6.2 Azure Machine Configuration & VM Extensions on Arc Servers

Azure Machine Configuration & VM Extensions on Arc Servers

Projecting physical and virtual servers into Azure Resource Manager via Azure Arc is only the foundational step. Realizing true hybrid governance requires the ability to audit operating system configurations, enforce standardized security baselines, install management tooling, and execute remote administrative tasks without depending on legacy on-premises management infrastructure.

Azure Arc fulfills these operational requirements through two powerful capabilities:

1. Azure Machine Configuration (formerly Azure Policy Guest Configuration): A declarative, policy-driven engine that audits and enforces in-guest OS settings using PowerShell Desired State Configuration (DSC v3).
2. Azure VM Extensions & Run Command: A modular software extension framework that brings native Azure agent features—such as Azure Monitor Agent, Microsoft Defender for Servers, Key Vault certificate enrollment, and ad-hoc script execution—directly to hybrid servers.

---

1. Azure Machine Configuration Architecture & DSC v3

Azure Machine Configuration enables auditing and configuring in-guest operating system settings for both Azure virtual machines and Azure Arc-enabled servers natively through Azure Policy.

+-----------------------------------------------------------------------------------------+
|                    AZURE MACHINE CONFIGURATION EXECUTION PIPELINE                       |
|                                                                                         |
|   [AZURE POLICY CONTROL PLANE]                                                          |
|   - Azure Policy Definition (AuditIfNotExists / DeployIfNotExists)                      |
|   - Policy Assignment (Target: Subscription, RG, or Arc Machine)                        |
|   - Points to: Package URI (HTTPS Blob Storage with SAS token)                          |
|                                 |                                                       |
|                                 | (Policy Assignment Pushed via ARM)                    |
|                                 v                                                       |
|   [GUEST CONFIGURATION SERVICE (gc_service)]                                            |
|   1. Downloads Package .zip (localhost.mof + metadata.json + DSC Modules)               |
|   2. Validates package hash against Azure Policy assignment                             |
|   3. Sandboxed PowerShell DSC v3 Engine executes:                                       |
|      * Test-TargetResource (Evaluates compliance)                                       |
|      * Set-TargetResource  (Applies remediation if DeployIfNotExists/AuditandSet)       |
|   4. Reports structured compliance JSON back to Azure Policy Engine                     |
+-----------------------------------------------------------------------------------------+

How the Machine Configuration Engine Operates:

• The Guest Configuration Service (gc_service) running on the Arc-enabled server periodically queries Azure Policy for assigned configuration definitions.
• When a policy is assigned, gc_service downloads the packaged configuration .zip archive from Azure Blob Storage over outbound HTTPS (TCP 443).
• Inside the guest OS, gc_service executes an isolated, embedded instance of PowerShell Desired State Configuration (DSC v3). It invokes Test-TargetResource (or the DSC class Test() method) to verify whether the local OS state matches the declared baseline.
• If the policy effect is configured for remediation, the agent executes Set-TargetResource to bring non-compliant settings into desired alignment.
• The resulting compliance data is posted back to Azure Policy, providing centralized compliance dashboards across on-premises and cloud servers.

---

2. Built-in Baselines vs Authoring Custom Configuration Packages

Microsoft provides extensive built-in Machine Configuration definitions that can be assigned directly from the Azure Portal, including:

• Windows Server Security Baselines (aligned with CIS and Microsoft Security Baselines).
• Auditing password complexity, lockout thresholds, and maximum password age.
• Enforcing TLS 1.2 / TLS 1.3 protocol and cipher suite configurations.
• Auditing non-standard accounts in the local BUILTIN\Administrators group.
• Auditing BitLocker drive encryption and Windows Defender Antivirus real-time protection.

Authoring Custom Machine Configuration Packages

When an enterprise requires custom configuration baselines (e.g., verifying specific internal registry keys, auditing customized audit policies, or checking legacy file permissions), administrators author custom packages using the GuestConfiguration PowerShell module.

+-----------------------------------------------------------------------------------------+
|                    CUSTOM MACHINE CONFIGURATION PACKAGE STRUCTURE (.ZIP)                |
|                                                                                         |
|   CustomPackage.zip                                                                     |
|   ├── localhost.mof             <-- Compiled MOF document containing target settings    |
|   ├── metadata.json             <-- Package version, hash, OS requirements, parameters  |
|   └── Modules/                                                                          |
|       └── PSDscResources/       <-- Required PowerShell DSC modules & resource providers|
|           └── 2.12.0.0/                                                                 |
|               ├── PSDscResources.psd1                                                   |
|               └── ...                                                                   |
+-----------------------------------------------------------------------------------------+

Step-by-Step Custom Package Creation Workflow:

# Step 1: Install the GuestConfiguration authoring module
Install-Module -Name GuestConfiguration -Scope CurrentUser -Repository PSGallery

# Step 2: Define and compile the DSC Configuration into a MOF file
Configuration AuditSecuritySettings {
    Import-DscResource -ModuleName PSDscResources
    
    Registry DisableInsecureSMB1 {
        Key       = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters'
        ValueName = 'SMB1'
        ValueData = '0'
        ValueType = 'Dword'
        Ensure    = 'Present'
    }
}

# Compile the configuration
AuditSecuritySettings -OutputPath "C:\MachineConfig\MOF"

# Step 3: Package the MOF, metadata, and dependencies into a signed .zip artifact
New-GuestConfigurationPackage `
    -Name "AuditSecuritySettings" `
    -Configuration "C:\MachineConfig\MOF\AuditSecuritySettings\localhost.mof" `
    -Type "Audit" `
    -Path "C:\MachineConfig\Packages\AuditSecuritySettings.zip" `
    -Force

# Step 4: Test package compliance locally prior to deployment
Get-GuestConfigurationPackageComplianceStatus -Path "C:\MachineConfig\Packages\AuditSecuritySettings.zip"

# Step 5: Publish package to an Azure Storage Blob container
Publish-GuestConfigurationPackage `
    -Path "C:\MachineConfig\Packages\AuditSecuritySettings.zip" `
    -ResourceGroupName "rg-hybrid-governance" `
    -StorageAccountName "stgarcconfiguration" `
    -StorageContainerName "guestconfiguration"

---

3. Azure Policy Effects: AuditIfNotExists vs DeployIfNotExists

Machine Configuration policies utilize specific Azure Policy effects to govern enforcement behavior:

+-----------------------------------------------------------------------------------------+
|                    POLICY EFFECTS COMPARISON IN MACHINE CONFIGURATION                   |
|                                                                                         |
|   DIMENSION              AuditIfNotExists               DeployIfNotExists               |
|   --------------------+------------------------------+----------------------------------|
|   Primary Purpose     | Passive compliance auditing  | Active configuration remediation |
|   Package Type        | 'Audit'                      | 'AuditandSet'                    |
|   In-Guest Action     | Executes Test-TargetResource | Executes Test-TargetResource &   |
|                       | (Reports Pass/Fail)          | Set-TargetResource               |
|   OS State Change     | Zero modifications to OS     | Modifies OS registry/files/state |
|   Identity Required   | Standard ARM Read access     | System/User Managed Identity     |
|                       |                              | with 'Guest Configuration        |
|                       |                              | Contributor' role                |
+-----------------------------------------------------------------------------------------+

• AuditIfNotExists: Evaluates whether a Microsoft.GuestConfiguration/guestConfigurationAssignments resource exists on the Arc server and whether its compliance state is Compliant. If the configuration deviates from the baseline, Azure Policy marks the machine as Non-Compliant in compliance dashboards. It will never alter files, services, or registry values on the server.
• DeployIfNotExists: Automatically creates and links the guestConfigurationAssignments sub-resource to the Arc server. When configured with an AuditandSet package, if the agent detects configuration drift during periodic evaluation, it automatically executes the DSC Set-TargetResource method to correct the deviation. Remediating non-compliant resources requires creating a Remediation Task in Azure Policy backed by a Managed Identity with appropriate RBAC privileges.

---

4. Core VM Extensions on Azure Arc-Enabled Servers

VM Extensions are small applications that execute post-onboarding configuration and management automation tasks on Azure Arc-enabled servers. The Extension Manager (extmd) handles extension lifecycle operations.

+-----------------------------------------------------------------------------------------+
|                         CORE VM EXTENSIONS FOR ARC-ENABLED SERVERS                      |
|                                                                                         |
|  +---------------------------+  +---------------------------+  +----------------------+ |
|  | Azure Monitor Agent (AMA) |  | Defender for Servers(MDE) |  | Key Vault Extension  | |
|  | - Data Collection Rules   |  | - MDE Sensor Onboarding   |  | - Auto Cert Enroller | |
|  | - Perf Counters & Events  |  | - Vulnerability Scan (MDVM|  | - Local Cert Store Sync| |
|  | - Replaces MMA / OMS      |  | - EDR & Behavioral Alert  |  | - Zero Manual Renewal| |
|  +---------------------------+  +---------------------------+  +----------------------+ |
|                                              |                                          |
|  +------------------------------------------------------------------------------------+ |
|  | Custom Script Extension                                                            | |
|  | - Downloads & executes PowerShell scripts from Azure Blob / GitHub                  | |
|  | - Automates application setup, agent distribution, and post-join config             | |
|  +------------------------------------------------------------------------------------+ |
+-----------------------------------------------------------------------------------------+

1. Azure Monitor Agent (AMA)

• Architecture: The modern, unified telemetry agent for Windows and Linux that completely supersedes the legacy Log Analytics (MMA / OMS) agent and Diagnostics extension.
• Data Collection Rules (DCRs): Unlike the legacy MMA agent which sent identical data to an entire workspace, AMA utilizes Data Collection Rules (DCRs). DCRs allow filtering and scoping at the source: administrators specify exactly which Windows Event Logs (System, Application, Security via XPath queries), performance counters (CPU, Memory, Disk IOPS), and IIS logs are collected from specific subsets of Arc servers, streaming them to Log Analytics or Azure Monitor Metrics.

2. Microsoft Defender for Servers / MDE Extension

• Deploys the Microsoft Defender for Endpoint (MDE) sensor to Arc-enabled servers seamlessly without running local installation packages or onboarding scripts.
• Provides real-time behavioral protection, cloud-delivered malware protection, Endpoint Detection and Response (EDR), and continuous vulnerability assessment through Microsoft Defender Vulnerability Management (MDVM).

3. Azure Key Vault VM Extension

• Automatically enrolls, downloads, and periodically polls Azure Key Vault for updated X.509 SSL/TLS certificates and installs them directly into the local Windows Certificate Store (Cert:\LocalMachine\My).
• Eliminates manual certificate renewal processes across on-premises web servers (IIS) and application hosts by monitoring certificate validity and automatically downloading new versions when rotated in Key Vault.

4. Custom Script Extension for Windows

• Allows downloading and executing arbitrary PowerShell scripts located in Azure Blob Storage, GitHub repositories, or internal web servers.
• Common use cases include executing silent application installations, provisioning local service accounts, or running post-onboarding bootstrapping tasks.

Deploying VM Extensions via Azure CLI

# Deploy the Azure Monitor Agent (AMA) extension to an Arc-enabled server
az connectedmachine extension create \
    --resource-group "rg-hybrid-infrastructure" \
    --machine-name "SRV-APP-01" \
    --name "AzureMonitorWindowsAgent" \
    --type "AzureMonitorWindowsAgent" \
    --publisher "Microsoft.Azure.Monitor" \
    --location "eastus"

# Deploy the Azure Key Vault extension for automated certificate sync
az connectedmachine extension create \
    --resource-group "rg-hybrid-infrastructure" \
    --machine-name "SRV-WEB-01" \
    --name "KeyVaultForWindows" \
    --type "KeyVaultForWindows" \
    --publisher "Microsoft.Azure.KeyVault" \
    --settings '{"secretsManagementSettings": {"pollingIntervalInS": "3600", "certificateStoreName": "MY", "certificateStoreLocation": "LocalMachine", "observedCertificates": ["https://kv-corp-prod.vault.azure.net/secrets/web-ssl-cert"]}}'

---

5. Azure Arc Run Command vs Custom Script Extension

For remote script execution, Azure Arc provides two distinct capabilities: Azure Arc Run Command and Custom Script Extension.

+-----------------------------------------------------------------------------------------+
|                   RUN COMMAND VS CUSTOM SCRIPT EXTENSION COMPARISON                     |
|                                                                                         |
|   DIMENSION              AZURE ARC RUN COMMAND          CUSTOM SCRIPT EXTENSION         |
|   --------------------+------------------------------+----------------------------------|
|   Primary Objective   | Ad-hoc troubleshooting and   | Initial server provisioning and  |
|                       | diagnostic script execution  | multi-step software installation |
|   Execution Model     | Immediate, interactive, or   | Asynchronous extension deployment|
|                       | asynchronous via CLI/Portal  | lifecycle driven by ARM template |
|   Script Source       | Inline script text or remote | External files stored in Azure   |
|                       | script URI                   | Blob Storage or public URLs      |
|   Re-execution Model  | Repeatable on demand with    | Requires updating sequence number|
|                       | different parameters         | or modifying extension config    |
|   Network Exposure    | Zero inbound ports (HTTPS)   | Zero inbound ports (HTTPS)       |
+-----------------------------------------------------------------------------------------+

Executing Ad-Hoc Scripts with Run Command

The Run Command feature leverages the Connected Machine Agent infrastructure to execute PowerShell scripts on Windows (or Bash scripts on Linux) without establishing an RDP, SSH, or WinRM session, and without exposing port 3389 or 5985/5986.

# Execute an ad-hoc PowerShell command on an Arc server and stream stdout
az connectedmachine run-command create \
    --resource-group "rg-hybrid-infrastructure" \
    --machine-name "SRV-DB-01" \
    --run-command-name "CheckDiskSpace" \
    --script "Get-Volume -DriveLetter C, D | Select-Object DriveLetter, FileSystemLabel, SizeRemaining, Size | Format-Table -AutoSize"

[!TIP] Security Isolation with Run Command: Run Command operations execute under the local NT AUTHORITY\SYSTEM account on Windows. Access to trigger Run Commands is controlled strictly via Azure RBAC (Microsoft.HybridCompute/machines/runCommands/write permission). This enables central cloud administrators or automated pipelines to perform break-glass diagnostics on on-premises servers without requiring local administrative domain credentials.