Azure Arc for the Servers You Are Keeping: What You Get and What Is Charged

You install the Azure Connected Machine agent on a Windows or Linux server, manually or at scale, and the machine becomes an Azure resource with its own Resource ID in a resource group. From then on you manage it like a native Azure VM. Microsoft's supported list runs from Windows Server 2012 through 2025 and across current RHEL, Ubuntu, SLES, Oracle, Rocky and Alma releases, 64-bit only.

The agent sends a heartbeat every five minutes. Miss it and the machine shows as Disconnected within 15 to 30 minutes; stay disconnected for 45 days and it can move to Expired, after which an administrator must reconnect it. There is no limit on the number of Arc-enabled servers in a resource group or subscription, and Arc is not for machines already running in Azure.

The metadata Arc collects, such as operating system, computer name, FQDN and agent version, stays in the region you chose when you generated the onboarding script. Connectivity can go through the public endpoint, a proxy, the Azure Arc gateway or a private endpoint; the design conversation is about outbound access.

Microsoft's Azure Arc overview lists the control-plane functions offered at no extra cost for Arc-enabled servers: resource organization through management groups and tags, search and indexing through Azure Resource Graph, access control through Azure RBAC, and environments and automation through templates and extensions. That is the inventory layer.

A second layer opens if your Windows Server licenses carry active Software Assurance or are active subscription licenses. Windows Server Management enabled by Azure Arc gives those servers Azure Update Manager, Change Tracking and Inventory, Azure Machine Configuration, Windows Admin Center in Azure, Remote Support, Best Practices Assessment, Azure Site Recovery configuration and Network HUD on Windows Server 2025, at no extra cost beyond networking, storage and log ingestion. The catch is attestation: you must explicitly attest to the licensing for each server, or enroll in Windows Server pay-as-you-go through Arc. Microsoft states eligibility is not inferred from the Arc connection itself. It needs agent version 1.47 or later and a Connected status.

Without attestation, Microsoft says customers can still purchase Update Manager, Change Tracking and Inventory, and Machine Configuration for their Arc-enabled servers; the other services in that list are not available to them through Arc.

Hotpatching for Windows Server 2025 sits outside those rules. Microsoft states it is available to all customers who Arc-enable a 2025 server, and our deadlines page records that the hotpatch subscription charge was removed on May 19, 2026.

Windows Server 2012 and 2012 R2 left support on October 10, 2023; their Extended Security Updates program ends on October 13, 2026, and nothing is sold after that. Windows Server 2016 leaves extended support on January 12, 2027, and Microsoft's billing page says ESU billing through Arc begins on January 13, 2027, with licenses provisioned later back-billed to the end-of-support date. Microsoft's prerequisites page lists the expected end of Arc support for Windows Server 2012 and 2012 R2 as November 2026.

The mechanics are the same for both versions. You provision an ESU license in the Azure portal, choosing Standard or Datacenter and physical or virtual cores, and attest to Software Assurance or an equivalent subscription. Physical-core licenses need at least 16 cores per machine; virtual-core licenses need at least eight per VM and cannot be used on physical hosts. A Standard license covers up to two VMs, Datacenter an unlimited number. You then link the license to the Arc-enabled servers it covers.

Billing is monthly, on cores and edition. Enroll after the end-of-support date and Microsoft back-bills to that date; deactivate and reactivate and you pay for the gap; deactivate or delete and billing continues for up to five more days. Windows Server 2016 differs in two ways: SPLA is not available, and there is no Visual Studio dev/test exemption.

Updates arrive through whichever patching tool you already use: Update Manager, WSUS, Microsoft Update, Configuration Manager or a third-party product. Enrolled servers also get Update Manager, Change Tracking and Inventory and Azure Policy guest configuration at no additional charge. SQL Server 2016, whose extended support ended on July 14, 2026, has its own ESU path through Arc with a window that closes on July 17, 2029.

Microsoft's rule is short: any Azure service used on an Arc-enabled server, such as Microsoft Defender for Cloud or Azure Monitor, is charged at that service's own pricing.

Defender for Servers, delivered through Defender for Cloud, protects the machine with Defender for Endpoint, vulnerability management and threat detection. It is charged per the Defender for Cloud price list and billed by Microsoft to your subscription; it is not on the Software Assurance benefits list.

Azure Update Manager is included for servers covered by attestation or enrolled in ESU, and is otherwise purchasable for Arc-enabled servers. Azure Machine Configuration, the policy engine that audits settings inside the operating system, follows the Azure Policy pricing guide unless attestation or ESU covers it.

Change Tracking and Inventory and the Best Practices Assessment need a Log Analytics workspace, and Microsoft notes that data ingestion there might incur costs even when the feature is included. The same applies to VM insights, any logs the Azure Monitor agent ships to a workspace, and Microsoft Sentinel if you connect it. Azure Site Recovery configuration is included; the Site Recovery service, its storage, compute and networking are not.

Every one of those meters is a Microsoft charge on your Azure invoice.

Which servers. Arc should follow the lifecycle decision, not precede it: the machines you have chosen to keep on-premises for a defined period, each with an owner and a review date.

Licensing status. Know which Windows Server licenses carry Software Assurance or a subscription, because that decides whether attestation unlocks the included services and whether an ESU license can be provisioned at all.

Networking and region. Choose the connectivity path and the Azure region deliberately; Arc metadata stays in that region.

Workspace and retention. If you will use Change Tracking, VM insights or Sentinel, size the Log Analytics workspace and set retention before the agents start sending data; ingestion is the meter most likely to surprise.

Roles and tags. ESU licensing needs the Contributor role. Agree a tag standard up front, including Microsoft's ESU Usage tags for Visual Studio dev/test and disaster recovery machines, which ride on a paid production license.

Exit dates. Windows Server 2012 R2 needs a plan that ends before November 2026. Windows Server 2016 needs an ESU-or-migrate decision before January 2027; our Windows Server 2016 end of support assessment is built for that decision.

Is Azure Arc itself charged?

The control plane, meaning the resource, tags, Resource Graph search, RBAC and extensions, is offered at no extra cost. Every Azure service you attach, from Defender for Servers to Log Analytics, is charged at its own price, and ESU licenses are billed monthly per core.

Do we need Software Assurance?

Not to connect a server. You need Software Assurance or an equivalent subscription to attest for Windows Server Management benefits and to provision Windows Server ESU licenses; for Windows Server 2012 and 2012 R2, SPLA also qualifies.

Can Arc patch our servers?

Azure Update Manager assesses and installs updates on Arc-enabled servers on schedules and maintenance windows. It still needs an update source such as Microsoft Update or WSUS; our WSUS replacement with Azure Update Manager service does that swap.

What if a server goes offline?

It shows Disconnected within 15 to 30 minutes and can become Expired after 45 days, after which it must be reconnected. The included benefits require a Connected status.

Does Arc replace migration?

No. It is the management plane for what stays. Windows Server 2012 R2 on Arc loses ESU in October 2026 and Arc support in November 2026; Arc buys visibility, not time.