Home › Articles › Azure Arc
Azure Arc

Azure Arc-Enabled Servers: Governance at Scale Across Hybrid Environments

👤 Mohamed Dyabi | 📅 October 2024 | ⏰ 11 min read
← All Articles

🌏 The Arc Governance Model

Azure Arc transforms how organizations govern hybrid server estates by projecting on-premises and multi-cloud servers into Azure as first-class resources. Once a server is Arc-connected, it receives an ARM resource ID and becomes subject to the full Azure governance stack: RBAC, Azure Policy, Microsoft Defender for Cloud, Azure Monitor, and Azure Resource Graph.

The practical impact: a single governance policy can enforce the same security baseline on a server in your Frankfurt datacenter, a VM in your AWS environment, and an Azure VM in West Europe simultaneously — from one policy assignment in the Azure portal.

🚀 Server Onboarding Strategy

Successful large-scale Arc onboarding requires a phased approach. The most common mistake is attempting to onboard all servers simultaneously without validating the process on a representative sample first.

Recommended phases:

  1. Pilot (5–10 servers): Validate network connectivity, firewall rules, proxy configuration, and the complete onboarding/management lifecycle
  2. Wave 1 — Non-production (100–500 servers): Validate at scale, identify environment-specific issues, tune Data Collection Rules
  3. Wave 2 — Production (all remaining): Full deployment with monitoring and rollback procedures in place
💡

Proxy environments: Most EMEA enterprise environments route internet traffic through a proxy. The Arc agent must be configured with proxy settings before attempting registration. Use azcmagent config set proxy.url "http://proxy:port" before running the connect command.

📋 Policy at Scale

Assign policies at the Management Group level to ensure coverage across subscriptions as your Arc resource estate grows. The recommended policy initiative stack for Arc-enabled servers:

Azure CLI — Assign Security Benchmark initiative to Management Group
az policy assignment create   --name "arc-security-baseline"   --scope "/providers/Microsoft.Management/managementGroups/your-mg-id"   --policy-set-definition "/providers/Microsoft.Authorization/policySetDefinitions/1f3afdf9-d0c9-4c3d-847f-89da613e70a8"   --location "westeurope"   --identity-type SystemAssigned   --display-name "Arc Servers - Azure Security Benchmark"

🛡️ Defender for Cloud

Enable Microsoft Defender for Servers Plan 2 on all subscriptions containing Arc resources. At scale, use the Defender for Cloud environment settings to enable plans at the management group level — new subscriptions automatically inherit the Defender configuration.

Key Defender capabilities for Arc servers that are often underutilized:

  • Regulatory compliance dashboard: Tracks compliance against PCI-DSS, ISO 27001, SOC 2, and others across your entire Arc estate
  • Attack path analysis: Identifies exploitable attack paths that traverse on-premises and cloud resources
  • Agentless scanning: No agent required for vulnerability assessment — uses cloud APIs to assess the server state

🔁 Update Manager

Azure Update Manager provides unified patch management across Arc servers with flexible scheduling, pre/post patching scripts, and compliance reporting. For EMEA environments with maintenance window constraints:

PowerShell — Create a maintenance schedule for EMEA servers
New-AzMaintenanceConfiguration `
  -ResourceGroupName "rg-maintenance" `
  -Name "EMEA-Saturday-Patching" `
  -MaintenanceScope "InGuestPatch" `
  -Location "westeurope" `
  -StartDateTime "2025-01-04 02:00" `
  -Duration "03:00" `
  -RecurEvery "Week Saturday" `
  -TimeZone "W. Europe Standard Time" `
  -InstallPatchRebootSetting "IfRequired"

📊 Resource Graph Queries

Azure Resource Graph enables powerful inventory and compliance queries across your entire Arc estate. Essential queries for hybrid environments:

KQL — Find all Arc servers missing Defender extension
resources
| where type == "microsoft.hybridcompute/machines"
| where properties.status == "Connected"
| extend extensions = properties.extensions
| where not(extensions has "MDE.Windows")
| project name, resourceGroup, location, 
    os = tostring(properties.osName),
    lastHeartbeat = tostring(properties.lastStatusChange)
| order by lastHeartbeat desc
KQL — Arc server compliance summary by OS version
resources
| where type == "microsoft.hybridcompute/machines"
| extend osVersion = tostring(properties.osVersion)
| extend status = tostring(properties.status)
| summarize count() by osVersion, status
| order by count_ desc

⚙️ Automation at Scale

For hybrid estates of 500+ servers, manual remediation of policy non-compliance is impractical. Use Azure Policy remediation tasks combined with Azure Automation runbooks triggered by Event Grid alerts for automated, audited remediation workflows.

The pattern for automated compliance:

  1. Policy evaluates Arc server → marks as non-compliant
  2. Defender for Cloud alert fires → triggers Event Grid event
  3. Event Grid subscription invokes Logic App
  4. Logic App runs Azure Automation runbook via Hybrid Runbook Worker on the affected server
  5. Remediation action executed locally on the server, result logged to Log Analytics
  6. Policy re-evaluation confirms compliance within 24 hours
Azure ArcGovernanceAzure PolicyDefender for CloudUpdate ManagerResource GraphAutomation