To manage on-premises Windows Servers from Azure, you install the Azure Connected Machine Agent and register each server with Azure Arc. First, ensure the operating system is compatible and that you have a Log Analytics workspace ready in Azure to receive the agent's data. You also need the right Azure permissions to manage the workspace. The agent communicates with Azure over TCP port 443, and you can choose how it connects. The simplest way is direct internet access. You can also route traffic through a Log Analytics Gateway or use a more secure hybrid network like VPN or ExpressRoute.
A system architecture diagram showing an on-premises server with the Azure Connected Machine Agent connecting to Azure Arc via three network paths: direct internet, Log Analytics Gateway, and VPN or ExpressRoute.
Installation uses PowerShell or Azure CLI. After running the script on each server, verify the registration in the Azure Arc portal. Once the agent is installed, assign roles in Azure so users can interact with the machine and apply Azure Policy to enforce rules across your hybrid servers. This process brings your on-premises servers into Azure's management system, giving you a single view and consistent policy control.
Desired State Configuration (DSC) is a PowerShell tool that defines how a computer should be set up. You write these definitions as PowerShell scripts. For example, a script can require that a specific Windows feature, like IIS, is installed. To use these scripts in Azure, you import them into Azure Automation State Configuration. You use a PowerShell command to publish your script file to your Automation Account.
After importing a configuration, Azure Automation compiles it into a ready-to-use format called a node configuration. You then register your target machines, which can be Azure VMs or on-premises servers, as managed nodes with the Automation service. Finally, you assign the specific compiled node configuration to each registered node. This tells the Automation service exactly how that machine should be configured.
Once a configuration is assigned, the DSC agent on the managed node regularly checks its own settings against the desired state. You control how often this check happens and what the node should do if it finds a difference, or drift. The node can automatically fix the drift or just report it. You monitor this by viewing compliance reports from Azure Automation for each node. You can also integrate with Azure Policy to automatically report on and fix configuration drift across many machines at once, keeping your hybrid Windows Server environment consistent.
Azure VM Extensions are tools that add cloud capabilities to virtual machines, including machines not hosted in Azure. These extensions let you bring features like automation, security, and monitoring to servers in your own data center. They act like plugins that install on a VM and connect it to Azure services, making a local server behave like an Azure virtual machine.
The Hybrid Worker Extension lets a VM run Azure Automation runbooks, which are scripts that automate tasks. To install it, you first get the automation account URL, then run a PowerShell command to place the extension on the target machine. The command differs for Windows (HybridWorkerForWindows) and Linux (HybridWorkerForLinux). The extension can be set to update automatically or you can control updates manually.
For the extension to work, the target machine must have outbound internet access on port 443. The firewall must allow connections to URLs ending in .azure-automation.net. If the network uses a proxy server, you must configure the proxy settings on the VM before installing the extension.
The extension-based approach is better than older methods. It removes the need for a separate Log Analytics Agent, simplifying setup. Because it integrates with Azure Resource Manager, you can manage groups of machines with the same tools used for Azure VMs. It works with Microsoft Entra ID for secure authentication. Finally, it creates a unified experience where Azure VMs and non-Azure machines (enabled with Azure Arc) are managed through the same portal.
After installation, confirm the extension is working by checking that runbooks can be executed on the target machine and that the extension shows a healthy status in Azure monitoring tools.
Azure Update Manager is a service that manages Windows Server updates across hybrid environments. To control when updates happen, you create maintenance configurations in Azure. These set recurring schedules, called maintenance windows, so systems only update during approved times. You can choose windows during low-traffic hours, set schedules for different types of machines, and defer updates during critical business periods to prevent unexpected restarts.
Managing updates for many servers is easier when you group them into collections. These collections organize virtual machines based on their roles, workloads, or locations. You can then assign a single maintenance configuration to an entire group at once, ensuring consistent rules apply to all member servers automatically.
You can apply updates across hundreds of servers using automated workflows. You start and manage these large-scale deployments using the Azure portal, PowerShell, or the Azure CLI. Automating the patching sequence reduces manual work and the risk of human error, ensuring security patches are distributed uniformly.
After deployment, Azure Update Manager provides detailed compliance reports. These reports show whether machines are in a compliant or non-compliant state and identify any updates that failed to install. When a failure is detected, you can quickly plan and execute fixes to secure the affected systems. Monitoring these reports continuously helps close security gaps quickly.
Hybrid Runbook Workers are machines that run runbooks from Azure Automation on local resources. The newer Extension-based Hybrid Worker uses the VM extension framework, so you don't need the Log Analytics agent. Onboarding is simpler and uses system-assigned managed identities for secure, password-free access to Azure resources. This approach works consistently for both Azure VMs and non-Azure machines enabled through Azure Arc.
Before deploying a hybrid worker, the machine must meet system requirements for CPU and RAM. It needs the Azure Connected Machine agent and must have system-assigned managed identities enabled. Supported operating systems include Windows Server 2019/2022 and Linux like Ubuntu. Once deployed, you manage workers as part of a hybrid worker group, which groups workers together for runbook execution.
Runbooks on hybrid workers can directly manage local machine resources or interact with the local environment. You should test a runbook on the machine that hosts the worker. For authentication, use managed identities or configure the runbook with its own credentials. Runbooks on hybrid workers cannot use cloud-based authentication from the Azure portal. Long-running runbooks should be able to handle worker machine restarts.
Hybrid workers need outbound internet access on TCP port 443 to reach Azure Automation. Specific URLs must be accessible, and you can route traffic through a proxy server. To control network access in Azure, use the GuestAndHybridManagement service tag in network security groups. This tag automatically includes the required Azure IP ranges.
Hybrid Runbook Workers are useful for many tasks. You can schedule VM operations like starting or stopping VMs. They can perform periodic maintenance like data purging. For resource lifecycle management, you can create or delete VMs automatically. You can also integrate runbooks with monitoring tools to check resource availability and trigger automated responses to problems.
Since the older Agent-based Hybrid Workers are being retired, you must migrate to Extension-based workers. If problems occur, consult troubleshooting guides. Common issues involve network connectivity, permissions, or the worker not having the correct managed identity. Check the network first, then verify the machine meets system requirements and that the managed identity has the right Azure permissions.
Azure Automation runbooks are scripts that automate tasks in your hybrid environment. You author these runbooks using graphical, PowerShell, or Python editors within the Azure portal. Once created, you can test them in a sandbox environment before assigning them to run on Hybrid Runbook Workers or directly in Azure. Runbooks can perform a wide variety of actions, such as managing resources, processing data, or responding to alerts, helping you automate repetitive operations across both cloud and on-premises systems.
Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Prepare and test your skills
Prepare and test your skills
The Azure Connected Machine Agent communicates with Azure over TCP port 443, and the simplest connection method is direct internet access. You can also route traffic through a Log Analytics Gateway or use a more secure hybrid network like VPN or ExpressRoute.
Azure VM Extensions act like plugins that install on a virtual machine and connect it to Azure services, making a local server behave like an Azure virtual machine. They let you bring features like automation, security, and monitoring to servers in your own data center.
The newer Extension-based Hybrid Worker uses the VM extension framework so you do not need the Log Analytics agent, simplifying setup. It integrates with Azure Resource Manager and uses system-assigned managed identities for secure, password-free access, creating a unified management experience for both Azure VMs and non-Azure machines enabled through Azure Arc.
The DSC agent on the managed node regularly checks its own settings against the desired state. If it finds a difference, called drift, the node can automatically fix the drift or just report it, and you monitor this by viewing compliance reports from Azure Automation for each node.
StudyCerts
StudyCerts