# Azure Arc

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/azure-arc

## Quick definition

Azure Arc is a tool from Microsoft that helps you manage your IT resources no matter where they are located. You can use it to control servers in your own data center, computers in other clouds like Amazon Web Services or Google Cloud, and even devices at the edge. It gives you a single place to apply security rules, track updates, and organize everything, all from the Azure portal.

## Simple meaning

Think of Azure Arc as a universal remote control for all the technology in your company. Just like a universal remote can control your TV, sound system, and gaming console even though they are different brands, Azure Arc lets you manage servers and other technology from different places using one tool.



Normally, if you have servers in your office and also use Amazon Web Services or Google Cloud, you might need to log into three or four different management websites just to check on everything. This can be exhausting and confusing. Azure Arc connects all those separate systems so you can see them in one dashboard. It works by installing a small piece of software on each server or cluster you want to manage. That software phones home to Azure and reports what the server is doing, what software is running, and whether it has the latest security patches.



Once your resources are connected, you can do many things. You can enforce security policies, like making sure every server has antivirus software turned on. You can deploy updates or new applications across all your servers at once. You can also use Azure tools to monitor performance, set up alerts when something goes wrong, and even run databases that are stored on your own hardware.



Azure Arc does not move your data to Microsoft’s cloud. Instead, it only sends metadata, which is information about your resources but not the actual content. This is important for companies that have strict rules about keeping customer data in certain locations. They still get the benefits of cloud management without having to send sensitive data anywhere.



For an IT certification learner, understanding Azure Arc is important because hybrid cloud environments are now the norm. Most businesses do not run everything in one single cloud. They mix on-premises servers, multiple cloud providers, and edge devices. Azure Arc is Microsoft’s answer to this complexity. It brings consistency and simplicity to a messy world. Instead of managing each environment with separate tools, you unify them under Azure’s management plane.



One easy way to remember it is: Azure Arc extends Azure’s control plane to any infrastructure. The control plane is the set of management functions that Azure offers, like policy enforcement, monitoring, and updates. By extending that control plane outside of Azure, you can manage everything with the same skills and tools you already use for Azure.

## Technical definition

Azure Arc is a hybrid and multicloud management platform that extends the Azure Resource Manager (ARM) control plane to resources running outside of Azure subscriptions. This includes physical or virtual servers running Windows or Linux, Kubernetes clusters, SQL Server instances, and Azure Stack HCI clusters. The core mechanism relies on agent-based connectivity, where a lightweight agent installed on each resource establishes an outbound connection to Azure using HTTPS on port 443. This outbound-only model eliminates the need for opening inbound ports in firewalls, a critical security advantage for enterprise environments.



The Azure Arc-enabled server experience uses the Azure Connected Machine agent. Once installed and registered, the agent reports metadata to Azure, including operating system version, disk capacity, network configuration, and installed software inventory. This metadata enables Azure policies, Azure Monitor, and Azure Update Management to function on non-Azure machines. For example, you can apply Azure Policy to enforce that only approved applications run on Arc-enabled servers, regardless of their physical location. The agent communicates periodically with Azure, typically every five minutes, to maintain a current state.



For Kubernetes, Azure Arc-enabled Kubernetes works by deploying a set of agents (arc-agents, cluster-metadata-operator, resource-sync-agent, etc.) into the target cluster. These agents run as pods and maintain an outbound connection to Azure. Once connected, you can manage the cluster through the Azure portal, apply GitOps configurations using Flux, and deploy Helm charts. GitOps is a key feature: you define a desired state in a Git repository, and Azure Arc continuously reconciles the cluster to match that state. This enables automated, auditable configuration management across clusters in different clouds or on-premises.



Azure Arc also extends to data services. Azure Arc-enabled SQL Server allows you to manage SQL Server instances running anywhere with Azure tools. You can configure backups, security patches, and monitoring from Azure. Azure Arc-enabled PostgreSQL and data services (like Azure Arc-enabled SQL Managed Instance) run on Kubernetes clusters managed by Arc, providing elastic scaling and automated patching while the data remains on your own infrastructure.



The underlying protocol for connectivity is built on Azure IoT Hub and Azure Resource Manager. The registered resource is represented as a resource in Azure Resource Manager, assigned a resource ID, and listed alongside native Azure resources in the portal. This means role-based access control (RBAC), Azure Policy, and resource tags all apply uniformly. For example, you can tag an on-premises server as “Production” and apply a policy that restricts SSH access, just as you would for an Azure VM.



From a networking perspective, no VPN or ExpressRoute is required for Arc to function, though they can be used. The agent uses public endpoints to connect, but you can configure proxy servers for environments that restrict internet access. For servers that cannot reach the internet at all, Azure Arc is not suitable unless you set up a proxy that can relay traffic.



Real IT implementation involves careful planning for agent deployment at scale. Organizations use Azure Arc to achieve regulatory compliance across distributed environments, to centralize patching through Azure Update Management (which calls Windows Update or Linux package managers), and to enable Azure Monitor for proactive alerting. Arc also integrates with Azure Security Center and Microsoft Defender for Cloud, extending threat detection capabilities to on-premises and multicloud workloads.



Azure Arc is not a migration tool. It does not move workloads to Azure. It is a management overlay that brings Azure’s governance, security, and operations tools to any infrastructure. It requires internet connectivity, agent management, and a change in operational mindset to centralize management across previously isolated environments.

## Real-life example

Imagine you are the facilities manager for a company that owns three different office buildings spread across town. Each building has its own security system, its own heating and cooling controls, its own lighting schedule, and its own cleaning crew schedule. You currently have to visit each building separately, check each system, and make adjustments manually. Sometimes you forget to adjust the thermostat in Building B, or you miss a security alarm because you are in Building A. This is inefficient and stressful.



Now imagine you install a central control panel in your main office. You connect each building’s systems to this panel through a small communication device. From this panel, you can see the temperature in all three buildings, lock or unlock any door, turn lights on or off, and schedule cleaning for all buildings at once. If a security alarm goes off in Building C, the panel alerts you immediately, no matter where you are. The panel does not actually own the buildings or change their physical structure. It simply gives you a single window to manage everything.



In this analogy, the three buildings are your different IT environments: your own data center (on-premises), AWS, and Google Cloud. The central control panel is Azure Arc. The small communication device is the Azure Connected Machine agent installed on each server or Kubernetes cluster. The thermostat, security system, and lights represent management tasks like applying security policies, installing updates, and monitoring performance.



The key point is that you do not move any of the physical infrastructure. The buildings stay where they are. But you gain the ability to manage them all from one location. This saves time, reduces errors, and gives you a complete picture of your operations. In IT, Azure Arc does exactly that: it gives you a single management plane for servers and clusters that live anywhere, without moving them to Azure.



A practical scenario: A retail company has point-of-sale servers in 500 stores, a Kubernetes cluster for analytics on AWS, and a SQL Server database in their headquarters data center. Without Azure Arc, the IT team needs separate tools to patch the store servers, update the Kubernetes cluster, and secure the SQL database. With Azure Arc, they onboard all these resources. Now they can push a critical security patch to all 500 store servers from the Azure portal, enforce a policy that blocks unauthorized software on the AWS cluster, and set up backups for the SQL database, all without leaving the Azure dashboard.

## Why it matters

Azure Arc matters because the modern IT landscape is rarely homogeneous. Most organizations operate a mix of on-premises data centers, public cloud environments from multiple providers, and edge devices. Managing each silo with separate tools leads to inconsistencies, security gaps, and inefficient operations. Azure Arc addresses this by unifying management under one familiar interface.



For IT professionals, Azure Arc is important for several reasons. First, it reduces operational overhead. Instead of learning and maintaining separate management tools for on-premises, AWS, Google Cloud, and Azure, teams can standardize on Azure’s management tooling. Second, it improves security posture. When all resources are visible in Azure, you can apply consistent security policies across the entire estate. If a new vulnerability is announced, you can quickly assess which of your servers, even those outside Azure, are affected and apply patches from a single console.



Third, Azure Arc enables cost savings. By using Azure Update Management and Azure Policy on existing hardware, organizations can avoid the cost of migrating workloads to the cloud for management benefits alone. Fourth, it supports compliance. Many regulated industries require data to remain in specific geographic locations. Azure Arc lets those organizations benefit from cloud management capabilities while keeping data on-premises.



Finally, Azure Arc is a strategic skill for IT professionals. As more companies adopt hybrid and multicloud strategies, the ability to manage across environments becomes increasingly valuable. Knowing Azure Arc demonstrates that you can design and operate management solutions that span diverse infrastructure, a skill that is in high demand.

## Why it matters in exams

Azure Arc appears in several Microsoft Azure certification exams, including AZ-104 (Microsoft Azure Administrator) and Azure Fundamentals (AZ-900). It is also relevant for AWS and Google Cloud certifications because Azure Arc competes with their own hybrid management solutions like AWS Systems Manager and Google Anthos. Understanding Azure Arc helps you answer questions about hybrid management, policy enforcement, and resource governance.



For AZ-900, you need to understand that Azure Arc is a solution for managing hybrid and multicloud environments. Questions may ask: “Which Azure service allows you to manage resources outside of Azure using the same tools?” or “What is the primary benefit of Azure Arc?” You may also see scenario-based questions where a company has on-premises servers and wants to apply Azure Policy to them. The correct answer is to use Azure Arc.



For AZ-104, the exam covers more technical aspects. You may be asked about the prerequisites for enabling Azure Arc, such as the need for the Azure Connected Machine agent and outbound internet access. You could see questions about how to register servers, how to assign policies to Arc-enabled machines, or how to use Azure Arc with Azure Update Management. There may be troubleshooting questions about why an Arc-enabled server is not showing up in the portal, often related to agent communication issues or network proxy configuration.



For AWS certifications like AWS Certified Cloud Practitioner, AWS Developer Associate, or AWS Solutions Architect Associate, Azure Arc is not directly tested, but comparative questions may appear. You might be asked to contrast Azure Arc with AWS Systems Manager or AWS Outposts. Knowing Azure Arc helps you answer those comparison questions correctly.



For Google Cloud certifications like Google Cloud Digital Leader or Google Associate Cloud Engineer, Azure Arc is again not a test objective, but understanding it helps with multicloud management questions. Google’s equivalent is Anthos, and exam questions may ask you to identify differences.



In all exams, common question patterns include: identifying the correct service for a given hybrid scenario, understanding that Arc does not migrate workloads but only manages them, and recognizing that Arc requires an installed agent and internet connectivity. You are unlikely to be asked about deep configuration details like Flux or GitOps in foundational exams, but for professional-level exams, those details may appear.

## How it appears in exam questions

Exam questions about Azure Arc typically fall into three patterns: scenario-based, configuration, and troubleshooting.



Scenario-based questions present a business requirement and ask which service to use. For example: “A company has virtual machines in an on-premises data center and wants to apply Azure security policies to them. Which service should they use?” The correct answer is Azure Arc. Another scenario: “An organization has Kubernetes clusters running on AWS and on-premises. They want to manage them centrally from Azure. What should they implement?” Answer: Azure Arc-enabled Kubernetes.



Configuration questions focus on prerequisites and steps. Example: “You need to enable Azure Arc on a Windows Server 2019 machine that is behind a corporate proxy. What must you configure first?” The correct approach is to configure the proxy settings on the Azure Connected Machine agent, often via an environment variable or agent configuration file. Another question: “Which port must be open for the Azure Arc agent to function?” Answer: outbound HTTPS (port 443).



Troubleshooting questions test your ability to diagnose common issues. For instance: “You have installed the Azure Connected Machine agent on a server, but the server does not appear in the Azure portal after one hour. What is the most likely cause?” Possible causes include network connectivity issues, incorrect registration credentials, or the agent service is not running. The question might ask you to verify that the agent can reach the Azure endpoints.



Another pattern involves policy and RBAC. Example: “You have Arc-enabled servers in a resource group. You assign a policy to the resource group to require encryption. Will this policy apply to the Arc-enabled servers?” The answer is yes, because Arc-enabled servers are represented as normal Azure resources and resource groups exist in Azure Resource Manager.



You may also see questions about licensing. For example, “Do you need additional licensing to use Azure Arc?” The answer varies: management features like Azure Policy are free, but using Arc-enabled data services or advanced security features requires appropriate licensing (e.g., Azure Arc-enabled SQL Server requires SQL Server license with Software Assurance).



A common tricky question: “Does Azure Arc migrate on-premises workloads to Azure?” The correct answer is no. Azure Arc only manages, not migrates. This is a frequent misassumption that exam writers exploit.

## Example scenario

A medium-sized hospital has 200 servers in its main data center running patient records, billing systems, and email. They also have 50 servers in a remote clinic that operate on a disconnected network with limited internet. The IT team wants to ensure all servers are patched monthly and comply with healthcare regulations. They also want to monitor server health without deploying a separate monitoring solution.



They decide to use Azure Arc. First, they install the Azure Connected Machine agent on each of the 200 main data center servers. These servers have reliable internet access, so the agent connects successfully. The IT team can now see all 200 servers in the Azure portal. They apply an Azure Policy that requires all servers to have Windows Defender enabled and to report missing updates. They also set up Azure Update Management to automatically patch servers every month.



For the remote clinic with limited internet, they cannot use Azure Arc because the servers cannot maintain a stable outbound connection to Azure. They instead use a local update server and manual compliance checks. Azure Arc is not suitable for environments without internet connectivity.



This scenario illustrates the core benefit of Azure Arc: centralized management for internet-connected servers. It also highlights a key limitation: Azure Arc requires internet connectivity. During certification exams, you may be asked to identify when Azure Arc is appropriate and when it is not.

## Common mistakes

- **Mistake:** Thinking Azure Arc migrates workloads to Azure.
  - Why it is wrong: Azure Arc does not move any data or workloads. It only extends management capabilities to resources residing elsewhere. Migration is a separate process.
  - Fix: Remember that Arc is a management tool, not a migration tool. It keeps workloads where they are but manages them from Azure.
- **Mistake:** Believing Azure Arc requires inbound firewall ports.
  - Why it is wrong: The Azure Connected Machine agent uses outbound connections only. No inbound ports are needed. Opening inbound ports would be a security risk.
  - Fix: Check that outbound HTTPS (port 443) is open from the machine to Azure endpoints. Do not open any inbound ports.
- **Mistake:** Assuming Azure Arc works without internet connectivity.
  - Why it is wrong: The agent needs to periodically communicate with Azure to report status and receive policies. Without internet, the agent cannot function.
  - Fix: Ensure the machine has a stable outbound internet connection or a proxy that can relay traffic to Azure. For air-gapped environments, consider alternatives like Azure Stack.
- **Mistake:** Confusing Azure Arc with Azure Stack.
  - Why it is wrong: Azure Stack is a hardware and software solution that brings Azure services to on-premises data centers. Azure Arc is a software-only management tool that connects existing infrastructure to Azure.
  - Fix: Azure Arc manages resources that are not Azure. Azure Stack runs actual Azure services locally. They serve different purposes.
- **Mistake:** Thinking Azure Arc is only for servers.
  - Why it is wrong: Azure Arc supports multiple resource types: servers (Windows and Linux), Kubernetes clusters (any distribution), SQL Server instances, and Azure Stack HCI clusters.
  - Fix: Remember the broader scope: Arc for servers, Arc for Kubernetes, Arc for data services. Each requires a different agent or onboarding method.
- **Mistake:** Expecting Azure Arc to work without proper permissions.
  - Why it is wrong: To register a machine with Azure Arc, you need permissions at the Azure subscription level, typically Contributor or Owner. If not configured, registration fails.
  - Fix: Ensure the user or service principal performing the registration has the required RBAC permissions on the target resource group or subscription.

## Exam trap

{"trap":"A question describes a scenario where a company has on-premises servers and wants to use Azure features like Azure Backup or Azure Site Recovery for disaster recovery. The question asks: 'Which Azure service should they use?'","why_learners_choose_it":"Learners often confuse Azure Arc with services that provide disaster recovery or backup. They see 'managing on-premises' and jump to Azure Arc, even though the requirement is for backup or replication, not just management.","how_to_avoid_it":"Read the question carefully. Azure Arc enables management, policy, and monitoring, but it does not provide backup or disaster recovery. For Azure Backup on on-premises servers, you use the Azure Backup agent or Microsoft Azure Recovery Services (MARS) agent, not Azure Arc. For Azure Site Recovery, you use the Site Recovery appliance. Azure Arc can be used alongside these services, but by itself it does not perform backup or replication."}

## Commonly confused with

- **Azure Arc vs Azure Stack:** Azure Stack is a hybrid cloud platform that brings Azure services, like VMs and storage, to your on-premises data center. Azure Arc does not run Azure services locally; it only connects existing resources to Azure for management. Azure Stack is hardware-based (Azure Stack HCI or Azure Stack Hub), while Azure Arc is a pure software solution. (Example: If you want to run Azure VMs on your own hardware, use Azure Stack. If you want to manage your existing VMware or Hyper-V servers from Azure, use Azure Arc.)
- **Azure Arc vs AWS Systems Manager:** AWS Systems Manager is a similar hybrid management service from Amazon Web Services. It manages EC2 instances and on-premises servers via the SSM Agent. Azure Arc performs the same function but for the Azure ecosystem. The difference is the cloud provider: Systems Manager works with AWS, Azure Arc works with Azure. (Example: A company using AWS would use Systems Manager to patch on-premises servers. A company using Azure would use Azure Arc.)
- **Azure Arc vs Google Anthos:** Google Anthos is Google Cloud’s hybrid and multicloud platform for managing Kubernetes clusters anywhere. Azure Arc-enabled Kubernetes is Microsoft’s equivalent. Both use agents and GitOps, but Anthos is tied to Google Cloud and can manage clusters across AWS and Azure, while Azure Arc is tied to Azure and supports managing clusters on AWS and Google Cloud. (Example: To manage a Kubernetes cluster on AWS from Google Cloud, use Anthos. To manage that same cluster from Azure, use Azure Arc-enabled Kubernetes.)
- **Azure Arc vs Azure Policy:** Azure Policy is a service within Azure that enforces rules on resources. Azure Arc enables you to apply Azure Policy to resources outside of Azure. They are not the same thing: Azure Policy is the rule engine, Azure Arc is the connectivity layer that brings external resources into Azure’s scope so Policy can evaluate them. (Example: Azure Policy is like a rule book. Azure Arc is like a bridge that connects your offsite buildings to the main office so the rule book can be applied there.)
- **Azure Arc vs Azure Monitor:** Azure Monitor collects telemetry and logs from Azure resources. Azure Arc extends Azure Monitor to non-Azure resources. Azure Monitor is the tool for data collection and alerting; Azure Arc is the enabling technology that allows that data collection to happen on external machines. (Example: You need Azure Monitor to see CPU usage. You need Azure Arc to see CPU usage on an on-premises server in Azure Monitor.)

## Step-by-step breakdown

1. **Plan the deployment** — Identify all servers and clusters you want to manage with Azure Arc. Ensure they have outbound internet access to Azure public endpoints. Determine which resource groups and regions to use in Azure. Plan for proxy configuration if the environment uses a proxy server.
2. **Install the Azure Connected Machine agent** — For servers, download and install the Azure Connected Machine agent on each target machine. For Windows, use an MSI installer. For Linux, use a script that downloads the agent package. The agent is available for Windows Server 2012 and later, and multiple Linux distributions including Ubuntu, CentOS, and Red Hat.
3. **Register the machine with Azure** — Run the agent registration command (azcmagent connect) providing your Azure subscription, resource group, and location. This establishes the connection. The authentication method can be interactive or service principal for bulk deployments. The agent generates a unique resource ID in Azure Resource Manager.
4. **Verify the connection** — Check the Azure portal. The machine should appear as a resource in the specified resource group. The status should be “Connected”. You can also run azcmagent show on the machine to see connection details, including the last heartbeat time.
5. **Apply policies and configurations** — Assign Azure Policy initiatives to the resource group containing the Arc-enabled machines. Policies can enforce settings like requiring encryption, disabling local users, or installing Microsoft Defender. You can also use Azure Update Management to schedule patching.
6. **Enable monitoring** — Install the Azure Monitor agent (AMA) on the Arc-enabled machines. This agent sends performance and event data to Log Analytics workspaces. You can then create alerts for high CPU usage, disk space, or specific security events. Dashboards can visualize health across all machines.
7. **Manage Kubernetes clusters (optional)** — For Kubernetes, deploy the Arc agents using a provided script or Helm chart. The cluster must meet prerequisites: a compatible Kubernetes version, kubeconfig access, and outbound connectivity. Once connected, you can enable GitOps configurations to automatically deploy applications from a Git repository.
8. **Enable data services (optional)** — For SQL Server, install the Azure extension for SQL Server on Windows machines. For Azure Arc-enabled SQL Managed Instance, deploy it on a Kubernetes cluster that is already Arc-enabled. This creates a managed database service that runs locally but is patched and backed up via Azure.
9. **Monitor and maintain** — Regularly check the health of the Arc agents. The agent updates itself automatically but may require restart. Monitor connectivity status. If a machine goes offline, investigate network issues or agent crashes. Use Azure Arc’s inventory tools to maintain an accurate asset list.
10. **Decommission resources** — If a server is retired, disconnect it from Azure Arc by running azcmagent disconnect and then uninstall the agent. This removes the resource from Azure Resource Manager. Failing to disconnect can leave orphaned resources in your subscription.

## Practical mini-lesson

In practice, deploying Azure Arc is not just about installing an agent. It requires careful planning of network connectivity, permissions, and organizational policies. The first step is always assessment. IT professionals must inventory their existing infrastructure and verify that all target machines meet the prerequisites. For servers, that means Windows Server 2012 R2 or newer, Linux kernel version 3.10 or later, and PowerShell 4.0 or later for Windows. For Kubernetes, the version must be 1.18 or later, and the cluster must support Kubernetes RBAC.



Network configuration is a common stumbling block. The Azure Connected Machine agent requires access to multiple Azure endpoints, including management.azure.com, login.microsoftonline.com, and specific region endpoints. If a proxy server is in use, the agent must be configured to use it. This is done via environment variables (HTTPS_PROXY) or the agent’s configuration file. Without proper proxy configuration, registration will fail silently.



Bulk onboarding is often done using Azure Arc’s automated scripts. For Windows, you can use Group Policy to deploy the MSI and a PowerShell script that registers the machine. For Linux, you can use configuration management tools like Ansible or Puppet. Azure Arc also supports onboarding via Azure Resource Manager templates or using the Azure portal’s “Generate script” feature, which produces a script tailored to your subscription.



What can go wrong? A common issue is that the agent loses connectivity after an operating system update or a network configuration change. The agent will show as “Disconnected” in the portal. The fix is usually to verify network connectivity from the machine to Azure endpoints using Test-NetConnection (Windows) or curl (Linux). Another issue is that the machine appears but policies do not apply. This often happens because the policy assignment is scoped to a resource group that does not contain the Arc-enabled machines. Check the scope.



Another consideration is cost. Azure Arc itself is free for basic management features like Azure Policy and Azure Resource Manager. However, using advanced services like Azure Monitor, Azure Security Center, or Azure Update Management incurs charges based on the number of connected machines. For SQL Server, Azure Arc-enabled SQL Server requires SQL Server licenses with Software Assurance or subscription-based licenses. Professionals must budget accordingly.



Finally, security is a core concern. The Azure Connected Machine agent runs with local system privileges. It should be treated as any other critical service. Use managed identities or service principals with the least privilege needed for registration. Audit agent installations and regularly review which machines are Arc-enabled to avoid unauthorized management endpoints.

## Commands

```
az arc connect --name MyCluster --resource-group MyRG --subscription MySub
```
Connects a Kubernetes cluster to Azure Arc, enabling management of the cluster from Azure.

*Exam note: Tests understanding of the initial step to onboard Kubernetes clusters to Azure Arc; often appears in scenario-based questions about hybrid management.*

```
az connectedmachine extension create --name MyExtension --machine-name MyMachine --resource-group MyRG --location eastus --type CustomScriptExtension --publisher Microsoft.Compute --settings "{\"commandToExecute\": \"echo Hello\"}"
```
Installs a custom script extension on an Azure Arc-enabled server to run a script or configuration.

*Exam note: Exams assess knowledge of managing extensions on Arc-enabled machines, similar to Azure VMs but for hybrid servers.*

```
az connectedmachine run-command invoke --name MyMachine --resource-group MyRG --command-id RunPowerShellScript --scripts "Get-Process"
```
Runs a PowerShell command remotely on an Azure Arc-enabled server for troubleshooting or administration.

*Exam note: Commonly tested in hybrid scenarios to demonstrate remote management capabilities without direct RDP/SSH access.*

```
az k8s-extension create --name MyExtension --cluster-name MyCluster --resource-group MyRG --cluster-type connectedClusters --extension-type microsoft.azuredefender.kubernetes --auto-upgrade-minor-version true
```
Deploys Azure Defender for Kubernetes as an extension on an Arc-enabled Kubernetes cluster for security monitoring.

*Exam note: Highlights integration with Azure Security Center; exams test knowledge of extensions for security, policy, and monitoring.*

```
az policy assignment create --name ApplyTags --scope /subscriptions/MySub/resourceGroups/MyRG --policy-definition /providers/Microsoft.Authorization/policyDefinitions/... --params '{"tagName": {"value": "Environment"}, "tagValue": {"value": "Production"}}' --assign-identity --location eastus
```
Assigns an Azure Policy to an Arc-enabled resource scope, ensuring compliance across hybrid environments.

*Exam note: Tests the ability to enforce governance policies on non-Azure resources, a core concept in identity and governance.*

```
az connectedmachine assess-patches --name MyMachine --resource-group MyRG
```
Assesses missing patches on an Azure Arc-enabled server and reports compliance status.

*Exam note: Appears in questions about update management for hybrid machines, comparing to Azure Update Management for VMs.*

```
az role assignment create --assignee user@domain.com --role Reader --scope /subscriptions/MySub/resourceGroups/MyRG/providers/Microsoft.HybridCompute/machines/MyMachine
```
Assigns a Reader role to a user for a specific Arc-enabled server, demonstrating RBAC on hybrid resources.

*Exam note: Tests understanding of role-based access control scope for Arc resources, a common exam scenario.*

## Troubleshooting clues

- **Agent not registered** — symptom: Azure portal shows machine as 'Disconnected' or 'Expired' status.. The Azure Connected Machine agent heartbeat has stopped due to network issues, expired certificate, or agent crash. (Exam clue: Exams present scenarios where a machine shows disconnected after network changes, testing the need to check agent health and re-register.)
- **Extension deployment failure** — symptom: Extension status shows 'Failed' with error 'Extension provisioning failed' in portal.. Incorrect extension type, incompatible version, or missing dependencies on the target machine (e.g., Python for custom scripts). (Exam clue: Questions often ask why a custom script extension fails on an Arc server, requiring knowledge of extension prerequisites and logs.)
- **Policy assignment not applying** — symptom: Arc-enabled resources show non-compliant despite a policy assignment targeting their resource group.. The policy assignment may lack a managed identity, or the Arc resources are not in the correct scope due to subscription filtering. (Exam clue: Tests understanding of policy scope and the need for system-assigned identity on Arc resources for remediation tasks.)
- **Azure AD authentication timeout** — symptom: Error 'AADSTS700016' when trying to connect an Arc agent, with message about application not found.. The service principal used for registration has expired, been deleted, or does not have correct permissions in the tenant. (Exam clue: Commonly appears in troubleshooting questions where an admin reuses an old service principal, requiring re-creation or consent update.)
- **Kubernetes cluster connection lost** — symptom: Arc-enabled Kubernetes cluster shows 'Offline' in portal, and 'az arc connect' commands fail with 'dial tcp' error.. Firewall rules blocking outbound traffic to Azure endpoints (e.g., management.azure.com) or cluster proxy configuration issues. (Exam clue: Exams test network requirements for Arc, including required URLs and ports for hybrid connectivity.)
- **Run command fails with access denied** — symptom: Error 'Unauthorized' when using 'az connectedmachine run-command invoke'.. The user or service principal lacks the 'Microsoft.HybridCompute/machines/runCommands/action' permission on the resource. (Exam clue: Tests RBAC and the specific custom role needed for remote commands, distinct from VM run command permissions.)
- **Patch assessment returns no data** — symptom: Patch assessment shows 'NotAvailable' or 'Failed' for an Arc-enabled server.. The Windows Update service (or equivalent on Linux) is disabled, or the Azure Monitor agent is not properly installed for update management. (Exam clue: Appears in update management questions, requiring knowledge of dependencies like the Log Analytics agent and Update Management solution.)

## Memory tip

Arc extends the Azure arm to any farm: Arc extends Azure Resource Manager to any infrastructure, anywhere.

## FAQ

**Is Azure Arc a free service?**

Azure Arc itself does not incur additional costs for basic management features like Resource Manager, Azure Policy, and tagging. However, using services like Azure Monitor, Azure Security Center, or Azure Update Management on Arc-enabled machines will incur charges.

**Does Azure Arc work with AWS and Google Cloud?**

Yes. You can install the Azure Connected Machine agent on servers running in AWS EC2 or Google Compute Engine, and you can connect Kubernetes clusters in those clouds using Azure Arc-enabled Kubernetes. This allows centralized management from Azure.

**Can I use Azure Arc without internet connectivity?**

No. Azure Arc requires periodic outbound HTTPS connections to Azure. For environments without internet, consider Azure Stack HCI or a private Azure Arc solution using Azure Stack, though that requires additional infrastructure.

**What happens if I uninstall the Azure Connected Machine agent?**

The resource in Azure becomes disconnected and eventually may be removed. It is best practice to run the azcmagent disconnect command before uninstalling to properly clean up the registration in Azure Resource Manager.

**Does Azure Arc move my data to Azure?**

No. Azure Arc only sends metadata about your resources, such as operating system version, disk usage, and installed software. Your actual data remains on your own infrastructure.

**What operating systems does Azure Arc support for servers?**

Azure Arc supports Windows Server 2012 R2 and later, and multiple Linux distributions including Ubuntu, CentOS, RHEL, SUSE Linux Enterprise Server, and Debian. The full list is in the official documentation.

**Can I manage Azure Arc-enabled servers with Azure Backup?**

Azure Arc itself does not provide backup. However, you can use Azure Backup on Arc-enabled servers by installing the Azure Backup extension. Note that Azure Backup is a separate service with its own licensing.

**What is the difference between Azure Arc and Azure Lighthouse?**

Azure Lighthouse enables service providers to manage multiple Azure tenants. Azure Arc enables management of non-Azure resources. They are complementary: you could use Azure Arc to manage a customer’s on-premises servers from the service provider’s tenant.

## Summary

Azure Arc is a transformative service for IT professionals managing hybrid, multicloud, and edge environments. It solves the fundamental problem of fragmented management by extending Azure’s control plane to any infrastructure. With Azure Arc, you can manage servers, Kubernetes clusters, and SQL databases running in your data center, in other clouds, or at the edge, all from the Azure portal.



Understanding Azure Arc is important for certification exams like AZ-900 and AZ-104, where it appears in scenario-based questions about hybrid management, policy enforcement, and monitoring. Key exam takeaways include: Azure Arc does not migrate workloads, it requires outbound internet connectivity, it supports multiple resource types, and it is not a replacement for backup or disaster recovery services. The most common exam traps confuse Azure Arc with Azure Stack or imply it provides migration capabilities.



For your career, Azure Arc represents a shift toward unified management. As organizations continue to diversify their infrastructure, skills in hybrid management tools like Azure Arc become essential. It reduces operational complexity, improves security consistency, and enables centralized governance without requiring full cloud migration. Mastery of Azure Arc positions you as a versatile IT professional capable of managing modern, distributed environments.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/azure-arc