Azure Arc
Azure Arc represents servers, Kubernetes clusters, SQL Server instances and VMware or SCVMM estates that run outside Azure as Azure resources, so they can be inventoried, governed, secured and updated with Azure tools. Core inventory and access control are free; services you add on are billed.1
Also known as Azure Arc-enabled servers, Azure Arc-enabled Kubernetes, Azure Arc-enabled data services, Azure Arc-enabled SQL Server
- Intended for
- Infrastructure and operations teams, Security and compliance teams, Platform teams running Kubernetes outside Azure, Database administrators running SQL Server outside Azure
- Runs on
- On-premises datacenters, Edge sites, Other public clouds such as AWS and Google Cloud, VMware vSphere and System Center Virtual Machine Manager estates, Azure Local
At a glance
- What is it?
- Azure Arc is Microsoft's management layer for resources outside Azure. It projects physical servers, virtual machines, Kubernetes clusters and databases running on-premises, at the edge or in other clouds into Azure Resource Manager, where each one gets an Azure resource ID and can sit in resource groups, carry tags and be governed like a native Azure resource. Microsoft describes Arc as a key part of its adaptive cloud approach, and it is the control plane for Azure Local and the base layer that Azure IoT Operations runs on.123
- What does it do?
- For servers, the Azure Connected Machine agent connects Windows and Linux machines so you can apply Azure Policy machine configuration, update them with Azure Update Manager, monitor them with Azure Monitor and VM insights, protect them with Microsoft Defender for Cloud and Defender for Endpoint, collect events into Microsoft Sentinel and run automation and VM extensions. For Kubernetes, Arc agents attach any CNCF-certified cluster for inventory, GitOps with Flux v2 or Argo CD, policy, monitoring, Defender for Containers, Azure RBAC and cluster extensions such as Azure Machine Learning. Arc also manages VM lifecycle on Azure Local, VMware vCenter and SCVMM, extends Azure services to SQL Server, and runs Azure SQL Managed Instance on any Kubernetes.45
- Who needs it?
- Organizations with servers and clusters spread across datacenters, edge sites and several clouds that want one inventory, one policy model and one set of security and update tools. It suits teams that already use Azure governance and want to extend it to non-Azure machines, VMware customers who want self-service VM operations through Azure RBAC, and service providers who manage customer estates through Azure Lighthouse.4
- What does it need?
- An Azure subscription and permission to register resource providers and onboard resources
- Outbound network access from machines or clusters to the required Azure endpoints (Arc gateway can reduce the endpoint list)
- Supported operating systems for the Connected Machine agent, or a CNCF-certified Kubernetes cluster
- A chosen Azure region for resource metadata, considering data residency
- Budget for add-on services (for example Defender for Cloud, Azure Monitor) you plan to enable
- What it is not
- Arc does not move workloads into Azure and does not host anything by itself: machines and clusters keep running where they are. It is not designed or supported for managing VMs that already run in Azure. Arc is not free end to end: inventory, tags, Resource Graph, RBAC and templates cost nothing extra, but services such as Defender for Cloud or Azure Monitor are billed at their normal prices. Indirectly connected mode was retired in September 2025, so plans should assume a connection to Azure.14
Availability and licensing. Generally available. Checked 26 October 2026: Arc control plane features (management groups and tags, Azure Resource Graph, Azure RBAC, templates and extensions) are offered at no extra cost, as are inventory and VM lifecycle operations for Arc-enabled VMware vSphere and SCVMM. Azure services used on Arc resources, such as Defender for Cloud or Azure Monitor, are charged at their normal prices. Indirectly connected mode was retired in September 2025.6
The problem it solves
Most enterprises run a mix of on-premises servers, VMware estates, edge devices, Kubernetes clusters and workloads in more than one cloud. Each environment brings its own tools for inventory, patching, security and access, which makes it hard to know what exists, whether it is compliant and who can change it.
Arc gives those resources an identity in Azure Resource Manager so the same policy, RBAC, monitoring, security and update services can be applied across the whole estate.
How it works
Arc works through agents that open an outbound connection to Azure:
- Servers: the Azure Connected Machine agent registers each machine and sends a heartbeat every five minutes. A machine is marked Disconnected after 15 to 30 minutes without a heartbeat and may become Expired after 45 days disconnected.
- Kubernetes: Arc agents deployed into the cluster create a secure outbound connection; the cluster appears as an Azure resource and can receive cluster extensions.
- Custom locations: an abstraction on top of Arc-enabled Kubernetes that lets you target the cluster when deploying Azure services such as Azure Arc-enabled data services, Azure Container Apps on Azure Arc and Event Grid on Kubernetes.
Once connected, resources are managed through the Azure portal, CLI, PowerShell or REST API, and data such as instance metadata is stored in the Azure region you chose at registration.145
Diagram as a list
Copilot & business apps
- Azure portal, CLI, PowerShell, RESTSingle place to view and operate Arc-enabled resourcesConnects to Azure Resource Manager
Data & analytics
- Azure Monitor and Log AnalyticsPerformance data, logs and VM insights
Security, identity & governance
- Azure Policy and Azure Update ManagerAudit configuration and patch hybrid machines
- Microsoft Defender for Cloud and Microsoft SentinelThreat protection and security event collection
Cloud & hybrid infrastructure
- Azure Resource ManagerHolds the Azure resource representation of each connected machine or cluster
- Azure Connected Machine agentRuns on each Windows or Linux server and connects it outbound to AzureConnects to Azure Resource Manager
- Arc agents in Kubernetes clustersConnect CNCF-certified clusters outbound and host cluster extensions
- Custom locationsTargets for deploying Azure services onto Arc-enabled clusters
- Arc VM management for Azure Local, VMware vCenter, SCVMMVM lifecycle operations from Azure with RBACConnects to Azure Resource Manager
Capabilities
Arc-enabled servers4
Windows and Linux machines outside Azure get an Azure resource ID through the Connected Machine agent.
Why it matters: One inventory and management model for on-premises and multicloud machines.
Limits: Not supported for VMs that run in Azure; machines disconnected for 45 days may expire and need reconnecting.
Governance and updates for hybrid machines4
Azure Policy machine configuration, Azure Update Manager, Azure Automation and VM extensions on Arc-enabled servers.
Why it matters: Audit settings and patch operating systems the same way across environments.
Limits: Each service is priced separately, for example machine configuration under Azure Policy pricing.
Security monitoring4
Defender for Endpoint through Microsoft Defender for Cloud, and Microsoft Sentinel event collection for Arc-enabled servers.
Why it matters: Non-Azure servers feed the same detection and response tools as Azure resources.
Limits: Defender for Cloud and Sentinel charges apply.
Arc-enabled Kubernetes5
Attach any CNCF-certified cluster, including on AWS, GCP, VMware vSphere or Azure Local, and manage it with GitOps, Azure Policy, Azure Monitor and Defender for Containers.
Why it matters: Consistent configuration and compliance for clusters wherever they run.
Limits: Add-on services on the cluster are billed at their own prices.
VM lifecycle on Azure Local, VMware and SCVMM1
Create, resize, delete and power-cycle VMs from Azure, with self-service delegated through Azure RBAC.
Why it matters: Application teams can manage VMs on-premises without direct hypervisor access.
Limits: Requires the corresponding Arc-enabled VMware vSphere, SCVMM or Azure Local integration.
Azure services on your clusters1
Custom locations let you deploy Azure Arc-enabled data services (Azure SQL Managed Instance), Container Apps on Azure Arc and Event Grid on Kubernetes onto Arc-enabled clusters.
Why it matters: Run selected Azure services close to data or under local residency rules.
Limits: Only the listed services are offered this way; indirectly connected mode was retired in September 2025.
Practical use cases
Security teams cannot see or protect servers that run on-premises and in another cloud.
- Approach
- Onboard those servers to Arc and enable Defender for Cloud and Sentinel collection.
- Role of Azure Arc
- Arc gives the servers Azure identities so security services can cover them.
- Data, infrastructure and skills
- Connected Machine agent on each server, Defender for Cloud and Sentinel licensing.
- Type of benefit
- Visibility and threat detection
- Caveats
- Defender and Sentinel are billed separately.
- First step
- Onboard a pilot group and confirm alerts reach Defender for Cloud.
Kubernetes clusters in factories and other clouds drift from the approved configuration.
- Approach
- Attach the clusters with Arc and drive configuration from Git with Flux v2 plus Azure Policy for Kubernetes.
- Role of Azure Arc
- Arc connects clusters to Azure for GitOps and policy.
- Data, infrastructure and skills
- CNCF-certified clusters with outbound connectivity, a Git repository.
- Type of benefit
- Consistency and compliance
- Caveats
- Clusters need connectivity to Azure; indirectly connected mode was retired in September 2025.
- First step
- Attach one cluster and apply a Flux configuration from a test repository.
Edge sites need a managed Kubernetes base for industrial data services.
- Approach
- Arc-enable the edge cluster and deploy Azure IoT Operations onto it.
- Role of Azure Arc
- Arc is the management plane that IoT Operations depends on.
- Data, infrastructure and skills
- A supported Kubernetes distribution at the site.
- Type of benefit
- Central management of distributed sites
- Caveats
- IoT Operations has its own hardware and permission requirements.
- First step
- Arc-enable a test cluster and run the IoT Operations quickstart.
Works with
Optional integration
- Azure IoT OperationsAzure IoT Operations runs on Azure Arc-enabled Kubernetes clusters and is managed from the cloud through Arc.
- Azure Kubernetes Service (AKS)Arc-enabled clusters are listed alongside AKS clusters, and AKS Hybrid and Edge options connect to the same Azure management plane.
- Microsoft SentinelArc-enabled servers can send security events to Microsoft Sentinel.
- Azure Machine LearningAzure Machine Learning can deploy workloads to Arc-enabled Kubernetes clusters.
- Azure Container AppsContainer Apps on Azure Arc can be deployed to custom locations on Arc-enabled clusters.
Same family
- Azure LocalAzure Local uses Azure Arc as its unifying control plane; both belong to Microsoft's adaptive cloud approach.
Required by
- Azure LocalAzure Local uses Azure Arc as its unifying control plane.
- Azure IoT OperationsIoT Operations runs on Azure Arc-enabled Kubernetes clusters and is managed through Arc.
Optional integration for
- Azure Kubernetes Service (AKS)Arc-enabled Kubernetes clusters appear alongside AKS clusters for inventory, GitOps, policy and monitoring.
- Azure Machine LearningHybrid training and inferencing run on Azure Arc-enabled Kubernetes.
- Azure Container AppsContainer Apps can be deployed as a cluster extension on Azure Arc-enabled Kubernetes through custom locations.
Relationship labels follow Microsoft's documentation. "Alternative approaches" does not mean one is better: each profile says when it fits.
Getting started
Choose the right Arc service
Use Microsoft's guidance on choosing an Arc service for machines to decide between Arc-enabled servers, Arc-enabled VMware vSphere or SCVMM, and Azure Local.
Check: Each environment in your estate is mapped to one onboarding path.
Connect a pilot server
Generate an installation script in the portal for the Azure region you want and install the Connected Machine agent on one Windows and one Linux machine.
Check: Both machines appear under Azure Arc, Machines, with status Connected.
Apply governance and updates
Assign an Azure Policy machine configuration and schedule updates with Azure Update Manager on the pilot machines.
Check: Compliance results and update assessments show for both machines.
Attach a Kubernetes cluster
Deploy Arc agents to a CNCF-certified cluster and set up a GitOps configuration with Flux v2.
Check: The cluster shows as a connected resource and the GitOps configuration reports as compliant.
Official resources
Deciding whether you need it?
Three free tools apply Microsoft's own published guidance to your situation, and say when Azure Arc or any new technology is not needed.
Sources
Each statement above links to the source it comes from. Labels say who reported it.
- Azure Arc overview (opens in a new tab)
- What is Azure Local? Overview and key benefits (opens in a new tab)
- What is Azure IoT Operations? (opens in a new tab)
- Azure Arc-enabled servers overview (opens in a new tab)
- Overview of Azure Arc-enabled Kubernetes (opens in a new tab)
- Azure Arc product page (opens in a new tab)
- What is AKS Hybrid and Edge? (opens in a new tab)
Thank you. Your correction was sent.
The editors check it against the sources. If you left an email address, they may reply about it.