the service instance in. For region with data residency requirements, customer data is always kept within the same region.

Next steps

• Before evaluating or enabling Azure Arc-enabled servers across multiple hybrid machines, review the Connected Machine agent overview to understand requirements, technical details about the agent, and deployment methods.
• Try out Arc-enabled servers by using the Azure Arc Jumpstart.
• Review the Planning and deployment guide to plan for deploying Azure Arc-enabled servers at any scale and implement centralized management and monitoring.
• Explore the Azure Arc landing zone accelerator for hybrid and multicloud.