Azure Arc - Centralized Management of On-Premises

A organisation runs a hybrid estate: Azure cloud resources alongside on-premises servers. The on-prem servers are managed entirely by hand. Engineers SSH into each machine to check configurations, apply patches, and review security settings.

Security audits kept failing. The servers did not follow a standard security configuration, and nothing detected when a setting drifted away from the expected baseline.

What was happening

• Password policies were inconsistent across servers
• SSH was configured differently on each machine
• File permissions (for example `/etc/passwd`) were not standardised
• Audit logging was enabled on some servers and missing on others
• Nobody knew when a setting changed, or who changed it

Current state

Business impact

The core question

How do we define, enforce, continuously audit, and monitor a security baseline on on-premises Linux servers from one place, without migrating them to the cloud and without buying a new configuration management platform?

Manual audits cannot keep up with a hybrid estate. A server can be compliant on Monday and drift by Wednesday, and a spreadsheet will not notice. This use case replaces point-in-time checks with continuous, centralised evaluation.

Root cause analysis

Options considered

What the organisation gains

For the organisation:

• Documented evidence to pass security audits
• Lower risk of non-compliance fines
• No new configuration management licences to buy
• New servers inherit the same policies automatically when onboarded into the resource group

For the IT team:

• No more logging into every server to check settings
• Alerts when a server goes offline or runs out of resources
• Audit reports in seconds using KQL
• One portal for inventory, compliance, and monitoring

Use this pattern when servers must stay where they are but you want them governed as though they were in Azure.

Use this approach when

• You run a hybrid estate. Some workloads are in Azure and some are on-prem or in another cloud, and you want one view of all of them.
• You are failing, or preparing for, compliance audits. Examples include ISO 27001, SOC 2, PCI DSS, NIS2, and CIS benchmarks, where auditors need evidence that controls are enforced continuously, not checked once a quarter.
• Configuration drift is a real risk. Many admins have SSH access, changes are made by hand, and there is no change tracking.
• You already pay for Azure. Arc onboarding for inventory is free. You pay for Policy machine configuration, Log Analytics ingestion, and alerts, rather than a new product licence.
• Servers cannot move to the cloud. The reasons may be data residency, latency, hardware dependencies, or migration cost.
• You need one dashboard for leadership. A compliance percentage per server and per policy, visible in the Azure portal.

Typical triggers example

• Audit finding - Password policy not enforced on 12 of 30 Linux servers
• Security incident - An SSH setting was weakened and nobody noticed for weeks
• New regulation - A directive requires continuous monitoring of server configuration
• Merger or acquisition - You inherit servers with unknown configuration
• Scale - The server count grows past what manual checks can cover

When this is not the right fit

• You need immediate, sub-minute detection of a config change. Machine Configuration evaluates periodically (about every 15 minutes), and compliance results can take longer to appear in the portal. For real-time change detection, add file integrity monitoring (for example Defender for Servers or Change Tracking).
• You need to enforce settings, not just report them. The policies in this lab use the Audit effect. Automatic correction requires `AuditAndSet` / `ApplyAndMonitor` machine configuration assignments, or a separate tool such as Ansible.
• You have no Azure subscription and no plan to adopt Azure.

Accounts and Access

• An Azure subscription with Owner, or Contributor + Resource Policy Contributor, rights on the resource group you create
• Azure Connected Machine Onboarding permission (included in Contributor)
• An email address that can receive alert notifications

Tools on your local machine

Resource providers

Register these once per subscription:

az provider register --namespace Microsoft.HybridCompute
az provider register --namespace Microsoft.GuestConfiguration
az provider register --namespace Microsoft.HybridConnectivity
az provider register --namespace Microsoft.AzureArcData
az provider register --namespace Microsoft.Insights
az provider register --namespace Microsoft.OperationalInsights

Knowledge assumed

• Basic familiarity with KQL is helpful but not required
• Navigating the Azure portal
• Basic Linux administration (SSH, systemctl, ufw)