To bring on‑premises Windows Servers into Azure management, you install the Azure Connected Machine Agent and register each server with Azure Arc. Before you begin, confirm that the operating system is compatible and that you have a Log Analytics workspace ready in Azure to receive the data the agent will send. You also need the right permissions: Azure AD roles and resource‑level permissions must allow you to manage the workspace, and system‑assigned managed identities should be enabled on the target servers to handle authentication.
The agent communicates with Azure Monitor over TCP port 443, and you have three connectivity choices. The simplest option is to let the machine reach the public internet directly. If you need an intermediate hop, you can route traffic through a Log Analytics Gateway. For a more direct and secure path, use a hybrid networking solution such as VPN or ExpressRoute. Whatever you choose, ensure the network path is open and stable.
A system architecture diagram showing three connectivity options for on-premises servers running the Azure Connected Machine Agent to communicate with Azure Monitor over TCP port 443: direct public internet, Log Analytics Gateway, and hybrid networking via VPN or ExpressRoute.
Installation uses either PowerShell or Azure CLI. Run the deployment script on each server, and then monitor the registration process to verify that the server appears in the Azure Arc portal. Once the agent is installed, assign roles in Azure so that users and services can interact with the machine, and apply Azure Policy to enforce compliance settings across your hybrid fleet. By following these steps, you bring your on‑premises servers into the same management plane as your Azure resources, giving you a unified view and consistent policy enforcement.
Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Prepare and test your skills
Prepare and test your skills
The Azure Connected Machine Agent can communicate with Azure Monitor over TCP port 443 using one of three connectivity choices: direct internet access, routing traffic through a Log Analytics Gateway, or using a hybrid networking solution like VPN or ExpressRoute.
Before installing the Azure Connected Machine Agent, you must confirm the operating system is compatible, have a Log Analytics workspace ready in Azure, and ensure you have the correct Azure AD roles and resource-level permissions to manage that workspace. Additionally, system-assigned managed identities should be enabled on the target servers for authentication.
You install the Azure Connected Machine Agent using either PowerShell or Azure CLI by running the deployment script on each server. After installation, you monitor the registration process to verify the server appears in the Azure Arc portal.
StudyCerts
StudyCerts