6.1 Azure Arc-Enabled Servers Architecture & Onboarding
Key Takeaways
- Azure Arc-enabled servers project physical and virtual non-Azure Windows and Linux servers into Azure Resource Manager (ARM) as Microsoft.HybridCompute/machines, granting them first-class Azure identities and governance capabilities.
- The Azure Connected Machine Agent operates through three core operating system services: Hybrid Instance Metadata Service (himds) for identity and heartbeats, Guest Configuration Service (gc_service) for policy evaluation, and Extension Manager (extmd) for VM extension lifecycle management.
- Network communication requires only outbound HTTPS connectivity over TCP port 443 to Azure management endpoints; no inbound firewall ports, public IP addresses, or incoming network tunnels are necessary.
- Enterprise-scale onboarding utilizes an Entra ID Service Principal assigned the least-privilege 'Azure Connected Machine Onboarding' RBAC role, distributed via Active Directory Group Policy startup scripts or Microsoft Configuration Manager.
- Local agent configuration, connectivity diagnostics, logs collection, and lifecycle operations are managed using the azcmagent command-line interface (show, check, config, disconnect, and logs).
Azure Arc-Enabled Servers Architecture & Onboarding
Modern enterprise IT environments rarely reside entirely within a single cloud boundary. Organizations routinely operate heterogeneous fleets of Windows Server and Linux virtual machines running across on-premises hypervisors (VMware vSphere, Microsoft Hyper-V), physical bare-metal hardware, and third-party cloud platforms (AWS, Google Cloud). Azure Arc-enabled servers bridges this architectural divide by projecting non-Azure physical and virtual servers directly into Azure Resource Manager (ARM) as first-class resources under the Microsoft.HybridCompute/machines resource provider namespace.
Once projected into ARM, non-Azure servers gain native Azure capabilities: they can be organized into Subscriptions, Resource Groups, and Management Groups; tagged with corporate metadata; secured with Azure Role-Based Access Control (Azure RBAC); governed through Azure Policy and Azure Machine Configuration; monitored using Azure Monitor; and patched via Azure Update Manager—all without migrating the underlying operating system or storage volumes into the cloud.
1. Azure Arc-Enabled Servers Core Architecture
When a server is onboarded to Azure Arc, the installation of the Azure Connected Machine Agent creates a digital representation of the host within Azure Resource Manager. The physical or virtual machine remains in its existing physical datacenter or host environment while establishing an outbound, cryptographically authenticated control-plane connection to Azure.
+-----------------------------------------------------------------------------------------+
| AZURE ARC-ENABLED SERVERS CONTROL PLANE ARCHITECTURE |
| |
| [ON-PREMISES / MULTICLOUD INFRASTRUCTURE] [AZURE RESOURCE MANAGER] |
| +---------------------------------------+ +----------------------------+ |
| | Windows Server 2012 R2 - 2025 Host | | Azure Subscription | |
| | | | - Resource Group | |
| | +-----------------------------------+ | | - Resource Tags | |
| | | Azure Connected Machine Agent | | | - Azure RBAC Access | |
| | | | | +----------------------------+ |
| | | [himds] Identity & Heartbeats | | ^ |
| | | [gc_svc] Machine Configuration | | | |
| | | [extmd] Extension Manager | |=== Outbound HTTPS 443 ====>| |
| | +-----------------------------------+ | (No Inbound Ports) v |
| | | +----------------------------+ |
| | [Guest OS / Workloads / Services] | | Microsoft.HybridCompute | |
| | - Active Directory / Hyper-V / IIS | | /machines Projection | |
| +---------------------------------------+ +----------------------------+ |
+-----------------------------------------------------------------------------------------+
The Projection Model vs Virtualization Migration
It is critical to distinguish Azure Arc from cloud migration solutions such as Azure Migrate. Azure Arc does not relocate the virtual disk images (VHD/VHDX/VMDK) or modify the hypervisor execution engine. The server continues executing locally. Azure Arc projects only the management metadata and control plane into Azure, allowing centralized governance across hybrid topologies.
2. Connected Machine Agent Architecture & OS Services
The Azure Connected Machine Agent is composed of three primary background operating system services working in concert:
+-----------------------------------------------------------------------------------------+
| AZURE CONNECTED MACHINE AGENT DAEMON STACK |
| |
| +-----------------------------------------------------------------------------------+ |
| | Hybrid Instance Metadata Service (himds / himds.exe) | |
| | - Manages local IMDS REST endpoint: http://localhost:40342/metadata/... | |
| | - Generates & rotates Azure Entra ID System-Assigned Managed Identity | |
| | - Transmits 5-minute health heartbeats to Azure Hybrid Instance Service | |
| | - Collects host hardware, OS build, FQDN, and network adapter metadata | |
| +-----------------------------------------------------------------------------------+ |
| | |
| +-----------------------------------------------------------------------------------+ |
| | Guest Configuration Service (gc_service / gc_agent) | |
| | - Executes in-guest compliance audits and Desired State Configuration (DSC v3) | |
| | - Evaluates OS-level security baselines assigned by Azure Policy | |
| | - Reports in-guest compliance JSON telemetry back to ARM | |
| +-----------------------------------------------------------------------------------+ |
| | |
| +-----------------------------------------------------------------------------------+ |
| | Extension Manager Service (extmd / ext_mgr) | |
| | - Coordinates lifecycle of Azure VM Extensions (AMA, MDE, Custom Script, KeyVault) | |
| | - Downloads, installs, configures, health-monitors, and uninstalls extensions | |
| +-----------------------------------------------------------------------------------+ |
+-----------------------------------------------------------------------------------------+
Detailed Service Functions:
- Hybrid Instance Metadata Service (
himds/himds.exe):- Serves as the identity and heartbeat engine. It exposes a local Instance Metadata Service (IMDS) endpoint accessible only via loopback at
http://localhost:40342/metadata/identity/oauth2/token. - Maintains the machine's Microsoft Entra ID System-Assigned Managed Identity. Local applications and extensions can acquire OAuth 2.0 tokens from this local endpoint to authenticate directly to Azure services (e.g., Azure Key Vault, Azure Storage) without embedding credentials in configuration files.
- Transmits a health heartbeat to Azure every 5 minutes. If Azure fails to receive a heartbeat for more than 15 minutes, the machine's status in the Azure portal transitions from
ConnectedtoDisconnected.
- Serves as the identity and heartbeat engine. It exposes a local Instance Metadata Service (IMDS) endpoint accessible only via loopback at
- Guest Configuration Service (
gc_service/gc_agent):- Runs an embedded, sandboxed PowerShell Desired State Configuration (DSC v3) execution engine.
- Downloads and executes Machine Configuration policy packages assigned to the machine to audit or enforce OS-level security baselines, registry settings, and user rights assignments.
- Extension Manager Service (
extmd/ext_mgr):- Implements the VM Extension framework on non-Azure servers. It handles requests from ARM to install, configure, upgrade, and delete extension binaries such as the Azure Monitor Agent (AMA), Microsoft Defender for Endpoint (MDE), Azure Key Vault extension, and Custom Script Extension.
3. Onboarding Prerequisites & Network Architecture
To onboard a server to Azure Arc, the host operating system and network routing path must satisfy strict architectural requirements.
Supported Operating Systems
- Windows Server: Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 (Standard, Datacenter, and Server Core editions).
- Linux: Red Hat Enterprise Linux (RHEL) 7/8/9, CentOS 7, Oracle Linux 7/8/9, SUSE Linux Enterprise Server (SLES) 12/15, Ubuntu 18.04/20.04/22.04/24.04 LTS, Debian 10/11/12, Rocky Linux, and AlmaLinux.
- Local Privileges: Requires administrative elevation (
BUILTIN\Administratorson Windows;rooton Linux).
Network Connectivity & Security Baseline
The Azure Connected Machine Agent communicates exclusively outbound over standard HTTPS (TCP Port 443). It does not require any inbound ports to be opened on perimeter firewalls or local host firewalls, nor does it require a public IP address.
+-----------------------------------------------------------------------------------------+
| AZURE ARC MANDATORY OUTBOUND HTTPS ENDPOINTS |
| |
| ENDPOINT URL PATTERN PURPOSE |
| ------------------------------------+-------------------------------------------------|
| management.azure.com | Azure Resource Manager control plane operations |
| login.microsoftonline.com | Entra ID authentication and token issuance |
| pas.windows.net | Hybrid Instance Service token authority |
| *.his.arc.azure.com | Hybrid Instance Metadata Service heartbeats |
| guestconfiguration.azure.com | Azure Machine Configuration package downloads |
| *.servicebus.windows.net | Notification channel and Run Command messaging |
| *.blob.core.windows.net | VM extension binaries and package storage |
+-----------------------------------------------------------------------------------------+
Proxy and SSL Inspection Rules
If the on-premises environment routes outbound traffic through an enterprise HTTP/HTTPS proxy server, the agent must be configured with proxy connection parameters. The agent supports both unauthenticated proxies and proxies using integrated Windows authentication.
# Configure proxy settings directly via the azcmagent CLI
azcmagent config set proxy.url "http://proxy.contoso.com:8080"
# Configure proxy bypass for internal local endpoints
azcmagent config set proxy.nonproxy "localhost,127.0.0.1,*.internal.contoso.com"
# Alternative: Configure system-wide environment variable
[System.Environment]::SetEnvironmentVariable('https_proxy', 'http://proxy.contoso.com:8080', [System.EnvironmentVariableTarget]::Machine)
[!CAUTION] SSL/TLS Inspection & Certificate Termination: Azure Arc agent communication utilizes mutual Transport Layer Security (mTLS) with pinned Microsoft certificates. If an enterprise perimeter proxy performs SSL Decryption / TLS Inspection (Man-in-the-Middle), the agent will reject the intercepted proxy certificate, terminating connection attempts. Administrators must create an SSL inspection bypass rule for all Azure Arc domain endpoints.
Azure Arc Private Link Scope (AMPLS)
For high-security environments where servers must not route traffic across the public Internet, organizations can deploy an Azure Arc Private Link Scope (AMPLS). This architecture routes all agent heartbeats, extension downloads, and metadata over an Azure ExpressRoute or Site-to-Site VPN directly into private endpoints hosted within an Azure Virtual Network (VNet).
4. Enterprise Onboarding Methods: Interactive vs Service Principal at Scale
Microsoft provides multiple onboarding workflows designed for different deployment scales.
+-----------------------------------------------------------------------------------------+
| ONBOARDING METHODOLOGY SELECTION |
| |
| CRITERIA INTERACTIVE SCRIPT SERVICE PRINCIPAL AT SCALE |
| --------------------+-----------------------------+-----------------------------------|
| Target Scale | 1 to 5 machines (PoC / Dev) | Hundreds to Thousands of servers |
| Authentication | Interactive browser / code | Entra ID App (Secret or Cert) |
| User Interaction | Required (MFA / Browser) | Zero interaction (Fully automated)|
| Deployment Vehicle | Manual PowerShell execution | Group Policy, MECM, Ansible, WAC |
| Required RBAC Role | Azure Connected Machine | Azure Connected Machine |
| | Onboarding (or Contributor) | Onboarding |
+-----------------------------------------------------------------------------------------+
Method 1: Interactive Onboarding (Single-Server Evaluation)
In the Azure Portal, navigating to Azure Arc > Servers > Add allows generating a PowerShell script for a single server. Executing the script downloads AzureConnectedMachineAgent.msi, installs the binaries, and initiates an interactive authentication challenge prompting the administrator to authenticate via https://microsoft.com/devicelogin using their Entra ID administrative credentials.
Method 2: Automated Onboarding at Scale via Entra ID Service Principal
For production deployments across hundreds of physical or virtual servers, administrators generate an onboarding script backed by a Microsoft Entra ID Service Principal.
Step 1: Assign the Least-Privilege RBAC Role
The Service Principal requires only the Azure Connected Machine Onboarding built-in role scoped to the target Resource Group or Subscription.
[!IMPORTANT] Least-Privilege Principle (
Azure Connected Machine Onboarding): TheAzure Connected Machine Onboardingrole permits the Service Principal to register and onboardMicrosoft.HybridCompute/machinesresources into Azure. It does not permit reading data, deleting servers, modifying Azure policies, or assigning roles, preventing privilege escalation if the onboarding secret is intercepted.
Step 2: Execute Unattended Onboarding Script
# Download and install the Azure Connected Machine Agent MSI silently
$AgentDownloadUrl = "https://aka.ms/AzureConnectedMachineAgent"
$InstallerPath = "$env:TEMP\AzureConnectedMachineAgent.msi"
Invoke-WebRequest -Uri $AgentDownloadUrl -OutFile $InstallerPath -UseBasicParsing
Start-Process -FilePath "msiexec.exe" -ArgumentList "/i `"$InstallerPath`" /qn /l*v `"$env:TEMP\ArcAgentInstall.log`"" -Wait
# Connect the agent to Azure using the Service Principal
$TenantId = "72f988bf-86f1-41af-91ab-2d7cd011db47"
$SubscriptionId = "a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d"
$ResourceGroup = "rg-hybrid-infrastructure"
$Location = "eastus"
$AppId = "d9e8f7a6-b5c4-3d2e-1f0a-9b8c7d6e5f4a"
$AppSecret = "Secr3t~Value~P@ssw0rd2026!"
& "$env:ProgramFiles\AzureConnectedMachineAgent\azcmagent.exe" connect `
--service-principal-id $AppId `
--service-principal-secret $AppSecret `
--tenant-id $TenantId `
--subscription-id $SubscriptionId `
--resource-group $ResourceGroup `
--location $Location `
--tags "Datacenter=Chicago,Environment=Production,Workload=ActiveDirectory" `
--correlation-id (New-Guid).ToString()
Method 3: Active Directory Group Policy (GPO) Distribution
To onboard entire Active Directory Organizational Units (OUs) without touching individual machines:
- Create a network share containing
AzureConnectedMachineAgent.msiand a locked-down PowerShell script containing theazcmagent connectcommand. - Create an Active Directory Group Policy Object (GPO) linked to the target OU.
- Configure a Startup Script under
Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown) > Startupor deploy a Scheduled Task running under theNT AUTHORITY\SYSTEMcontext. - When domain-joined servers reboot, the agent installs silently, authenticates via the Service Principal, applies tags, and registers the server in ARM.
5. Agent Administration & CLI Reference (azcmagent)
The azcmagent command-line utility provides complete lifecycle and diagnostic capabilities for the Connected Machine Agent.
Core azcmagent CLI Commands
| Command | Primary Function | Exam & Operational Use Case |
|---|---|---|
azcmagent show | Displays agent status, connection state, Azure resource ID, tenant ID, and proxy settings | Verifying successful onboarding and checking whether the host is Connected or Disconnected |
azcmagent check | Validates end-to-end network reachability to all mandatory Azure endpoints and tests proxy authentication | Troubleshooting firewall blocks, DNS resolution failures, and proxy routing rules |
azcmagent config get/set | Queries or modifies local agent configuration properties (e.g. proxy.url, proxy.nonproxy) | Configuring proxy URLs or adjusting local agent parameters post-installation |
azcmagent disconnect | Removes the server registration from Azure Arc and revokes the local managed identity certificate | Gracefully unlinking a decommissioned server before removing local agent binaries |
azcmagent logs | Collects all local diagnostic logs into a consolidated .zip archive | Capturing error logs (himds.log, gc_agent.log) for Microsoft Support escalations |
Diagnostic Workflow: Troubleshooting a Disconnected Agent
# Step 1: Inspect local agent state and connection status
azcmagent show
# Sample Output:
# Resource Name : SRV-APP-01
# Resource Group : rg-hybrid-infrastructure
# Subscription ID : a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d
# Tenant ID : 72f988bf-86f1-41af-91ab-2d7cd011db47
# VM ID : 12345678-abcd-1234-abcd-1234567890ab
# Agent Status : Disconnected
# Agent Version : 1.42.02891.1345
# HTTPS Proxy : http://proxy.contoso.com:8080
# Step 2: Execute network connectivity and endpoint validation check
azcmagent check
# Step 3: If connectivity succeeds but agent remains disconnected, gather logs
azcmagent logs
# Generated: C:\ProgramData\AzureConnectedMachineAgent\Log\azcmagent_logs_20260822_143000.zip
[!TIP] Exam Trap: Disconnecting vs Deleting in Azure: Running
azcmagent disconnectfrom the local guest server removes the local connection certificate and sets the status to disconnected. However, it does not delete theMicrosoft.HybridCompute/machinesresource representation in Azure ARM. To cleanly purge the server, an administrator must both executeazcmagent disconnectlocally and delete the resource object in the Azure Portal, Azure CLI (az resource delete), or Azure PowerShell (Remove-AzConnectedMachine).
An infrastructure security architect is creating a Microsoft Entra ID Service Principal to automate the onboarding of 500 on-premises Windows Server instances to Azure Arc across multiple data centers. Applying the principle of least privilege, which built-in Role-Based Access Control (RBAC) role should be assigned to this Service Principal on the target Resource Group?
A network security administrator is configuring corporate perimeter firewalls to permit Azure Arc-enabled server communication. Which firewall rule configuration satisfies the connectivity requirements of the Azure Connected Machine Agent?
Which operating system service component of the Azure Connected Machine Agent is responsible for exposing the local Instance Metadata Service (IMDS) endpoint on port 40342 and generating the server's Entra ID System-Assigned Managed Identity tokens?
An administrator notices that several newly onboarded on-premises Windows Servers are displaying a status of 'Disconnected' in the Azure Portal. You are logged into one of the affected servers locally via PowerShell. Which command should you execute first to validate reachability to all mandatory Azure Arc cloud endpoints?