Installation uses PowerShell or Azure CLI. After running the script on each server, verify the registration in the Azure Arc portal. Once the agent is installed, assign roles in Azure so users can interact with the machine and apply Azure Policy to enforce rules across your hybrid servers. This process brings your on-premises servers into Azure's management system, giving you a single view and consistent policy control.
Implement Azure Machine Configuration
Authoring and Importing DSC Configurations
Desired State Configuration (DSC) is a PowerShell tool that defines how a computer should be set up. You write these definitions as PowerShell scripts. For example, a script can require that a specific Windows feature, like IIS, is installed. To use these scripts in Azure, you import them into Azure Automation State Configuration. You use a PowerShell command to publish your script file to your Automation Account.
Assigning Configurations to Nodes
After importing a configuration, Azure Automation compiles it into a ready-to-use format called a node configuration. You then register your target machines, which can be Azure VMs or on-premises servers, as managed nodes with the Automation service. Finally, you assign the specific compiled node configuration to each registered node. This tells the Automation service exactly how that machine should be configured.
Once a configuration is assigned, the DSC agent on the managed node regularly checks its own settings against the desired state. You control how often this check happens and what the node should do if it finds a difference, or drift. The node can automatically fix the drift or just report it. You monitor this by viewing compliance reports from Azure Automation for each node. You can also integrate with Azure Policy to automatically report on and fix configuration drift across many machines at once, keeping your hybrid Windows Server environment consistent.
Deploy Azure services using VM extensions on non-Azure machines
What VM Extensions Do
Azure VM Extensions are tools that add cloud capabilities to virtual machines, including machines not hosted in Azure. These extensions let you bring features like automation, security, and monitoring to servers in your own data center. They act like plugins that install on a VM and connect it to Azure services, making a local server behave like an Azure virtual machine.
Installing the Hybrid Worker Extension
The Hybrid Worker Extension lets a VM run Azure Automation runbooks, which are scripts that automate tasks. To install it, you first get the automation account URL, then run a PowerShell command to place the extension on the target machine. The command differs for Windows (HybridWorkerForWindows) and Linux (HybridWorkerForLinux). The extension can be set to update automatically or you can control updates manually.
Network and Security Requirements
For the extension to work, the target machine must have outbound internet access on port 443. The firewall must allow connections to URLs ending in .azure-automation.net. If the network uses a proxy server, you must configure the proxy settings on the VM before installing the extension.
Why Use Extension-Based Workers
The extension-based approach is better than older methods. It removes the need for a separate Log Analytics Agent, simplifying setup. Because it integrates with Azure Resource Manager, you can manage groups of machines with the same tools used for Azure VMs. It works with Microsoft Entra ID for secure authentication. Finally, it creates a unified experience where Azure VMs and non-Azure machines (enabled with Azure Arc) are managed through the same portal.
Verifying the Deployment
After installation, confirm the extension is working by checking that runbooks can be executed on the target machine and that the extension shows a healthy status in Azure monitoring tools.
Manage updates by using Azure Update Manager
Define Update Configurations and Maintenance Windows
Azure Update Manager is a service that manages Windows Server updates across hybrid environments. To control when updates happen, you create maintenance configurations in Azure. These set recurring schedules, called maintenance windows, so systems only update during approved times. You can choose windows during low-traffic hours, set schedules for different types of machines, and defer updates during critical business periods to prevent unexpected restarts.
Group Servers into Update Collections
Managing updates for many servers is easier when you group them into collections. These collections organize virtual machines based on their roles, workloads, or locations. You can then assign a single maintenance configuration to an entire group at once, ensuring consistent rules apply to all member servers automatically.
Deploy Patches at Scale
You can apply updates across hundreds of servers using automated workflows. You start and manage these large-scale deployments using the Azure portal, PowerShell, or the Azure CLI. Automating the patching sequence reduces manual work and the risk of human error, ensuring security patches are distributed uniformly.
Analyze Compliance Reports
After deployment, Azure Update Manager provides detailed compliance reports. These reports show whether machines are in a compliant or non-compliant state and identify any updates that failed to install. When a failure is detected, you can quickly plan and execute fixes to secure the affected systems. Monitoring these reports continuously helps close security gaps quickly.
Implement Azure Automation for hybrid workloads
Deploy Extension-based Hybrid Runbook Workers
Hybrid Runbook Workers are machines that run runbooks from Azure Automation on local resources. The newer Extension-based Hybrid Worker uses the VM extension framework, so you don't need the Log Analytics agent. Onboarding is simpler and uses system-assigned managed identities for secure, password-free access to Azure resources. This approach works consistently for both Azure VMs and non-Azure machines enabled through Azure Arc.
Integrate and Manage Hybrid Workers
Before deploying a hybrid worker, the machine must meet system requirements for CPU and RAM. It needs the Azure Connected Machine agent and must have system-assigned managed identities enabled. Supported operating systems include Windows Server 2019/2022 and Linux like Ubuntu. Once deployed, you manage workers as part of a hybrid worker group, which groups workers together for runbook execution.
Runbooks on Hybrid Runbook Workers
Runbooks on hybrid workers can directly manage local machine resources or interact with the local environment. You should test a runbook on the machine that hosts the worker. For authentication, use managed identities or configure the runbook with its own credentials. Runbooks on hybrid workers cannot use cloud-based authentication from the Azure portal. Long-running runbooks should be able to handle worker machine restarts.
Network Planning
Hybrid workers need outbound internet access on TCP port 443 to reach Azure Automation. Specific URLs must be accessible, and you can route traffic through a proxy server. To control network access in Azure, use the GuestAndHybridManagement service tag in network security groups. This tag automatically includes the required Azure IP ranges.
Common Scenarios
Hybrid Runbook Workers are useful for many tasks. You can schedule VM operations like starting or stopping VMs. They can perform periodic maintenance like data purging. For resource lifecycle management, you can create or delete VMs automatically. You can also integrate runbooks with monitoring tools to check resource availability and trigger automated responses to problems.
Migration and Troubleshooting
Since the older Agent-based Hybrid Workers are being retired, you must migrate to Extension-based workers. If problems occur, consult troubleshooting guides. Common issues involve network connectivity, permissions, or the worker not having the correct managed identity. Check the network first, then verify the machine meets system requirements and that the managed identity has the right Azure permissions.
Create Azure Automation runbooks
Azure Automation runbooks are scripts that automate tasks in your hybrid environment. You author these runbooks using graphical, PowerShell, or Python editors within the Azure portal. Once created, you can test them in a sandbox environment before assigning them to run on Hybrid Runbook Workers or directly in Azure. Runbooks can perform a wide variety of actions, such as managing resources, processing data, or responding to alerts, helping you automate repetitive operations across both cloud and on-premises systems.
StudyCerts
StudyCerts