July 16, 2026
Azure Arc - Simply Explained
Modern IT environments rarely exist in a single cloud. Most organizations run Windows and Linux servers across on-premises data centers, Microsoft Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP), branch offices, and edge locations. Unfortunately, every environment introduces its own management portal, security tools, monitoring platform, and patching process. The result is fragmented operations, inconsistent security, configuration drift, and unnecessary complexity. In this episode of Microsoft Knowledge Nuggets, we explain Azure Arc in simple terms and show how it extends Azure's management capabilities beyond Azure itself. Rather than moving workloads to the cloud, Azure Arc brings Azure's governance, monitoring, security, and automation to the infrastructure you already own—wherever it runs. WHAT AZURE ARC ACTUALLY IS One of the biggest misconceptions is that Azure Arc is another cloud service. It isn't. Azure Arc doesn't replace your data center, migrate workloads, or host your applications. Instead, it acts as a bridge between your existing infrastructure and Azure Resource Manager. Using the lightweight Azure Connected Machine Agent, servers running outside Azure become Azure resources with their own resource IDs, resource groups, and management capabilities. Whether your workloads run on Windows Server, Linux, VMware, Hyper-V, AWS, Google Cloud, or edge devices, Azure Arc allows them to be managed through the same Azure portal and APIs used for native Azure resources. The result is a true hybrid and multi-cloud management experience without requiring application migration. GOVERNANCE, SECURITY, AND COMPLIANCE AT SCALE Once a server is connected through Azure Arc, organizations can immediately apply Azure Policy, Azure RBAC, Azure Machine Configuration, tagging, and centralized governance across their entire infrastructure. Instead of managing different compliance tools for every environment, administrators define policies once and automatically enforce them across Azure, on-premises, and other cloud providers. Azure Arc also integrates directly with Microsoft Defender for Cloud, Azure Monitor, Microsoft Sentinel, VM Insights, Log Analytics, and Extended Security Updates for legacy Windows Server and SQL Server versions. This provides centralized threat detection, vulnerability assessments, security recommendations, monitoring, and compliance reporting regardless of where workloads physically reside. PATCH MANAGEMENT, REMOTE ADMINISTRATION, AND AUTOMATION Azure Arc dramatically simplifies day-to-day operations by providing centralized update management, automation, and remote administration. Azure Update Manager enables organizations to patch Windows and Linux servers across Azure, on-premises environments, AWS, and Google Cloud using a single maintenance schedule. Administrators can execute PowerShell and Bash scripts through the Custom Script Extension without opening inbound firewall ports, while Windows Admin Center delivers secure browser-based server management directly from the Azure portal. Combined with Azure Automation, Remote Support, and secure outbound-only communication through HTTPS, Azure Arc enables organizations to manage hybrid infrastructure efficiently without deploying VPNs or exposing management interfaces to the internet. AZURE ARC FOR KUBERNETES, SQL SERVER, AND MULTI-CLOUD Azure Arc extends far beyond traditional servers. Kubernetes clusters running anywhere can be connected to Azure using GitOps with Flux for declarative deployments, centralized monitoring, and policy enforcement. Azure Arc also enhances SQL Server with vulnerability assessments, best practice recommendations, migration readiness analysis, pay-as-you-go licensing, and Azure Arc-enabled SQL Managed Instance. Through dedicated connectors for AWS and Google Cloud Platform, Azure Arc discovers cloud resources, automatically onboards supported virtual machines, and provides unified inventory, governance, and monitoring across multiple cloud providers. Instead of managing separate Azure, AWS, and GCP environments independently, organizations gain a single operational view across their complete infrastructure estate. WHY AZURE ARC HAS BECOME ESSENTIAL FOR HYBRID CLOUD The real value of Azure Arc isn't any individual feature—it's the unified management experience it creates. Rather than maintaining separate security policies, monitoring tools, update systems, and governance processes for every environment, Azure Arc establishes a single control plane for hybrid and multi-cloud infrastructure. Organizations improve operational efficiency, strengthen security, simplify compliance, and reduce administrative overhead while preserving the freedom to run workloads wherever they make the most business sense. Whether you're managing Windows Servers, Linux systems, Kubernetes clusters, SQL Server, VMware environments, edge computing, or multiple public clouds, Azure Arc delivers consistent governance and cloud-native management without requiring large-scale migration projects. After listening to this episode, you'll understand why Azure Arc has become one of Microsoft's most important technologies for modern hybrid cloud operations and why it serves as the foundation for unified infrastructure management across Azure and beyond.
Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.
🚀 Want to be part of m365.fm?
Then stop just listening… and start showing up.
👉 Connect with me on LinkedIn and let’s make something happen:
- 🎙️ Be a podcast guest and share your story
- 🎧 Host your own episode (yes, seriously)
- 💡 Pitch topics the community actually wants to hear
- 🌍 Build your personal brand in the Microsoft 365 space
This isn’t just a podcast — it’s a platform for people who take action.
🔥 Most people wait. The best ones don’t.
👉 Connect with me on LinkedIn and send me a message:
"I want in"
Let’s build something awesome 👊
1
00:00:00,000 --> 00:00:01,380
Let's start with the problem.
2
00:00:01,380 --> 00:00:04,200
You've probably felt it even if you never had a name for it.
3
00:00:04,200 --> 00:00:06,340
Most companies today don't have one single place
4
00:00:06,340 --> 00:00:07,580
where everything lives.
5
00:00:07,580 --> 00:00:09,220
You've got servers in your own data center
6
00:00:09,220 --> 00:00:11,100
that once your predecessor set up 10 years ago
7
00:00:11,100 --> 00:00:12,120
that still run payroll.
8
00:00:12,120 --> 00:00:14,020
You've got virtual machines in Azure,
9
00:00:14,020 --> 00:00:16,520
maybe for a new application, your team built last year.
10
00:00:16,520 --> 00:00:18,300
You've got stuff running on Amazon Web Services
11
00:00:18,300 --> 00:00:21,240
because a department went rogue and spun up their own account.
12
00:00:21,240 --> 00:00:24,040
Maybe even some Google Cloud for a specific analytics job.
13
00:00:24,040 --> 00:00:24,920
Here's the thing.
14
00:00:24,920 --> 00:00:27,280
Each one of those environments has its own portal.
15
00:00:27,280 --> 00:00:30,260
Its own management tools, its own way of applying policies,
16
00:00:30,260 --> 00:00:32,760
its own security dashboard, its own patching schedule.
17
00:00:32,760 --> 00:00:33,980
So what does that mean for you?
18
00:00:33,980 --> 00:00:36,260
Your team ends up jumping between four different consoles
19
00:00:36,260 --> 00:00:38,500
just to see what you have let alone manage it.
20
00:00:38,500 --> 00:00:40,440
Security policies get applied unevenly
21
00:00:40,440 --> 00:00:43,060
because nobody remembers to check every environment.
22
00:00:43,060 --> 00:00:44,240
Patches slip through the cracks
23
00:00:44,240 --> 00:00:46,560
because one environment uses a different update tool
24
00:00:46,560 --> 00:00:47,400
than the others.
25
00:00:47,400 --> 00:00:50,420
And when something breaks, you're digging through multiple log
26
00:00:50,420 --> 00:00:53,040
sources trying to piece together what happened.
27
00:00:53,040 --> 00:00:54,880
This fragmentation creates blind spots
28
00:00:54,880 --> 00:00:56,200
and blind spots create risk.
29
00:00:56,200 --> 00:00:59,360
You don't know if every server has the latest security patch.
30
00:00:59,360 --> 00:01:01,040
You don't know if a configuration drifted
31
00:01:01,040 --> 00:01:03,120
on that one machine running in AWS.
32
00:01:03,120 --> 00:01:05,080
You don't even know how many servers you actually have
33
00:01:05,080 --> 00:01:06,360
across all these environments.
34
00:01:06,360 --> 00:01:07,320
The pain is real.
35
00:01:07,320 --> 00:01:09,200
Managing a hybrid or multi-cloud world
36
00:01:09,200 --> 00:01:10,600
without a single control plane
37
00:01:10,600 --> 00:01:12,840
leads to wasted time, security gaps,
38
00:01:12,840 --> 00:01:14,960
and operational inefficiency.
39
00:01:14,960 --> 00:01:17,000
You're spending more time switching tools
40
00:01:17,000 --> 00:01:18,640
than actually managing your infrastructure.
41
00:01:18,640 --> 00:01:21,040
But what if you could bring all those environments together
42
00:01:21,040 --> 00:01:22,040
under one roof?
43
00:01:22,040 --> 00:01:25,640
What Azure Arc actually is, the bridge.
44
00:01:25,640 --> 00:01:27,280
That's where Azure Arc comes in.
45
00:01:27,280 --> 00:01:29,520
Let me be clear about what it is right from the start.
46
00:01:29,520 --> 00:01:31,240
Azure Arc is not a cloud.
47
00:01:31,240 --> 00:01:32,680
It doesn't replace your data center.
48
00:01:32,680 --> 00:01:34,600
It doesn't migrate your servers anywhere.
49
00:01:34,600 --> 00:01:35,800
Think of it as a bridge.
50
00:01:35,800 --> 00:01:38,040
A connection between the servers you already have
51
00:01:38,040 --> 00:01:39,440
and Azure's management tools.
52
00:01:39,440 --> 00:01:40,440
Here's how it works.
53
00:01:40,440 --> 00:01:43,000
Azure Arc projects any machine running outside Azure
54
00:01:43,000 --> 00:01:44,280
into Azure Resource Manager.
55
00:01:44,280 --> 00:01:46,360
That's the engine that powers everything in Azure.
56
00:01:46,360 --> 00:01:48,600
Every virtual machine, every database,
57
00:01:48,600 --> 00:01:50,200
every resource you see in the portal
58
00:01:50,200 --> 00:01:52,200
has a record in Azure Resource Manager.
59
00:01:52,200 --> 00:01:54,280
With Arc, a server sitting in your basement,
60
00:01:54,280 --> 00:01:56,240
a virtual machine running on AWS,
61
00:01:56,240 --> 00:01:57,920
or a Kubernetes cluster at the edge
62
00:01:57,920 --> 00:02:00,000
all get their own Azure Resource ID.
63
00:02:00,000 --> 00:02:02,760
They show up in the portal just like native Azure resources.
64
00:02:02,760 --> 00:02:04,680
And once they're there, you can do things with them.
65
00:02:04,680 --> 00:02:07,680
You can apply Azure Policy to enforce security settings.
66
00:02:07,680 --> 00:02:10,600
You can use Azure Monitor to collect performance data and logs.
67
00:02:10,600 --> 00:02:12,880
You can enable Microsoft Defender for Cloud
68
00:02:12,880 --> 00:02:15,560
to scan for vulnerabilities and detect threats.
69
00:02:15,560 --> 00:02:17,400
All on servers that aren't running in Azure.
70
00:02:17,400 --> 00:02:18,600
The core idea is simple.
71
00:02:18,600 --> 00:02:19,920
You don't need to migrate anything
72
00:02:19,920 --> 00:02:21,880
to get Azure's management capabilities.
73
00:02:21,880 --> 00:02:23,240
You don't move your workloads.
74
00:02:23,240 --> 00:02:25,000
You don't re-architect your applications.
75
00:02:25,000 --> 00:02:26,400
You just connect what you already have
76
00:02:26,400 --> 00:02:27,960
to Azure's management plane.
77
00:02:27,960 --> 00:02:29,280
This works with Windows Server.
78
00:02:29,280 --> 00:02:30,480
It works with Linux.
79
00:02:30,480 --> 00:02:32,960
It works with Kubernetes clusters running anywhere.
80
00:02:32,960 --> 00:02:34,560
It works with SQL Server instances.
81
00:02:34,560 --> 00:02:37,040
It even works with Azure Data Services
82
00:02:37,040 --> 00:02:38,640
that you can run on your own hardware.
83
00:02:38,640 --> 00:02:40,760
So whether your server is in a data center,
84
00:02:40,760 --> 00:02:43,320
a remote branch office, an AWS region,
85
00:02:43,320 --> 00:02:44,720
or a Google Cloud Zone,
86
00:02:44,720 --> 00:02:46,840
Arc brings it into the same management experience.
87
00:02:46,840 --> 00:02:48,400
That's the simplest definition.
88
00:02:48,400 --> 00:02:50,920
Azure Arc brings Azure's management plane
89
00:02:50,920 --> 00:02:52,400
to where your servers already live.
90
00:02:52,400 --> 00:02:53,920
So how does this bridge actually work?
91
00:02:53,920 --> 00:02:56,040
It starts with a small piece of software.
92
00:02:56,040 --> 00:02:58,480
The secret source, the connected machine agent.
93
00:02:58,480 --> 00:03:01,040
So what exactly is the Azure connected machine agent?
94
00:03:01,040 --> 00:03:02,640
It's a lightweight piece of software
95
00:03:02,640 --> 00:03:05,560
you install on each server you want to manage through Arc.
96
00:03:05,560 --> 00:03:07,360
Once installed, the agent connects outbound
97
00:03:07,360 --> 00:03:10,200
to Azure over HTTPS on port 443,
98
00:03:10,200 --> 00:03:11,720
the same port your browser uses.
99
00:03:11,720 --> 00:03:14,800
So you don't need to open inbound ports or set up a VPN.
100
00:03:14,800 --> 00:03:17,160
The server reaches out to Azure, not the other way around,
101
00:03:17,160 --> 00:03:18,520
which means better security
102
00:03:18,520 --> 00:03:20,520
without punching holes in your firewall.
103
00:03:20,520 --> 00:03:22,600
Once that connection is made, your server,
104
00:03:22,600 --> 00:03:25,080
whether it's in your data center or running on AWS,
105
00:03:25,080 --> 00:03:27,760
appears in the Azure portal as a full Azure resource.
106
00:03:27,760 --> 00:03:29,880
It gets a resource ID, a region assignment,
107
00:03:29,880 --> 00:03:32,160
and a resource group just like any Azure VM.
108
00:03:32,160 --> 00:03:34,920
You can tag it, apply policies, monitor it, and manage it.
109
00:03:34,920 --> 00:03:35,880
Here's the best part.
110
00:03:35,880 --> 00:03:36,720
The agent is free.
111
00:03:36,720 --> 00:03:39,560
Connecting a server to Azure Arc costs nothing.
112
00:03:39,560 --> 00:03:41,520
You only pay for the services you enable on top,
113
00:03:41,520 --> 00:03:43,120
like Microsoft Defender for Cloud,
114
00:03:43,120 --> 00:03:45,080
Azure Update Manager, or Azure Monitor.
115
00:03:45,080 --> 00:03:47,040
So your bill only covers what you actually use.
116
00:03:47,040 --> 00:03:48,280
What does the agent actually do?
117
00:03:48,280 --> 00:03:50,960
It keeps the communication channel with Azure open.
118
00:03:50,960 --> 00:03:52,320
It handles extensions.
119
00:03:52,320 --> 00:03:55,240
Think of those as add-ons for monitoring or security scanning.
120
00:03:55,240 --> 00:03:56,640
And it sends inventory data back
121
00:03:56,640 --> 00:03:59,320
so you always know what's running on that machine.
122
00:03:59,320 --> 00:04:01,040
Installation is straightforward.
123
00:04:01,040 --> 00:04:03,600
In the Azure portal, navigate to Azure Arc,
124
00:04:03,600 --> 00:04:06,560
select servers, and generate an onboarding script,
125
00:04:06,560 --> 00:04:08,960
PowerShell for Windows, or Shell for Linux.
126
00:04:08,960 --> 00:04:10,960
Run it on the target machine with admin rights,
127
00:04:10,960 --> 00:04:12,960
authenticate to Azure, and within minutes,
128
00:04:12,960 --> 00:04:14,520
the server appears in your portal.
129
00:04:14,520 --> 00:04:17,000
All you need is admin rights and internet access.
130
00:04:17,000 --> 00:04:19,840
Once connected, you manage it just like any Azure VM.
131
00:04:19,840 --> 00:04:22,040
Install extensions, run scripts, apply policies,
132
00:04:22,040 --> 00:04:24,200
monitor performance, the experience is identical.
133
00:04:24,200 --> 00:04:26,360
With the agent in place, you unlock capabilities
134
00:04:26,360 --> 00:04:28,360
that change how you manage that server.
135
00:04:28,360 --> 00:04:30,160
Let's start with governance.
136
00:04:30,160 --> 00:04:31,280
What arc unlocks?
137
00:04:31,280 --> 00:04:32,520
Governance at scale.
138
00:04:32,520 --> 00:04:34,440
So you've connected a server to Arc.
139
00:04:34,440 --> 00:04:35,280
Now what?
140
00:04:35,280 --> 00:04:36,880
The first thing you'll notice is that you can apply
141
00:04:36,880 --> 00:04:38,120
Azure policy to it.
142
00:04:38,120 --> 00:04:40,520
The same policy engine that governs Azure resources
143
00:04:40,520 --> 00:04:43,520
now extends to your on-prem or AWS servers.
144
00:04:43,520 --> 00:04:45,840
In practice, you enforce compliance rules
145
00:04:45,840 --> 00:04:48,760
across your entire fleet, no matter where machines live.
146
00:04:48,760 --> 00:04:51,200
Need every server to have a specific security setting,
147
00:04:51,200 --> 00:04:53,560
write a policy, assign it to your Arc enabled servers,
148
00:04:53,560 --> 00:04:55,720
and Azure continuously checks compliance.
149
00:04:55,720 --> 00:04:57,480
If a server drift, you get an alert.
150
00:04:57,480 --> 00:04:59,160
You can even set up automatic remediation
151
00:04:59,160 --> 00:05:01,120
in some cases, tagging is another piece.
152
00:05:01,120 --> 00:05:03,080
You already tag Azure resources
153
00:05:03,080 --> 00:05:05,520
with environment, cost center, and owner tags.
154
00:05:05,520 --> 00:05:07,440
With Arc, you tag hybrid servers the same way.
155
00:05:07,440 --> 00:05:10,280
So that machine in your basement gets the same tags
156
00:05:10,280 --> 00:05:13,000
as your Azure VMs, making cost tracking, ownership,
157
00:05:13,000 --> 00:05:16,360
and environment separation consistent across your whole estate.
158
00:05:16,360 --> 00:05:17,920
Next up is access control.
159
00:05:17,920 --> 00:05:20,160
Azure RBAC lets you define who can do what
160
00:05:20,160 --> 00:05:22,960
on your on-prem servers through the Azure portal.
161
00:05:22,960 --> 00:05:25,080
Give your junior admin read only access
162
00:05:25,080 --> 00:05:27,320
to see inventory without making changes
163
00:05:27,320 --> 00:05:29,800
and let your security team run vulnerability scans
164
00:05:29,800 --> 00:05:33,040
without full admin access, or control from Azure,
165
00:05:33,040 --> 00:05:35,160
not from local policies on each server.
166
00:05:35,160 --> 00:05:36,880
Azure machine configuration goes further.
167
00:05:36,880 --> 00:05:38,760
It audits and sets OS level settings
168
00:05:38,760 --> 00:05:41,080
across your entire fleet from one place.
169
00:05:41,080 --> 00:05:43,800
Want Bitlocker enabled on every Windows server?
170
00:05:43,800 --> 00:05:46,160
Write a policy that checks and reports compliance.
171
00:05:46,160 --> 00:05:48,160
Need a specific registry key set correctly
172
00:05:48,160 --> 00:05:49,560
on all your Linux machines?
173
00:05:49,560 --> 00:05:50,320
Same thing.
174
00:05:50,320 --> 00:05:53,000
Define the desired state once, and Azure evaluates
175
00:05:53,000 --> 00:05:55,240
every Arc enabled server against it.
176
00:05:55,240 --> 00:05:56,560
Let me give you a concrete example.
177
00:05:56,560 --> 00:05:59,120
Say you have servers spread across three data centers,
178
00:05:59,120 --> 00:06:01,880
two cloud providers, and a dozen remote retail locations.
179
00:06:01,880 --> 00:06:03,960
You want to enforce a security baseline?
180
00:06:03,960 --> 00:06:06,080
Encryption enabled, certain ports closed,
181
00:06:06,080 --> 00:06:07,760
a specific antivirus installed.
182
00:06:07,760 --> 00:06:09,920
Without Arc, you'd check each environment
183
00:06:09,920 --> 00:06:11,080
with different tools.
184
00:06:11,080 --> 00:06:14,480
With Arc, you write one policy, assign it to the relevant scope,
185
00:06:14,480 --> 00:06:16,800
and Azure shows you which servers are compliant
186
00:06:16,800 --> 00:06:19,560
and which aren't, all in a single dashboard.
187
00:06:19,560 --> 00:06:20,760
That's governance at scale.
188
00:06:20,760 --> 00:06:22,600
One set of rules, one view of compliance,
189
00:06:22,600 --> 00:06:24,240
no matter where your servers live.
190
00:06:24,240 --> 00:06:26,160
Once you have that governance layer in place,
191
00:06:26,160 --> 00:06:27,920
the next thing to tackle is security,
192
00:06:27,920 --> 00:06:30,880
because threats don't care where your server runs.
193
00:06:30,880 --> 00:06:32,080
What Arc unlocks?
194
00:06:32,080 --> 00:06:33,520
Security and monitoring.
195
00:06:33,520 --> 00:06:37,040
Here's where Arc really shows its value, security.
196
00:06:37,040 --> 00:06:39,120
The hard truth is, a vulnerability sitting
197
00:06:39,120 --> 00:06:41,200
on a server in your data center is just as dangerous
198
00:06:41,200 --> 00:06:42,480
as one running in Azure.
199
00:06:42,480 --> 00:06:44,400
But without Arc, you're probably handling those
200
00:06:44,400 --> 00:06:46,080
with different tools, different processes,
201
00:06:46,080 --> 00:06:47,440
maybe even different teams.
202
00:06:47,440 --> 00:06:48,840
That changes now.
203
00:06:48,840 --> 00:06:51,040
With Arc, Microsoft Defender for Cloud extends
204
00:06:51,040 --> 00:06:52,280
to your hybrid servers.
205
00:06:52,280 --> 00:06:53,800
So the same vulnerability assessments,
206
00:06:53,800 --> 00:06:55,600
threat detection, and security recommendations
207
00:06:55,600 --> 00:06:58,320
you already get for Azure VMs, now applied to machines
208
00:06:58,320 --> 00:07:00,840
running on-prem, on AWS, or at the edge.
209
00:07:00,840 --> 00:07:02,680
Defender scans your entire hybrid fleet
210
00:07:02,680 --> 00:07:04,520
for missing patches, weak configurations,
211
00:07:04,520 --> 00:07:05,800
and suspicious activity.
212
00:07:05,800 --> 00:07:07,440
Then surfaces everything in the dashboard
213
00:07:07,440 --> 00:07:09,320
you already use for Azure resources.
214
00:07:09,320 --> 00:07:10,840
No more juggling separate tools.
215
00:07:10,840 --> 00:07:12,240
What about incident response?
216
00:07:12,240 --> 00:07:15,000
Microsoft Sentinel can pull logs from Arc machines too.
217
00:07:15,000 --> 00:07:16,840
So if Sentinel is your security information
218
00:07:16,840 --> 00:07:18,160
and event management tool,
219
00:07:18,160 --> 00:07:20,120
you get one unified security dashboard
220
00:07:20,120 --> 00:07:21,200
for every environment.
221
00:07:21,200 --> 00:07:22,960
No more jumping between different log sources,
222
00:07:22,960 --> 00:07:24,840
trying to piece together what happened.
223
00:07:24,840 --> 00:07:28,400
All your security data from all your servers lands in one place.
224
00:07:28,400 --> 00:07:29,480
Then there's monitoring.
225
00:07:29,480 --> 00:07:31,960
Azure Monitor collects performance metrics, logs,
226
00:07:31,960 --> 00:07:33,640
and alerts from hybrid machines,
227
00:07:33,640 --> 00:07:35,760
just like it does from native Azure VMs.
228
00:07:35,760 --> 00:07:37,440
Set up a log analytics workspace,
229
00:07:37,440 --> 00:07:39,160
configure your data collection rules,
230
00:07:39,160 --> 00:07:41,720
and start seeing CPU, memory, disk, and network data
231
00:07:41,720 --> 00:07:43,320
from every Arc enabled server.
232
00:07:43,320 --> 00:07:46,320
Want to know if a server's CPU stays above 90%
233
00:07:46,320 --> 00:07:47,760
for more than 15 minutes?
234
00:07:47,760 --> 00:07:48,960
You create an alert,
235
00:07:48,960 --> 00:07:51,880
and that alert fires whether that server lives in Azure,
236
00:07:51,880 --> 00:07:54,240
your data center, or in AWS region.
237
00:07:54,240 --> 00:07:56,440
VM Insights gives you real-time visibility
238
00:07:56,440 --> 00:07:59,360
into CPU, memory, and disk usage across your entire fleet.
239
00:07:59,360 --> 00:08:01,280
You can open a map of your servers,
240
00:08:01,280 --> 00:08:02,920
spot which ones are running hot,
241
00:08:02,920 --> 00:08:04,440
and drill into performance details
242
00:08:04,440 --> 00:08:06,360
without leaving the Azure portal.
243
00:08:06,360 --> 00:08:09,000
And this works for servers on-prem in AWS
244
00:08:09,000 --> 00:08:11,000
anywhere they happen to be.
245
00:08:11,000 --> 00:08:13,680
One more piece, extended security updates.
246
00:08:13,680 --> 00:08:15,080
Running an out-of-support version
247
00:08:15,080 --> 00:08:17,800
like SQL Server 2012 or Windows Server 2012,
248
00:08:17,800 --> 00:08:19,800
before you have to migrate those workloads
249
00:08:19,800 --> 00:08:21,560
to Azure to keep getting security patches.
250
00:08:21,560 --> 00:08:23,600
With Arc, you get those patches on-prem,
251
00:08:23,600 --> 00:08:25,160
no migration required.
252
00:08:25,160 --> 00:08:26,840
The updates come through the Arc channel,
253
00:08:26,840 --> 00:08:30,240
keeping your legacy system secure while you plan your next move.
254
00:08:30,240 --> 00:08:31,200
And here's a key point.
255
00:08:31,200 --> 00:08:34,800
You don't need a VPN or a bastion host to get remote visibility.
256
00:08:34,800 --> 00:08:37,120
All that monitoring data flows through the Arc agent
257
00:08:37,120 --> 00:08:38,720
secure outbound channel,
258
00:08:38,720 --> 00:08:40,760
no inbound ports, no complex networking,
259
00:08:40,760 --> 00:08:43,360
just the agent talking to Azure over HTPS.
260
00:08:43,360 --> 00:08:46,320
So you can see your servers monitor them and keep them secure,
261
00:08:46,320 --> 00:08:48,240
but what happens when you actually need to fix something
262
00:08:48,240 --> 00:08:49,720
or install an update?
263
00:08:49,720 --> 00:08:50,760
What Arc unlocks?
264
00:08:50,760 --> 00:08:52,400
Updates and remote management.
265
00:08:52,400 --> 00:08:55,520
You can see your servers, monitor them, and enforce policies.
266
00:08:55,520 --> 00:08:57,200
But eventually you need to do things,
267
00:08:57,200 --> 00:08:59,800
install updates, run scripts, troubleshoot issues.
268
00:08:59,800 --> 00:09:00,720
Arc handles that too.
269
00:09:00,720 --> 00:09:02,920
Azure Update Manager lets you schedule patching across
270
00:09:02,920 --> 00:09:05,320
all your Arc machines from a single dashboard.
271
00:09:05,320 --> 00:09:06,560
See which servers need updates,
272
00:09:06,560 --> 00:09:08,760
create a maintenance window and deploy patches,
273
00:09:08,760 --> 00:09:10,320
and it's not just Arc machines.
274
00:09:10,320 --> 00:09:13,560
You can include Azure VMs and even AWS EC2 instances
275
00:09:13,560 --> 00:09:14,480
in the same schedule.
276
00:09:14,480 --> 00:09:16,040
One dashboard, one patching rhythm,
277
00:09:16,040 --> 00:09:17,520
no matter where the server lives.
278
00:09:17,520 --> 00:09:19,280
Need to run a script on a remote machine.
279
00:09:19,280 --> 00:09:21,440
The custom script extension works on Arc servers
280
00:09:21,440 --> 00:09:23,360
just like it does on Azure VMs.
281
00:09:23,360 --> 00:09:25,120
Upload a PowerShell or Bash script,
282
00:09:25,120 --> 00:09:26,640
pick which servers to target
283
00:09:26,640 --> 00:09:28,680
and Azure executes it through the Arc agent.
284
00:09:28,680 --> 00:09:31,600
No RDP, no SSH into each machine individually.
285
00:09:31,600 --> 00:09:33,840
You can run the same script across hundreds of servers
286
00:09:33,840 --> 00:09:34,840
with a few clicks.
287
00:09:34,840 --> 00:09:36,840
Windows Admin Center in Azure gives you
288
00:09:36,840 --> 00:09:38,920
browser-based management for Arc servers.
289
00:09:38,920 --> 00:09:41,480
Open a console, view event logs, manage services,
290
00:09:41,480 --> 00:09:44,000
work with files, all through the Azure portal
291
00:09:44,000 --> 00:09:46,840
without a VPN or a public IP on the target server.
292
00:09:46,840 --> 00:09:49,360
The connection goes through the Arc agent's secure channel.
293
00:09:49,360 --> 00:09:52,160
That's a game changer for servers in remote locations
294
00:09:52,160 --> 00:09:53,800
or locked down environments
295
00:09:53,800 --> 00:09:56,600
where opening remote access ports isn't an option.
296
00:09:56,600 --> 00:09:58,600
Remote support provides just in time access
297
00:09:58,600 --> 00:10:00,080
with full audit logging.
298
00:10:00,080 --> 00:10:01,680
When you need to troubleshoot a problem,
299
00:10:01,680 --> 00:10:03,880
you grant temporary access through Arc.
300
00:10:03,880 --> 00:10:06,800
The session gets logged, everything that happens is recorded
301
00:10:06,800 --> 00:10:08,800
and when you're done, the access is revoked,
302
00:10:08,800 --> 00:10:11,880
no standing admin accounts, no permanent remote access paths.
303
00:10:11,880 --> 00:10:14,160
And as your automation runbooks can automate workflows
304
00:10:14,160 --> 00:10:16,840
across your hybrid environment, onboarding new servers,
305
00:10:16,840 --> 00:10:19,400
fixing configuration drift, responding to alerts.
306
00:10:19,400 --> 00:10:20,480
You write a runbook once
307
00:10:20,480 --> 00:10:22,680
and it runs across all your Arc enabled machines.
308
00:10:22,680 --> 00:10:24,520
So now you've got governance, security, monitoring,
309
00:10:24,520 --> 00:10:26,080
updates and remote management,
310
00:10:26,080 --> 00:10:28,240
all from one place for servers that aren't even in Azure.
311
00:10:28,240 --> 00:10:30,600
That's the core of what Arc delivers.
312
00:10:30,600 --> 00:10:34,360
Beyond servers, Kubernetes, SQL Server and data.
313
00:10:34,360 --> 00:10:36,560
So far, we've been talking about individual servers,
314
00:10:36,560 --> 00:10:38,320
your physical or virtual machines,
315
00:10:38,320 --> 00:10:39,840
but Arc doesn't stop there.
316
00:10:39,840 --> 00:10:43,680
It extends to Kubernetes clusters, SQL Server instances
317
00:10:43,680 --> 00:10:44,800
and even data services.
318
00:10:44,800 --> 00:10:46,040
Let's start with Kubernetes.
319
00:10:46,040 --> 00:10:47,840
If you're running Kubernetes on premises,
320
00:10:47,840 --> 00:10:51,200
on AWS, EKS or at the edge, Azure Arc projects
321
00:10:51,200 --> 00:10:53,520
those clusters into Azure resource manager,
322
00:10:53,520 --> 00:10:56,720
so they show up in the portal right alongside your other resources.
323
00:10:56,720 --> 00:11:00,040
You see all your clusters in one inventory, no matter where they run.
324
00:11:00,040 --> 00:11:01,440
Once the cluster is connected,
325
00:11:01,440 --> 00:11:04,640
you can use GitOps with Flux to define your cluster's desired state
326
00:11:04,640 --> 00:11:06,960
in a Git repository and Flux continuously
327
00:11:06,960 --> 00:11:08,720
reconciles the cluster to match it.
328
00:11:08,720 --> 00:11:10,960
Deployments, configurations, namespace settings,
329
00:11:10,960 --> 00:11:13,960
all managed through code and consistent across every environment.
330
00:11:13,960 --> 00:11:16,040
Plus, you get performance monitoring through Azure Monitor
331
00:11:16,040 --> 00:11:17,960
for containers or from the same dashboard
332
00:11:17,960 --> 00:11:19,400
you use for everything else.
333
00:11:19,400 --> 00:11:22,560
For SQL Server, Arc brings a whole new set of capabilities.
334
00:11:22,560 --> 00:11:24,440
Best practice assessments run automatically
335
00:11:24,440 --> 00:11:27,280
to evaluate your SQL instances for configuration issues,
336
00:11:27,280 --> 00:11:28,960
performance problems and security gaps
337
00:11:28,960 --> 00:11:31,960
while vulnerability scanning identifies potential weaknesses.
338
00:11:31,960 --> 00:11:33,920
And you get pay as you go licensing,
339
00:11:33,920 --> 00:11:36,600
paying per core per hour through your Azure subscription,
340
00:11:36,600 --> 00:11:38,880
even though the instance runs on your own hardware.
341
00:11:38,880 --> 00:11:42,240
Arc enabled SQL managed instance is where things get really interesting.
342
00:11:42,240 --> 00:11:44,320
It lets you run a fully managed SQL instance
343
00:11:44,320 --> 00:11:45,680
on your own infrastructure
344
00:11:45,680 --> 00:11:48,160
with the same engine as Azure SQL managed instance,
345
00:11:48,160 --> 00:11:51,320
including automatic updates, built in higher availability
346
00:11:51,320 --> 00:11:52,520
and elastic scaling.
347
00:11:52,520 --> 00:11:54,680
But it runs on your hardware in your data center,
348
00:11:54,680 --> 00:11:57,320
perfect for workloads that can't move to the cloud yet
349
00:11:57,320 --> 00:12:00,400
due to latency, regulation or legacy dependencies,
350
00:12:00,400 --> 00:12:02,680
but still need modern management.
351
00:12:02,680 --> 00:12:05,880
Migration assessments run automatically every seven days,
352
00:12:05,880 --> 00:12:08,320
evaluating your SQL databases and telling you
353
00:12:08,320 --> 00:12:09,920
what's ready to move to Azure,
354
00:12:09,920 --> 00:12:12,640
whether the right target is Azure SQL database,
355
00:12:12,640 --> 00:12:15,720
SQL managed instance or a SQL VM.
356
00:12:15,720 --> 00:12:17,600
And what blockers you need to address.
357
00:12:17,600 --> 00:12:20,680
This runs continuously so you always know where you stand.
358
00:12:20,680 --> 00:12:22,920
And for SQL Server 2012 and older,
359
00:12:22,920 --> 00:12:25,360
Arc delivers extended security updates
360
00:12:25,360 --> 00:12:27,640
without requiring you to migrate to Azure.
361
00:12:27,640 --> 00:12:29,560
The security patches come through the Arc channel
362
00:12:29,560 --> 00:12:31,240
to keep your legacy systems protected
363
00:12:31,240 --> 00:12:32,800
while you plan your next steps.
364
00:12:32,800 --> 00:12:35,160
This is where Arc becomes more than a management tool.
365
00:12:35,160 --> 00:12:36,920
You get cloud-like management and security
366
00:12:36,920 --> 00:12:38,400
on your existing infrastructure
367
00:12:38,400 --> 00:12:41,320
with a clear path to migration when you're ready.
368
00:12:41,320 --> 00:12:45,720
The multi-cloud reality, managing AWS and GCP.
369
00:12:45,720 --> 00:12:48,880
What about when your servers live inside another cloud entirely?
370
00:12:48,880 --> 00:12:50,440
Arc has an answer for that too.
371
00:12:50,440 --> 00:12:52,840
The multi-cloud connector for AWS is a resource
372
00:12:52,840 --> 00:12:55,680
you create an Azure that connects to your AWS environment,
373
00:12:55,680 --> 00:13:00,680
discovers EC2 instances, S3 buckets, and over 125 resource types,
374
00:13:00,680 --> 00:13:03,200
and replicates them all into Azure resource manager.
375
00:13:03,200 --> 00:13:06,640
So you see AWS resources alongside your Azure resources
376
00:13:06,640 --> 00:13:09,440
in the portal across Azure resource graph queries
377
00:13:09,440 --> 00:13:10,800
and in your dashboards.
378
00:13:10,800 --> 00:13:13,200
The connector can automatically install the Arc agent
379
00:13:13,200 --> 00:13:15,160
on discovered EC2 instances
380
00:13:15,160 --> 00:13:17,400
so you don't have to manually onboard each one.
381
00:13:17,400 --> 00:13:19,600
It identifies your AWS servers,
382
00:13:19,600 --> 00:13:22,960
installs the agent and brings them under Azure management.
383
00:13:22,960 --> 00:13:25,240
And when new instances spin up in AWS,
384
00:13:25,240 --> 00:13:27,920
they're automatically discovered and onboarded.
385
00:13:27,920 --> 00:13:29,360
For Google Cloud Platform,
386
00:13:29,360 --> 00:13:31,920
a similar connector brings inventory visibility
387
00:13:31,920 --> 00:13:33,360
and management capabilities.
388
00:13:33,360 --> 00:13:35,200
You provide your GCP project details
389
00:13:35,200 --> 00:13:36,760
and the connector discovers resources
390
00:13:36,760 --> 00:13:38,480
and makes them visible in Azure.
391
00:13:38,480 --> 00:13:40,040
Once these machines are connected,
392
00:13:40,040 --> 00:13:43,360
you can run Azure Policy and Azure Update Manager across them.
393
00:13:43,360 --> 00:13:45,400
The same policies you apply to your Azure VMs
394
00:13:45,400 --> 00:13:48,240
and on-prem servers now apply to machines running in AWS
395
00:13:48,240 --> 00:13:50,400
and GCP with the same update schedules
396
00:13:50,400 --> 00:13:53,320
and the same compliance reporting or from one place.
397
00:13:53,320 --> 00:13:54,760
This gives you a single pane of glass
398
00:13:54,760 --> 00:13:57,120
for all servers regardless of provider.
399
00:13:57,120 --> 00:14:00,640
You stop thinking about my Azure servers and my AWS servers
400
00:14:00,640 --> 00:14:02,840
and start thinking about simply my servers.
401
00:14:02,840 --> 00:14:04,880
The location becomes a property of the resource,
402
00:14:04,880 --> 00:14:06,880
not a separate management domain.
403
00:14:06,880 --> 00:14:08,160
What Arc is not?
404
00:14:08,160 --> 00:14:09,560
Clearing up confusion.
405
00:14:09,560 --> 00:14:11,280
Now that you've seen what Arc can do,
406
00:14:11,280 --> 00:14:12,880
let's clear up a few common myths.
407
00:14:12,880 --> 00:14:14,040
Here's what Arc is not.
408
00:14:14,040 --> 00:14:16,280
Myth number one is Azure Arc a Cloud?
409
00:14:16,280 --> 00:14:16,960
No.
410
00:14:16,960 --> 00:14:19,320
It doesn't give you compute storage or networking.
411
00:14:19,320 --> 00:14:21,040
It doesn't run your applications.
412
00:14:21,040 --> 00:14:22,400
Think of it as a management layer.
413
00:14:22,400 --> 00:14:24,080
It connects your existing infrastructure
414
00:14:24,080 --> 00:14:25,320
to Azure's management tools.
415
00:14:25,320 --> 00:14:26,840
Your workloads stay where they are.
416
00:14:26,840 --> 00:14:28,760
Arc just gives you a better way to manage them.
417
00:14:28,760 --> 00:14:31,120
Imagine you have a building with its own security system.
418
00:14:31,120 --> 00:14:32,440
Arc doesn't move the building.
419
00:14:32,440 --> 00:14:33,840
It just installs a new smart lock
420
00:14:33,840 --> 00:14:35,720
you can control from anywhere.
421
00:14:35,720 --> 00:14:38,320
Myth number two, does Arc migrate your servers?
422
00:14:38,320 --> 00:14:39,160
Not at all.
423
00:14:39,160 --> 00:14:40,120
Nothing moves.
424
00:14:40,120 --> 00:14:42,120
The machine stays right where it is.
425
00:14:42,120 --> 00:14:45,320
In your data center on AWS or wherever you run it,
426
00:14:45,320 --> 00:14:48,080
Arc creates a pointer in Azure resource manager, not a copy.
427
00:14:48,080 --> 00:14:50,080
Think of it as a bookmark instead of a photocopied.
428
00:14:50,080 --> 00:14:52,920
The actual workload never leaves its original location.
429
00:14:52,920 --> 00:14:55,760
Myth number three, do you need Arc on a VM that's already in Azure?
430
00:14:55,760 --> 00:14:56,600
No.
431
00:14:56,600 --> 00:14:59,200
Native Azure VMs already have the Azure VM agent built in.
432
00:14:59,200 --> 00:15:01,480
That agent gives you the same management capabilities.
433
00:15:01,480 --> 00:15:03,280
Arc is only for machines outside Azure.
434
00:15:03,280 --> 00:15:06,600
If your VM is already in Azure, you're already set.
435
00:15:06,600 --> 00:15:10,080
Myth number four is Arc a replacement for your current tools?
436
00:15:10,080 --> 00:15:10,720
No.
437
00:15:10,720 --> 00:15:13,680
It adds Azure's capabilities on top of what you already have.
438
00:15:13,680 --> 00:15:16,600
You can keep using System Center, Configuration Manager,
439
00:15:16,600 --> 00:15:18,280
or whatever tools you've invested in,
440
00:15:18,280 --> 00:15:19,800
Arc complements those tools.
441
00:15:19,800 --> 00:15:21,960
It adds a new layer of cloud-based governance
442
00:15:21,960 --> 00:15:25,960
and security that your existing tools might not offer.
443
00:15:25,960 --> 00:15:27,920
Myth number five, what about the agent?
444
00:15:27,920 --> 00:15:28,600
Is it heavy?
445
00:15:28,600 --> 00:15:29,880
No, it's lightweight.
446
00:15:29,880 --> 00:15:32,520
Uses minimal CPU and memory, and it's free.
447
00:15:32,520 --> 00:15:34,760
The cost comes from the services you enable on top,
448
00:15:34,760 --> 00:15:36,760
like Defender for Cloud or Azure Monitor,
449
00:15:36,760 --> 00:15:38,800
connecting a server costs nothing.
450
00:15:38,800 --> 00:15:41,200
Zero, Zilch.
451
00:15:41,200 --> 00:15:44,080
Myth number six is Arc only for servers?
452
00:15:44,080 --> 00:15:46,680
No, it works with Kubernetes, SQL Server,
453
00:15:46,680 --> 00:15:48,160
data services, and more.
454
00:15:48,160 --> 00:15:50,240
It's a platform that extends as your management
455
00:15:50,240 --> 00:15:53,320
to any resource type anywhere you have it running.
456
00:15:53,320 --> 00:15:55,120
The big picture, one control plane.
457
00:15:55,120 --> 00:15:56,680
So what does all of this add up to?
458
00:15:56,680 --> 00:15:59,000
Here's the thing, the real value of Azure Arc
459
00:15:59,000 --> 00:16:00,280
isn't any single feature.
460
00:16:00,280 --> 00:16:02,920
It's integration, not the agent, not the policies,
461
00:16:02,920 --> 00:16:04,040
not the monitoring.
462
00:16:04,040 --> 00:16:05,920
It's how all these pieces work together
463
00:16:05,920 --> 00:16:07,680
to give you one consistent way
464
00:16:07,680 --> 00:16:09,720
to manage every server you own.
465
00:16:09,720 --> 00:16:11,160
Now imagine your day to day.
466
00:16:11,160 --> 00:16:13,440
You stop jumping between four different portals.
467
00:16:13,440 --> 00:16:15,160
You stop worrying if a policy was applied
468
00:16:15,160 --> 00:16:17,400
to that one server running in AWS.
469
00:16:17,400 --> 00:16:18,880
You stop searching through different tools
470
00:16:18,880 --> 00:16:19,960
for the information you need.
471
00:16:19,960 --> 00:16:22,720
Instead, you have one place to govern, one to monitor,
472
00:16:22,720 --> 00:16:24,760
one to secure, one to patch.
473
00:16:24,760 --> 00:16:27,160
Your entire server estate, no matter where it lives,
474
00:16:27,160 --> 00:16:28,800
managed through a single control plane.
475
00:16:28,800 --> 00:16:30,080
That's the magic of it.
476
00:16:30,080 --> 00:16:32,120
And getting started is easier than you think.
477
00:16:32,120 --> 00:16:34,360
The hardest part only takes about 10 minutes.
478
00:16:34,360 --> 00:16:36,200
First, register the resource providers
479
00:16:36,200 --> 00:16:37,560
in your Azure subscription,
480
00:16:37,560 --> 00:16:39,400
then install the agent on one server.
481
00:16:39,400 --> 00:16:40,880
Watch it appear in the portal
482
00:16:40,880 --> 00:16:43,120
from there you add capabilities one at a time.
483
00:16:43,120 --> 00:16:45,440
Enable Azure policy, turn on Defender for Cloud,
484
00:16:45,440 --> 00:16:47,080
set up update manager.
485
00:16:47,080 --> 00:16:48,400
Each step builds on the last.
486
00:16:48,400 --> 00:16:50,080
You don't have to do everything at once.
487
00:16:50,080 --> 00:16:52,080
Start small and grow from there.
488
00:16:52,080 --> 00:16:52,960
Start simple.
489
00:16:52,960 --> 00:16:55,480
Head to the Azure portal, find Azure Arc,
490
00:16:55,480 --> 00:16:57,520
pick servers and hit create.
491
00:16:57,520 --> 00:16:59,360
Choose your subscription and resource group,
492
00:16:59,360 --> 00:17:00,840
generate the onboarding script
493
00:17:00,840 --> 00:17:02,320
and run it on a test machine.
494
00:17:02,320 --> 00:17:03,960
About 10 minutes later, you'll see a server
495
00:17:03,960 --> 00:17:05,920
that isn't inside Azure sitting right there
496
00:17:05,920 --> 00:17:07,840
in your portal ready to manage.
497
00:17:07,840 --> 00:17:10,040
That one experiment teaches you more about what Arc
498
00:17:10,040 --> 00:17:12,080
actually does than anything I can explain here.
499
00:17:12,080 --> 00:17:14,520
Subscribe to the show for more knowledge nuggets like this.
500
00:17:14,520 --> 00:17:17,480
Every week we break down Microsoft's platform in plain English
501
00:17:17,480 --> 00:17:18,920
and drop a comment with your biggest question
502
00:17:18,920 --> 00:17:20,800
about hybrid or multi-cloud management.
503
00:17:20,800 --> 00:17:22,040
I read every single one.
00:00:00,000 --> 00:00:01,380
Let's start with the problem.
2
00:00:01,380 --> 00:00:04,200
You've probably felt it even if you never had a name for it.
3
00:00:04,200 --> 00:00:06,340
Most companies today don't have one single place
4
00:00:06,340 --> 00:00:07,580
where everything lives.
5
00:00:07,580 --> 00:00:09,220
You've got servers in your own data center
6
00:00:09,220 --> 00:00:11,100
that once your predecessor set up 10 years ago
7
00:00:11,100 --> 00:00:12,120
that still run payroll.
8
00:00:12,120 --> 00:00:14,020
You've got virtual machines in Azure,
9
00:00:14,020 --> 00:00:16,520
maybe for a new application, your team built last year.
10
00:00:16,520 --> 00:00:18,300
You've got stuff running on Amazon Web Services
11
00:00:18,300 --> 00:00:21,240
because a department went rogue and spun up their own account.
12
00:00:21,240 --> 00:00:24,040
Maybe even some Google Cloud for a specific analytics job.
13
00:00:24,040 --> 00:00:24,920
Here's the thing.
14
00:00:24,920 --> 00:00:27,280
Each one of those environments has its own portal.
15
00:00:27,280 --> 00:00:30,260
Its own management tools, its own way of applying policies,
16
00:00:30,260 --> 00:00:32,760
its own security dashboard, its own patching schedule.
17
00:00:32,760 --> 00:00:33,980
So what does that mean for you?
18
00:00:33,980 --> 00:00:36,260
Your team ends up jumping between four different consoles
19
00:00:36,260 --> 00:00:38,500
just to see what you have let alone manage it.
20
00:00:38,500 --> 00:00:40,440
Security policies get applied unevenly
21
00:00:40,440 --> 00:00:43,060
because nobody remembers to check every environment.
22
00:00:43,060 --> 00:00:44,240
Patches slip through the cracks
23
00:00:44,240 --> 00:00:46,560
because one environment uses a different update tool
24
00:00:46,560 --> 00:00:47,400
than the others.
25
00:00:47,400 --> 00:00:50,420
And when something breaks, you're digging through multiple log
26
00:00:50,420 --> 00:00:53,040
sources trying to piece together what happened.
27
00:00:53,040 --> 00:00:54,880
This fragmentation creates blind spots
28
00:00:54,880 --> 00:00:56,200
and blind spots create risk.
29
00:00:56,200 --> 00:00:59,360
You don't know if every server has the latest security patch.
30
00:00:59,360 --> 00:01:01,040
You don't know if a configuration drifted
31
00:01:01,040 --> 00:01:03,120
on that one machine running in AWS.
32
00:01:03,120 --> 00:01:05,080
You don't even know how many servers you actually have
33
00:01:05,080 --> 00:01:06,360
across all these environments.
34
00:01:06,360 --> 00:01:07,320
The pain is real.
35
00:01:07,320 --> 00:01:09,200
Managing a hybrid or multi-cloud world
36
00:01:09,200 --> 00:01:10,600
without a single control plane
37
00:01:10,600 --> 00:01:12,840
leads to wasted time, security gaps,
38
00:01:12,840 --> 00:01:14,960
and operational inefficiency.
39
00:01:14,960 --> 00:01:17,000
You're spending more time switching tools
40
00:01:17,000 --> 00:01:18,640
than actually managing your infrastructure.
41
00:01:18,640 --> 00:01:21,040
But what if you could bring all those environments together
42
00:01:21,040 --> 00:01:22,040
under one roof?
43
00:01:22,040 --> 00:01:25,640
What Azure Arc actually is, the bridge.
44
00:01:25,640 --> 00:01:27,280
That's where Azure Arc comes in.
45
00:01:27,280 --> 00:01:29,520
Let me be clear about what it is right from the start.
46
00:01:29,520 --> 00:01:31,240
Azure Arc is not a cloud.
47
00:01:31,240 --> 00:01:32,680
It doesn't replace your data center.
48
00:01:32,680 --> 00:01:34,600
It doesn't migrate your servers anywhere.
49
00:01:34,600 --> 00:01:35,800
Think of it as a bridge.
50
00:01:35,800 --> 00:01:38,040
A connection between the servers you already have
51
00:01:38,040 --> 00:01:39,440
and Azure's management tools.
52
00:01:39,440 --> 00:01:40,440
Here's how it works.
53
00:01:40,440 --> 00:01:43,000
Azure Arc projects any machine running outside Azure
54
00:01:43,000 --> 00:01:44,280
into Azure Resource Manager.
55
00:01:44,280 --> 00:01:46,360
That's the engine that powers everything in Azure.
56
00:01:46,360 --> 00:01:48,600
Every virtual machine, every database,
57
00:01:48,600 --> 00:01:50,200
every resource you see in the portal
58
00:01:50,200 --> 00:01:52,200
has a record in Azure Resource Manager.
59
00:01:52,200 --> 00:01:54,280
With Arc, a server sitting in your basement,
60
00:01:54,280 --> 00:01:56,240
a virtual machine running on AWS,
61
00:01:56,240 --> 00:01:57,920
or a Kubernetes cluster at the edge
62
00:01:57,920 --> 00:02:00,000
all get their own Azure Resource ID.
63
00:02:00,000 --> 00:02:02,760
They show up in the portal just like native Azure resources.
64
00:02:02,760 --> 00:02:04,680
And once they're there, you can do things with them.
65
00:02:04,680 --> 00:02:07,680
You can apply Azure Policy to enforce security settings.
66
00:02:07,680 --> 00:02:10,600
You can use Azure Monitor to collect performance data and logs.
67
00:02:10,600 --> 00:02:12,880
You can enable Microsoft Defender for Cloud
68
00:02:12,880 --> 00:02:15,560
to scan for vulnerabilities and detect threats.
69
00:02:15,560 --> 00:02:17,400
All on servers that aren't running in Azure.
70
00:02:17,400 --> 00:02:18,600
The core idea is simple.
71
00:02:18,600 --> 00:02:19,920
You don't need to migrate anything
72
00:02:19,920 --> 00:02:21,880
to get Azure's management capabilities.
73
00:02:21,880 --> 00:02:23,240
You don't move your workloads.
74
00:02:23,240 --> 00:02:25,000
You don't re-architect your applications.
75
00:02:25,000 --> 00:02:26,400
You just connect what you already have
76
00:02:26,400 --> 00:02:27,960
to Azure's management plane.
77
00:02:27,960 --> 00:02:29,280
This works with Windows Server.
78
00:02:29,280 --> 00:02:30,480
It works with Linux.
79
00:02:30,480 --> 00:02:32,960
It works with Kubernetes clusters running anywhere.
80
00:02:32,960 --> 00:02:34,560
It works with SQL Server instances.
81
00:02:34,560 --> 00:02:37,040
It even works with Azure Data Services
82
00:02:37,040 --> 00:02:38,640
that you can run on your own hardware.
83
00:02:38,640 --> 00:02:40,760
So whether your server is in a data center,
84
00:02:40,760 --> 00:02:43,320
a remote branch office, an AWS region,
85
00:02:43,320 --> 00:02:44,720
or a Google Cloud Zone,
86
00:02:44,720 --> 00:02:46,840
Arc brings it into the same management experience.
87
00:02:46,840 --> 00:02:48,400
That's the simplest definition.
88
00:02:48,400 --> 00:02:50,920
Azure Arc brings Azure's management plane
89
00:02:50,920 --> 00:02:52,400
to where your servers already live.
90
00:02:52,400 --> 00:02:53,920
So how does this bridge actually work?
91
00:02:53,920 --> 00:02:56,040
It starts with a small piece of software.
92
00:02:56,040 --> 00:02:58,480
The secret source, the connected machine agent.
93
00:02:58,480 --> 00:03:01,040
So what exactly is the Azure connected machine agent?
94
00:03:01,040 --> 00:03:02,640
It's a lightweight piece of software
95
00:03:02,640 --> 00:03:05,560
you install on each server you want to manage through Arc.
96
00:03:05,560 --> 00:03:07,360
Once installed, the agent connects outbound
97
00:03:07,360 --> 00:03:10,200
to Azure over HTTPS on port 443,
98
00:03:10,200 --> 00:03:11,720
the same port your browser uses.
99
00:03:11,720 --> 00:03:14,800
So you don't need to open inbound ports or set up a VPN.
100
00:03:14,800 --> 00:03:17,160
The server reaches out to Azure, not the other way around,
101
00:03:17,160 --> 00:03:18,520
which means better security
102
00:03:18,520 --> 00:03:20,520
without punching holes in your firewall.
103
00:03:20,520 --> 00:03:22,600
Once that connection is made, your server,
104
00:03:22,600 --> 00:03:25,080
whether it's in your data center or running on AWS,
105
00:03:25,080 --> 00:03:27,760
appears in the Azure portal as a full Azure resource.
106
00:03:27,760 --> 00:03:29,880
It gets a resource ID, a region assignment,
107
00:03:29,880 --> 00:03:32,160
and a resource group just like any Azure VM.
108
00:03:32,160 --> 00:03:34,920
You can tag it, apply policies, monitor it, and manage it.
109
00:03:34,920 --> 00:03:35,880
Here's the best part.
110
00:03:35,880 --> 00:03:36,720
The agent is free.
111
00:03:36,720 --> 00:03:39,560
Connecting a server to Azure Arc costs nothing.
112
00:03:39,560 --> 00:03:41,520
You only pay for the services you enable on top,
113
00:03:41,520 --> 00:03:43,120
like Microsoft Defender for Cloud,
114
00:03:43,120 --> 00:03:45,080
Azure Update Manager, or Azure Monitor.
115
00:03:45,080 --> 00:03:47,040
So your bill only covers what you actually use.
116
00:03:47,040 --> 00:03:48,280
What does the agent actually do?
117
00:03:48,280 --> 00:03:50,960
It keeps the communication channel with Azure open.
118
00:03:50,960 --> 00:03:52,320
It handles extensions.
119
00:03:52,320 --> 00:03:55,240
Think of those as add-ons for monitoring or security scanning.
120
00:03:55,240 --> 00:03:56,640
And it sends inventory data back
121
00:03:56,640 --> 00:03:59,320
so you always know what's running on that machine.
122
00:03:59,320 --> 00:04:01,040
Installation is straightforward.
123
00:04:01,040 --> 00:04:03,600
In the Azure portal, navigate to Azure Arc,
124
00:04:03,600 --> 00:04:06,560
select servers, and generate an onboarding script,
125
00:04:06,560 --> 00:04:08,960
PowerShell for Windows, or Shell for Linux.
126
00:04:08,960 --> 00:04:10,960
Run it on the target machine with admin rights,
127
00:04:10,960 --> 00:04:12,960
authenticate to Azure, and within minutes,
128
00:04:12,960 --> 00:04:14,520
the server appears in your portal.
129
00:04:14,520 --> 00:04:17,000
All you need is admin rights and internet access.
130
00:04:17,000 --> 00:04:19,840
Once connected, you manage it just like any Azure VM.
131
00:04:19,840 --> 00:04:22,040
Install extensions, run scripts, apply policies,
132
00:04:22,040 --> 00:04:24,200
monitor performance, the experience is identical.
133
00:04:24,200 --> 00:04:26,360
With the agent in place, you unlock capabilities
134
00:04:26,360 --> 00:04:28,360
that change how you manage that server.
135
00:04:28,360 --> 00:04:30,160
Let's start with governance.
136
00:04:30,160 --> 00:04:31,280
What arc unlocks?
137
00:04:31,280 --> 00:04:32,520
Governance at scale.
138
00:04:32,520 --> 00:04:34,440
So you've connected a server to Arc.
139
00:04:34,440 --> 00:04:35,280
Now what?
140
00:04:35,280 --> 00:04:36,880
The first thing you'll notice is that you can apply
141
00:04:36,880 --> 00:04:38,120
Azure policy to it.
142
00:04:38,120 --> 00:04:40,520
The same policy engine that governs Azure resources
143
00:04:40,520 --> 00:04:43,520
now extends to your on-prem or AWS servers.
144
00:04:43,520 --> 00:04:45,840
In practice, you enforce compliance rules
145
00:04:45,840 --> 00:04:48,760
across your entire fleet, no matter where machines live.
146
00:04:48,760 --> 00:04:51,200
Need every server to have a specific security setting,
147
00:04:51,200 --> 00:04:53,560
write a policy, assign it to your Arc enabled servers,
148
00:04:53,560 --> 00:04:55,720
and Azure continuously checks compliance.
149
00:04:55,720 --> 00:04:57,480
If a server drift, you get an alert.
150
00:04:57,480 --> 00:04:59,160
You can even set up automatic remediation
151
00:04:59,160 --> 00:05:01,120
in some cases, tagging is another piece.
152
00:05:01,120 --> 00:05:03,080
You already tag Azure resources
153
00:05:03,080 --> 00:05:05,520
with environment, cost center, and owner tags.
154
00:05:05,520 --> 00:05:07,440
With Arc, you tag hybrid servers the same way.
155
00:05:07,440 --> 00:05:10,280
So that machine in your basement gets the same tags
156
00:05:10,280 --> 00:05:13,000
as your Azure VMs, making cost tracking, ownership,
157
00:05:13,000 --> 00:05:16,360
and environment separation consistent across your whole estate.
158
00:05:16,360 --> 00:05:17,920
Next up is access control.
159
00:05:17,920 --> 00:05:20,160
Azure RBAC lets you define who can do what
160
00:05:20,160 --> 00:05:22,960
on your on-prem servers through the Azure portal.
161
00:05:22,960 --> 00:05:25,080
Give your junior admin read only access
162
00:05:25,080 --> 00:05:27,320
to see inventory without making changes
163
00:05:27,320 --> 00:05:29,800
and let your security team run vulnerability scans
164
00:05:29,800 --> 00:05:33,040
without full admin access, or control from Azure,
165
00:05:33,040 --> 00:05:35,160
not from local policies on each server.
166
00:05:35,160 --> 00:05:36,880
Azure machine configuration goes further.
167
00:05:36,880 --> 00:05:38,760
It audits and sets OS level settings
168
00:05:38,760 --> 00:05:41,080
across your entire fleet from one place.
169
00:05:41,080 --> 00:05:43,800
Want Bitlocker enabled on every Windows server?
170
00:05:43,800 --> 00:05:46,160
Write a policy that checks and reports compliance.
171
00:05:46,160 --> 00:05:48,160
Need a specific registry key set correctly
172
00:05:48,160 --> 00:05:49,560
on all your Linux machines?
173
00:05:49,560 --> 00:05:50,320
Same thing.
174
00:05:50,320 --> 00:05:53,000
Define the desired state once, and Azure evaluates
175
00:05:53,000 --> 00:05:55,240
every Arc enabled server against it.
176
00:05:55,240 --> 00:05:56,560
Let me give you a concrete example.
177
00:05:56,560 --> 00:05:59,120
Say you have servers spread across three data centers,
178
00:05:59,120 --> 00:06:01,880
two cloud providers, and a dozen remote retail locations.
179
00:06:01,880 --> 00:06:03,960
You want to enforce a security baseline?
180
00:06:03,960 --> 00:06:06,080
Encryption enabled, certain ports closed,
181
00:06:06,080 --> 00:06:07,760
a specific antivirus installed.
182
00:06:07,760 --> 00:06:09,920
Without Arc, you'd check each environment
183
00:06:09,920 --> 00:06:11,080
with different tools.
184
00:06:11,080 --> 00:06:14,480
With Arc, you write one policy, assign it to the relevant scope,
185
00:06:14,480 --> 00:06:16,800
and Azure shows you which servers are compliant
186
00:06:16,800 --> 00:06:19,560
and which aren't, all in a single dashboard.
187
00:06:19,560 --> 00:06:20,760
That's governance at scale.
188
00:06:20,760 --> 00:06:22,600
One set of rules, one view of compliance,
189
00:06:22,600 --> 00:06:24,240
no matter where your servers live.
190
00:06:24,240 --> 00:06:26,160
Once you have that governance layer in place,
191
00:06:26,160 --> 00:06:27,920
the next thing to tackle is security,
192
00:06:27,920 --> 00:06:30,880
because threats don't care where your server runs.
193
00:06:30,880 --> 00:06:32,080
What Arc unlocks?
194
00:06:32,080 --> 00:06:33,520
Security and monitoring.
195
00:06:33,520 --> 00:06:37,040
Here's where Arc really shows its value, security.
196
00:06:37,040 --> 00:06:39,120
The hard truth is, a vulnerability sitting
197
00:06:39,120 --> 00:06:41,200
on a server in your data center is just as dangerous
198
00:06:41,200 --> 00:06:42,480
as one running in Azure.
199
00:06:42,480 --> 00:06:44,400
But without Arc, you're probably handling those
200
00:06:44,400 --> 00:06:46,080
with different tools, different processes,
201
00:06:46,080 --> 00:06:47,440
maybe even different teams.
202
00:06:47,440 --> 00:06:48,840
That changes now.
203
00:06:48,840 --> 00:06:51,040
With Arc, Microsoft Defender for Cloud extends
204
00:06:51,040 --> 00:06:52,280
to your hybrid servers.
205
00:06:52,280 --> 00:06:53,800
So the same vulnerability assessments,
206
00:06:53,800 --> 00:06:55,600
threat detection, and security recommendations
207
00:06:55,600 --> 00:06:58,320
you already get for Azure VMs, now applied to machines
208
00:06:58,320 --> 00:07:00,840
running on-prem, on AWS, or at the edge.
209
00:07:00,840 --> 00:07:02,680
Defender scans your entire hybrid fleet
210
00:07:02,680 --> 00:07:04,520
for missing patches, weak configurations,
211
00:07:04,520 --> 00:07:05,800
and suspicious activity.
212
00:07:05,800 --> 00:07:07,440
Then surfaces everything in the dashboard
213
00:07:07,440 --> 00:07:09,320
you already use for Azure resources.
214
00:07:09,320 --> 00:07:10,840
No more juggling separate tools.
215
00:07:10,840 --> 00:07:12,240
What about incident response?
216
00:07:12,240 --> 00:07:15,000
Microsoft Sentinel can pull logs from Arc machines too.
217
00:07:15,000 --> 00:07:16,840
So if Sentinel is your security information
218
00:07:16,840 --> 00:07:18,160
and event management tool,
219
00:07:18,160 --> 00:07:20,120
you get one unified security dashboard
220
00:07:20,120 --> 00:07:21,200
for every environment.
221
00:07:21,200 --> 00:07:22,960
No more jumping between different log sources,
222
00:07:22,960 --> 00:07:24,840
trying to piece together what happened.
223
00:07:24,840 --> 00:07:28,400
All your security data from all your servers lands in one place.
224
00:07:28,400 --> 00:07:29,480
Then there's monitoring.
225
00:07:29,480 --> 00:07:31,960
Azure Monitor collects performance metrics, logs,
226
00:07:31,960 --> 00:07:33,640
and alerts from hybrid machines,
227
00:07:33,640 --> 00:07:35,760
just like it does from native Azure VMs.
228
00:07:35,760 --> 00:07:37,440
Set up a log analytics workspace,
229
00:07:37,440 --> 00:07:39,160
configure your data collection rules,
230
00:07:39,160 --> 00:07:41,720
and start seeing CPU, memory, disk, and network data
231
00:07:41,720 --> 00:07:43,320
from every Arc enabled server.
232
00:07:43,320 --> 00:07:46,320
Want to know if a server's CPU stays above 90%
233
00:07:46,320 --> 00:07:47,760
for more than 15 minutes?
234
00:07:47,760 --> 00:07:48,960
You create an alert,
235
00:07:48,960 --> 00:07:51,880
and that alert fires whether that server lives in Azure,
236
00:07:51,880 --> 00:07:54,240
your data center, or in AWS region.
237
00:07:54,240 --> 00:07:56,440
VM Insights gives you real-time visibility
238
00:07:56,440 --> 00:07:59,360
into CPU, memory, and disk usage across your entire fleet.
239
00:07:59,360 --> 00:08:01,280
You can open a map of your servers,
240
00:08:01,280 --> 00:08:02,920
spot which ones are running hot,
241
00:08:02,920 --> 00:08:04,440
and drill into performance details
242
00:08:04,440 --> 00:08:06,360
without leaving the Azure portal.
243
00:08:06,360 --> 00:08:09,000
And this works for servers on-prem in AWS
244
00:08:09,000 --> 00:08:11,000
anywhere they happen to be.
245
00:08:11,000 --> 00:08:13,680
One more piece, extended security updates.
246
00:08:13,680 --> 00:08:15,080
Running an out-of-support version
247
00:08:15,080 --> 00:08:17,800
like SQL Server 2012 or Windows Server 2012,
248
00:08:17,800 --> 00:08:19,800
before you have to migrate those workloads
249
00:08:19,800 --> 00:08:21,560
to Azure to keep getting security patches.
250
00:08:21,560 --> 00:08:23,600
With Arc, you get those patches on-prem,
251
00:08:23,600 --> 00:08:25,160
no migration required.
252
00:08:25,160 --> 00:08:26,840
The updates come through the Arc channel,
253
00:08:26,840 --> 00:08:30,240
keeping your legacy system secure while you plan your next move.
254
00:08:30,240 --> 00:08:31,200
And here's a key point.
255
00:08:31,200 --> 00:08:34,800
You don't need a VPN or a bastion host to get remote visibility.
256
00:08:34,800 --> 00:08:37,120
All that monitoring data flows through the Arc agent
257
00:08:37,120 --> 00:08:38,720
secure outbound channel,
258
00:08:38,720 --> 00:08:40,760
no inbound ports, no complex networking,
259
00:08:40,760 --> 00:08:43,360
just the agent talking to Azure over HTPS.
260
00:08:43,360 --> 00:08:46,320
So you can see your servers monitor them and keep them secure,
261
00:08:46,320 --> 00:08:48,240
but what happens when you actually need to fix something
262
00:08:48,240 --> 00:08:49,720
or install an update?
263
00:08:49,720 --> 00:08:50,760
What Arc unlocks?
264
00:08:50,760 --> 00:08:52,400
Updates and remote management.
265
00:08:52,400 --> 00:08:55,520
You can see your servers, monitor them, and enforce policies.
266
00:08:55,520 --> 00:08:57,200
But eventually you need to do things,
267
00:08:57,200 --> 00:08:59,800
install updates, run scripts, troubleshoot issues.
268
00:08:59,800 --> 00:09:00,720
Arc handles that too.
269
00:09:00,720 --> 00:09:02,920
Azure Update Manager lets you schedule patching across
270
00:09:02,920 --> 00:09:05,320
all your Arc machines from a single dashboard.
271
00:09:05,320 --> 00:09:06,560
See which servers need updates,
272
00:09:06,560 --> 00:09:08,760
create a maintenance window and deploy patches,
273
00:09:08,760 --> 00:09:10,320
and it's not just Arc machines.
274
00:09:10,320 --> 00:09:13,560
You can include Azure VMs and even AWS EC2 instances
275
00:09:13,560 --> 00:09:14,480
in the same schedule.
276
00:09:14,480 --> 00:09:16,040
One dashboard, one patching rhythm,
277
00:09:16,040 --> 00:09:17,520
no matter where the server lives.
278
00:09:17,520 --> 00:09:19,280
Need to run a script on a remote machine.
279
00:09:19,280 --> 00:09:21,440
The custom script extension works on Arc servers
280
00:09:21,440 --> 00:09:23,360
just like it does on Azure VMs.
281
00:09:23,360 --> 00:09:25,120
Upload a PowerShell or Bash script,
282
00:09:25,120 --> 00:09:26,640
pick which servers to target
283
00:09:26,640 --> 00:09:28,680
and Azure executes it through the Arc agent.
284
00:09:28,680 --> 00:09:31,600
No RDP, no SSH into each machine individually.
285
00:09:31,600 --> 00:09:33,840
You can run the same script across hundreds of servers
286
00:09:33,840 --> 00:09:34,840
with a few clicks.
287
00:09:34,840 --> 00:09:36,840
Windows Admin Center in Azure gives you
288
00:09:36,840 --> 00:09:38,920
browser-based management for Arc servers.
289
00:09:38,920 --> 00:09:41,480
Open a console, view event logs, manage services,
290
00:09:41,480 --> 00:09:44,000
work with files, all through the Azure portal
291
00:09:44,000 --> 00:09:46,840
without a VPN or a public IP on the target server.
292
00:09:46,840 --> 00:09:49,360
The connection goes through the Arc agent's secure channel.
293
00:09:49,360 --> 00:09:52,160
That's a game changer for servers in remote locations
294
00:09:52,160 --> 00:09:53,800
or locked down environments
295
00:09:53,800 --> 00:09:56,600
where opening remote access ports isn't an option.
296
00:09:56,600 --> 00:09:58,600
Remote support provides just in time access
297
00:09:58,600 --> 00:10:00,080
with full audit logging.
298
00:10:00,080 --> 00:10:01,680
When you need to troubleshoot a problem,
299
00:10:01,680 --> 00:10:03,880
you grant temporary access through Arc.
300
00:10:03,880 --> 00:10:06,800
The session gets logged, everything that happens is recorded
301
00:10:06,800 --> 00:10:08,800
and when you're done, the access is revoked,
302
00:10:08,800 --> 00:10:11,880
no standing admin accounts, no permanent remote access paths.
303
00:10:11,880 --> 00:10:14,160
And as your automation runbooks can automate workflows
304
00:10:14,160 --> 00:10:16,840
across your hybrid environment, onboarding new servers,
305
00:10:16,840 --> 00:10:19,400
fixing configuration drift, responding to alerts.
306
00:10:19,400 --> 00:10:20,480
You write a runbook once
307
00:10:20,480 --> 00:10:22,680
and it runs across all your Arc enabled machines.
308
00:10:22,680 --> 00:10:24,520
So now you've got governance, security, monitoring,
309
00:10:24,520 --> 00:10:26,080
updates and remote management,
310
00:10:26,080 --> 00:10:28,240
all from one place for servers that aren't even in Azure.
311
00:10:28,240 --> 00:10:30,600
That's the core of what Arc delivers.
312
00:10:30,600 --> 00:10:34,360
Beyond servers, Kubernetes, SQL Server and data.
313
00:10:34,360 --> 00:10:36,560
So far, we've been talking about individual servers,
314
00:10:36,560 --> 00:10:38,320
your physical or virtual machines,
315
00:10:38,320 --> 00:10:39,840
but Arc doesn't stop there.
316
00:10:39,840 --> 00:10:43,680
It extends to Kubernetes clusters, SQL Server instances
317
00:10:43,680 --> 00:10:44,800
and even data services.
318
00:10:44,800 --> 00:10:46,040
Let's start with Kubernetes.
319
00:10:46,040 --> 00:10:47,840
If you're running Kubernetes on premises,
320
00:10:47,840 --> 00:10:51,200
on AWS, EKS or at the edge, Azure Arc projects
321
00:10:51,200 --> 00:10:53,520
those clusters into Azure resource manager,
322
00:10:53,520 --> 00:10:56,720
so they show up in the portal right alongside your other resources.
323
00:10:56,720 --> 00:11:00,040
You see all your clusters in one inventory, no matter where they run.
324
00:11:00,040 --> 00:11:01,440
Once the cluster is connected,
325
00:11:01,440 --> 00:11:04,640
you can use GitOps with Flux to define your cluster's desired state
326
00:11:04,640 --> 00:11:06,960
in a Git repository and Flux continuously
327
00:11:06,960 --> 00:11:08,720
reconciles the cluster to match it.
328
00:11:08,720 --> 00:11:10,960
Deployments, configurations, namespace settings,
329
00:11:10,960 --> 00:11:13,960
all managed through code and consistent across every environment.
330
00:11:13,960 --> 00:11:16,040
Plus, you get performance monitoring through Azure Monitor
331
00:11:16,040 --> 00:11:17,960
for containers or from the same dashboard
332
00:11:17,960 --> 00:11:19,400
you use for everything else.
333
00:11:19,400 --> 00:11:22,560
For SQL Server, Arc brings a whole new set of capabilities.
334
00:11:22,560 --> 00:11:24,440
Best practice assessments run automatically
335
00:11:24,440 --> 00:11:27,280
to evaluate your SQL instances for configuration issues,
336
00:11:27,280 --> 00:11:28,960
performance problems and security gaps
337
00:11:28,960 --> 00:11:31,960
while vulnerability scanning identifies potential weaknesses.
338
00:11:31,960 --> 00:11:33,920
And you get pay as you go licensing,
339
00:11:33,920 --> 00:11:36,600
paying per core per hour through your Azure subscription,
340
00:11:36,600 --> 00:11:38,880
even though the instance runs on your own hardware.
341
00:11:38,880 --> 00:11:42,240
Arc enabled SQL managed instance is where things get really interesting.
342
00:11:42,240 --> 00:11:44,320
It lets you run a fully managed SQL instance
343
00:11:44,320 --> 00:11:45,680
on your own infrastructure
344
00:11:45,680 --> 00:11:48,160
with the same engine as Azure SQL managed instance,
345
00:11:48,160 --> 00:11:51,320
including automatic updates, built in higher availability
346
00:11:51,320 --> 00:11:52,520
and elastic scaling.
347
00:11:52,520 --> 00:11:54,680
But it runs on your hardware in your data center,
348
00:11:54,680 --> 00:11:57,320
perfect for workloads that can't move to the cloud yet
349
00:11:57,320 --> 00:12:00,400
due to latency, regulation or legacy dependencies,
350
00:12:00,400 --> 00:12:02,680
but still need modern management.
351
00:12:02,680 --> 00:12:05,880
Migration assessments run automatically every seven days,
352
00:12:05,880 --> 00:12:08,320
evaluating your SQL databases and telling you
353
00:12:08,320 --> 00:12:09,920
what's ready to move to Azure,
354
00:12:09,920 --> 00:12:12,640
whether the right target is Azure SQL database,
355
00:12:12,640 --> 00:12:15,720
SQL managed instance or a SQL VM.
356
00:12:15,720 --> 00:12:17,600
And what blockers you need to address.
357
00:12:17,600 --> 00:12:20,680
This runs continuously so you always know where you stand.
358
00:12:20,680 --> 00:12:22,920
And for SQL Server 2012 and older,
359
00:12:22,920 --> 00:12:25,360
Arc delivers extended security updates
360
00:12:25,360 --> 00:12:27,640
without requiring you to migrate to Azure.
361
00:12:27,640 --> 00:12:29,560
The security patches come through the Arc channel
362
00:12:29,560 --> 00:12:31,240
to keep your legacy systems protected
363
00:12:31,240 --> 00:12:32,800
while you plan your next steps.
364
00:12:32,800 --> 00:12:35,160
This is where Arc becomes more than a management tool.
365
00:12:35,160 --> 00:12:36,920
You get cloud-like management and security
366
00:12:36,920 --> 00:12:38,400
on your existing infrastructure
367
00:12:38,400 --> 00:12:41,320
with a clear path to migration when you're ready.
368
00:12:41,320 --> 00:12:45,720
The multi-cloud reality, managing AWS and GCP.
369
00:12:45,720 --> 00:12:48,880
What about when your servers live inside another cloud entirely?
370
00:12:48,880 --> 00:12:50,440
Arc has an answer for that too.
371
00:12:50,440 --> 00:12:52,840
The multi-cloud connector for AWS is a resource
372
00:12:52,840 --> 00:12:55,680
you create an Azure that connects to your AWS environment,
373
00:12:55,680 --> 00:13:00,680
discovers EC2 instances, S3 buckets, and over 125 resource types,
374
00:13:00,680 --> 00:13:03,200
and replicates them all into Azure resource manager.
375
00:13:03,200 --> 00:13:06,640
So you see AWS resources alongside your Azure resources
376
00:13:06,640 --> 00:13:09,440
in the portal across Azure resource graph queries
377
00:13:09,440 --> 00:13:10,800
and in your dashboards.
378
00:13:10,800 --> 00:13:13,200
The connector can automatically install the Arc agent
379
00:13:13,200 --> 00:13:15,160
on discovered EC2 instances
380
00:13:15,160 --> 00:13:17,400
so you don't have to manually onboard each one.
381
00:13:17,400 --> 00:13:19,600
It identifies your AWS servers,
382
00:13:19,600 --> 00:13:22,960
installs the agent and brings them under Azure management.
383
00:13:22,960 --> 00:13:25,240
And when new instances spin up in AWS,
384
00:13:25,240 --> 00:13:27,920
they're automatically discovered and onboarded.
385
00:13:27,920 --> 00:13:29,360
For Google Cloud Platform,
386
00:13:29,360 --> 00:13:31,920
a similar connector brings inventory visibility
387
00:13:31,920 --> 00:13:33,360
and management capabilities.
388
00:13:33,360 --> 00:13:35,200
You provide your GCP project details
389
00:13:35,200 --> 00:13:36,760
and the connector discovers resources
390
00:13:36,760 --> 00:13:38,480
and makes them visible in Azure.
391
00:13:38,480 --> 00:13:40,040
Once these machines are connected,
392
00:13:40,040 --> 00:13:43,360
you can run Azure Policy and Azure Update Manager across them.
393
00:13:43,360 --> 00:13:45,400
The same policies you apply to your Azure VMs
394
00:13:45,400 --> 00:13:48,240
and on-prem servers now apply to machines running in AWS
395
00:13:48,240 --> 00:13:50,400
and GCP with the same update schedules
396
00:13:50,400 --> 00:13:53,320
and the same compliance reporting or from one place.
397
00:13:53,320 --> 00:13:54,760
This gives you a single pane of glass
398
00:13:54,760 --> 00:13:57,120
for all servers regardless of provider.
399
00:13:57,120 --> 00:14:00,640
You stop thinking about my Azure servers and my AWS servers
400
00:14:00,640 --> 00:14:02,840
and start thinking about simply my servers.
401
00:14:02,840 --> 00:14:04,880
The location becomes a property of the resource,
402
00:14:04,880 --> 00:14:06,880
not a separate management domain.
403
00:14:06,880 --> 00:14:08,160
What Arc is not?
404
00:14:08,160 --> 00:14:09,560
Clearing up confusion.
405
00:14:09,560 --> 00:14:11,280
Now that you've seen what Arc can do,
406
00:14:11,280 --> 00:14:12,880
let's clear up a few common myths.
407
00:14:12,880 --> 00:14:14,040
Here's what Arc is not.
408
00:14:14,040 --> 00:14:16,280
Myth number one is Azure Arc a Cloud?
409
00:14:16,280 --> 00:14:16,960
No.
410
00:14:16,960 --> 00:14:19,320
It doesn't give you compute storage or networking.
411
00:14:19,320 --> 00:14:21,040
It doesn't run your applications.
412
00:14:21,040 --> 00:14:22,400
Think of it as a management layer.
413
00:14:22,400 --> 00:14:24,080
It connects your existing infrastructure
414
00:14:24,080 --> 00:14:25,320
to Azure's management tools.
415
00:14:25,320 --> 00:14:26,840
Your workloads stay where they are.
416
00:14:26,840 --> 00:14:28,760
Arc just gives you a better way to manage them.
417
00:14:28,760 --> 00:14:31,120
Imagine you have a building with its own security system.
418
00:14:31,120 --> 00:14:32,440
Arc doesn't move the building.
419
00:14:32,440 --> 00:14:33,840
It just installs a new smart lock
420
00:14:33,840 --> 00:14:35,720
you can control from anywhere.
421
00:14:35,720 --> 00:14:38,320
Myth number two, does Arc migrate your servers?
422
00:14:38,320 --> 00:14:39,160
Not at all.
423
00:14:39,160 --> 00:14:40,120
Nothing moves.
424
00:14:40,120 --> 00:14:42,120
The machine stays right where it is.
425
00:14:42,120 --> 00:14:45,320
In your data center on AWS or wherever you run it,
426
00:14:45,320 --> 00:14:48,080
Arc creates a pointer in Azure resource manager, not a copy.
427
00:14:48,080 --> 00:14:50,080
Think of it as a bookmark instead of a photocopied.
428
00:14:50,080 --> 00:14:52,920
The actual workload never leaves its original location.
429
00:14:52,920 --> 00:14:55,760
Myth number three, do you need Arc on a VM that's already in Azure?
430
00:14:55,760 --> 00:14:56,600
No.
431
00:14:56,600 --> 00:14:59,200
Native Azure VMs already have the Azure VM agent built in.
432
00:14:59,200 --> 00:15:01,480
That agent gives you the same management capabilities.
433
00:15:01,480 --> 00:15:03,280
Arc is only for machines outside Azure.
434
00:15:03,280 --> 00:15:06,600
If your VM is already in Azure, you're already set.
435
00:15:06,600 --> 00:15:10,080
Myth number four is Arc a replacement for your current tools?
436
00:15:10,080 --> 00:15:10,720
No.
437
00:15:10,720 --> 00:15:13,680
It adds Azure's capabilities on top of what you already have.
438
00:15:13,680 --> 00:15:16,600
You can keep using System Center, Configuration Manager,
439
00:15:16,600 --> 00:15:18,280
or whatever tools you've invested in,
440
00:15:18,280 --> 00:15:19,800
Arc complements those tools.
441
00:15:19,800 --> 00:15:21,960
It adds a new layer of cloud-based governance
442
00:15:21,960 --> 00:15:25,960
and security that your existing tools might not offer.
443
00:15:25,960 --> 00:15:27,920
Myth number five, what about the agent?
444
00:15:27,920 --> 00:15:28,600
Is it heavy?
445
00:15:28,600 --> 00:15:29,880
No, it's lightweight.
446
00:15:29,880 --> 00:15:32,520
Uses minimal CPU and memory, and it's free.
447
00:15:32,520 --> 00:15:34,760
The cost comes from the services you enable on top,
448
00:15:34,760 --> 00:15:36,760
like Defender for Cloud or Azure Monitor,
449
00:15:36,760 --> 00:15:38,800
connecting a server costs nothing.
450
00:15:38,800 --> 00:15:41,200
Zero, Zilch.
451
00:15:41,200 --> 00:15:44,080
Myth number six is Arc only for servers?
452
00:15:44,080 --> 00:15:46,680
No, it works with Kubernetes, SQL Server,
453
00:15:46,680 --> 00:15:48,160
data services, and more.
454
00:15:48,160 --> 00:15:50,240
It's a platform that extends as your management
455
00:15:50,240 --> 00:15:53,320
to any resource type anywhere you have it running.
456
00:15:53,320 --> 00:15:55,120
The big picture, one control plane.
457
00:15:55,120 --> 00:15:56,680
So what does all of this add up to?
458
00:15:56,680 --> 00:15:59,000
Here's the thing, the real value of Azure Arc
459
00:15:59,000 --> 00:16:00,280
isn't any single feature.
460
00:16:00,280 --> 00:16:02,920
It's integration, not the agent, not the policies,
461
00:16:02,920 --> 00:16:04,040
not the monitoring.
462
00:16:04,040 --> 00:16:05,920
It's how all these pieces work together
463
00:16:05,920 --> 00:16:07,680
to give you one consistent way
464
00:16:07,680 --> 00:16:09,720
to manage every server you own.
465
00:16:09,720 --> 00:16:11,160
Now imagine your day to day.
466
00:16:11,160 --> 00:16:13,440
You stop jumping between four different portals.
467
00:16:13,440 --> 00:16:15,160
You stop worrying if a policy was applied
468
00:16:15,160 --> 00:16:17,400
to that one server running in AWS.
469
00:16:17,400 --> 00:16:18,880
You stop searching through different tools
470
00:16:18,880 --> 00:16:19,960
for the information you need.
471
00:16:19,960 --> 00:16:22,720
Instead, you have one place to govern, one to monitor,
472
00:16:22,720 --> 00:16:24,760
one to secure, one to patch.
473
00:16:24,760 --> 00:16:27,160
Your entire server estate, no matter where it lives,
474
00:16:27,160 --> 00:16:28,800
managed through a single control plane.
475
00:16:28,800 --> 00:16:30,080
That's the magic of it.
476
00:16:30,080 --> 00:16:32,120
And getting started is easier than you think.
477
00:16:32,120 --> 00:16:34,360
The hardest part only takes about 10 minutes.
478
00:16:34,360 --> 00:16:36,200
First, register the resource providers
479
00:16:36,200 --> 00:16:37,560
in your Azure subscription,
480
00:16:37,560 --> 00:16:39,400
then install the agent on one server.
481
00:16:39,400 --> 00:16:40,880
Watch it appear in the portal
482
00:16:40,880 --> 00:16:43,120
from there you add capabilities one at a time.
483
00:16:43,120 --> 00:16:45,440
Enable Azure policy, turn on Defender for Cloud,
484
00:16:45,440 --> 00:16:47,080
set up update manager.
485
00:16:47,080 --> 00:16:48,400
Each step builds on the last.
486
00:16:48,400 --> 00:16:50,080
You don't have to do everything at once.
487
00:16:50,080 --> 00:16:52,080
Start small and grow from there.
488
00:16:52,080 --> 00:16:52,960
Start simple.
489
00:16:52,960 --> 00:16:55,480
Head to the Azure portal, find Azure Arc,
490
00:16:55,480 --> 00:16:57,520
pick servers and hit create.
491
00:16:57,520 --> 00:16:59,360
Choose your subscription and resource group,
492
00:16:59,360 --> 00:17:00,840
generate the onboarding script
493
00:17:00,840 --> 00:17:02,320
and run it on a test machine.
494
00:17:02,320 --> 00:17:03,960
About 10 minutes later, you'll see a server
495
00:17:03,960 --> 00:17:05,920
that isn't inside Azure sitting right there
496
00:17:05,920 --> 00:17:07,840
in your portal ready to manage.
497
00:17:07,840 --> 00:17:10,040
That one experiment teaches you more about what Arc
498
00:17:10,040 --> 00:17:12,080
actually does than anything I can explain here.
499
00:17:12,080 --> 00:17:14,520
Subscribe to the show for more knowledge nuggets like this.
500
00:17:14,520 --> 00:17:17,480
Every week we break down Microsoft's platform in plain English
501
00:17:17,480 --> 00:17:18,920
and drop a comment with your biggest question
502
00:17:18,920 --> 00:17:20,800
about hybrid or multi-cloud management.
503
00:17:20,800 --> 00:17:22,040
I read every single one.
