Azure Arc for the Servers You Are Keeping: What You Get and What Is Charged

Four things set the Azure invoice for an Arc-enabled server: whether its Windows Server license carries active Software Assurance or is a subscription license, because that decides whether the management benefits are included; whether it is enrolled in Extended Security Updates; which Azure services you attach to it; and how much log data those services send to a Log Analytics workspace. The table is the whole answer for the rows people ask about; the sections that follow explain each row and where it comes from.

Every charge in this table is Microsoft's and is billed to you on your Azure invoice; none of it is a fee of ours.

You install the Azure Connected Machine agent on a Windows or Linux server, manually or at scale, and the machine becomes an Azure resource with its own Resource ID in a resource group. From then on you manage it like a native Azure VM. Microsoft's supported list runs from Windows Server 2012 through 2025 and across current RHEL, Ubuntu, SLES, Oracle, Rocky and Alma releases, 64-bit only.

The agent sends a heartbeat every five minutes. Miss it and the machine shows as Disconnected within 15 to 30 minutes; stay disconnected for 45 days and it can move to Expired, after which an administrator must reconnect it. There is no limit on the number of Arc-enabled servers in a resource group or subscription, and Arc is not for machines already running in Azure.

The metadata Arc collects, such as operating system, computer name, FQDN and agent version, stays in the region you chose when you generated the onboarding script. Connectivity can go through the public endpoint, a proxy, the Azure Arc gateway or a private endpoint; the design conversation is about outbound access.

Microsoft's Azure Arc overview lists the control-plane functions offered at no extra cost for Arc-enabled servers: resource organization through management groups and tags, search and indexing through Azure Resource Graph, access control through Azure RBAC, and environments and automation through templates and extensions. That is the inventory layer.

A second layer opens if your Windows Server licenses carry active Software Assurance or are active subscription licenses. Windows Server Management enabled by Azure Arc gives those servers Azure Update Manager, Change Tracking and Inventory, Azure Machine Configuration, Windows Admin Center in Azure, Remote Support, Best Practices Assessment, Azure Site Recovery configuration, Network HUD on Windows Server 2025 and discounted per-server pricing for Azure File Sync, at no extra cost beyond networking, storage and log ingestion. The catch is attestation: you must explicitly attest to the licensing for each server, or enroll in Windows Server pay-as-you-go through Arc. Microsoft states eligibility is not inferred from the Arc connection itself. It needs agent version 1.47 or later and a Connected status.

Without attestation, Microsoft says customers can still purchase Update Manager, Change Tracking and Inventory, and Machine Configuration for their Arc-enabled servers; the other services in that list are not available to them through Arc.

Hotpatching for Windows Server 2025 sits outside those rules. Microsoft states it is available to all customers who Arc-enable a 2025 server, and our deadlines page records that the hotpatch subscription charge was removed on May 19, 2026.

Windows Server 2012 and 2012 R2 left support on October 10, 2023; their Extended Security Updates program ended on October 13, 2026, and nothing is sold after that. Windows Server 2016 leaves extended support on January 12, 2027, and Microsoft's billing page says ESU billing through Arc begins on January 13, 2027, with licenses provisioned later back-billed to the end-of-support date. Microsoft's prerequisites page gives November 2026 as the end of new Connected Machine agent versions for Windows Server 2012 and 2012 R2; the last compatible agent is supported for twelve months after its release, so Arc does not stop on that day, it stops moving forward.

The mechanics are the same for both versions. You provision an ESU license in the Azure portal, choosing Standard or Datacenter and physical or virtual cores, and attest to Software Assurance, an equivalent server subscription or SPLA licensing. Physical-core licenses need at least 16 cores per machine; virtual-core licenses need at least eight per VM and cannot be used on physical hosts. A Standard license covers up to two VMs, Datacenter an unlimited number. You then link the license to the Arc-enabled servers it covers.

Billing is monthly, on cores and edition. Enroll after the end-of-support date and Microsoft back-bills to that date; deactivate and reactivate and you pay for the gap; deactivate or delete and billing continues for up to five more days. The qualifying licenses are the same for both versions: Microsoft's Azure Arc pages for Windows Server 2016 state that machines licensed through SPLA or with a Server Subscription do not need Software Assurance to buy ESU, as for 2012 R2. Windows Server 2016 differs in what it leaves out: the Visual Studio dev/test exemption and the no-cost disaster-recovery benefit are not available, so every core, including recovery instances, is a paid core.

Updates arrive through whichever patching tool you already use: Update Manager, WSUS, Microsoft Update, Configuration Manager or a third-party product. Enrolled servers also get Update Manager, Change Tracking and Inventory and Azure Policy guest configuration at no additional charge. SQL Server 2016, whose extended support ended on July 14, 2026, has its own ESU path through Arc with a window that closes on July 17, 2029.

Microsoft's rule is short: any Azure service used on an Arc-enabled server, such as Microsoft Defender for Cloud or Azure Monitor, is charged at that service's own pricing.

Defender for Servers, delivered through Defender for Cloud, protects the machine with Defender for Endpoint, vulnerability management and threat detection. It is charged per the Defender for Cloud price list and billed by Microsoft to your subscription; it is not on the Software Assurance benefits list.

Azure Update Manager is included at no extra charge from Microsoft for an Arc-enabled server that is attested under Windows Server Management enabled by Azure Arc (active Software Assurance or Windows Server subscription licenses, or Windows Server pay-as-you-go through Arc), enrolled in Extended Security Updates through Arc, or in a subscription with Microsoft Defender for Servers Plan 2 enabled; any other Arc-enabled server is charged per server per month, prorated for the days it is Connected and managed, and Microsoft states that eligibility is not inferred from the Arc connection itself. Azure Machine Configuration, the policy engine that audits settings inside the operating system, follows the Azure Policy pricing guide unless attestation or ESU covers it.

Change Tracking and Inventory and the Best Practices Assessment need a Log Analytics workspace, and Microsoft notes that data ingestion there might incur costs even when the feature is included. The same applies to VM insights, any logs the Azure Monitor agent ships to a workspace, and Microsoft Sentinel if you connect it. Azure Site Recovery configuration is included; the Site Recovery service, its storage, compute and networking are not.

The Connected Machine agent only ever talks outbound, over TCP port 443, so the firewall work is an allow-list of destinations, not an inbound rule. Microsoft's network requirements page for the agent groups the public-cloud destinations into a few families: the Microsoft Entra ID sign-in endpoints (the regional login.microsoft.com hosts the agent uses day to day, login.microsoftonline.com as the global fallback used during onboarding, and pas.windows.net); management.azure.com, the Azure Resource Manager endpoint, needed only when a server is connected or disconnected; *.his.arc.azure.com for metadata and hybrid identity; *.guestconfiguration.azure.com for extension management and Machine Configuration; guestnotificationservice.azure.com with its subdomains and the azgn*.servicebus.windows.net hosts for the notification service behind extensions and connectivity; Azure blob storage for extension downloads; and the Microsoft download hosts the onboarding script pulls the agent package from. Windows Admin Center in Azure, Update Manager, Defender for Servers and the Azure Monitor agent each add destinations of their own, so build the list from the features you intend to use, not from the agent alone.

Three options exist for estates that cannot allow those destinations broadly. The agent supports a proxy server, set per machine at install time or afterward. The Azure Arc gateway routes the agent's traffic through one gateway resource and shrinks the allow-list to a short fixed set of endpoints. Azure Private Link carries the agent's traffic over a private endpoint, although Microsoft's table still marks some destinations as public even then, the Entra ID endpoints among them, so a private-link design does not remove the firewall change entirely. Pick one path before the first server is onboarded and write it into the design, because changing it later means touching every agent. Two more things from the April 2026 revision of the network requirements page: the AzureFrontDoor.Frontend service tag joined the required set, and extensions, ESU certificate updates and license validation for hotpatch or pay-as-you-go add endpoints of their own, so the list above is the agent's baseline rather than a complete firewall policy; build the rule from the live page on the day you deploy.

Hotpatching Windows Server 2025. A hotpatch applies a security update to a running server without a restart; the restart comes only with the baseline cumulative update, which Microsoft delivers about every three months. On-premises and in other clouds, hotpatches come only through Azure Arc: the server must be Arc-enabled, run Windows Server 2025 Standard or Datacenter with Virtualization-Based Security enabled (a Generation 2 virtual machine with Secure Boot on Hyper-V), and be enrolled in Hotpatch per machine from the Azure portal (Azure Arc, Machines, Hotpatch, then Confirm). The hotpatch subscription charge was removed on May 19, 2026 and the Arc control plane is offered at no extra cost, so what is left on the invoice is whichever Update Manager row in the table applies to that server's license.

That makes Arc part of the build rather than an afterthought: a domain controller or Hyper-V guest built on 2025 can have VBS on, the agent installed and the enrollment completed before it takes production load, where retrofitting a running server means checking firmware and VBS prerequisites, a restart and a maintenance window. Our companion guide to hotpatching Windows Server 2025 domain controllers walks through the prerequisites, the enrollment and what each piece is charged.

A parent company's or insurer's requirement for central management of all servers. An acquirer's security checklist, a cyber insurer's questionnaire or an auditor's control list often carries a row that reads, in effect, "all servers are centrally inventoried, patched and access-controlled". The row does not ask for a migration; it asks for one place where every server is listed, its patch state is visible, access is granted through roles and every change is logged. Arc with Azure Update Manager meets it without moving a workload: the resource list is the inventory, the Update Manager assessment is the patch-compliance evidence, Azure RBAC is the access control and the Activity Log is the change record. The companion article on central management of all servers as an audit requirement shows what that evidence looks like and which subscription the servers belong in when the tenant will pass to the acquirer.

In one plan in progress, a medical practice of about 200 users being acquired by a hospital group is connecting about a dozen servers to Arc as each one is rebuilt on a supported operating system, keeping the optional paid add-ons switched off and giving the acquirer's team read-only access to the inventory and the patch view. That shape is what our Azure Arc Onboarding with Azure Update Manager for an Audited Estate service is built for: $25 per server plus a $1,950 tenant fee, one week, up to 25 servers.

Which servers. Arc should follow the lifecycle decision, not precede it: the machines you have chosen to keep on-premises for a defined period, each with an owner and a review date.

Licensing status. Know which Windows Server licenses carry Software Assurance, a subscription or SPLA coverage, because that decides whether attestation unlocks the included services and whether an ESU license can be provisioned at all.

Networking and region. Choose the connectivity path and the Azure region deliberately; Arc metadata stays in that region.

Workspace and retention. If you will use Change Tracking, VM insights or Sentinel, size the Log Analytics workspace and set retention before the agents start sending data; ingestion is the meter most likely to surprise.

Roles and tags. ESU licensing needs the Contributor role. Agree a tag standard up front. Microsoft's ESU Usage tags for Visual Studio dev/test and disaster-recovery machines applied to Windows Server 2012 licenses only; neither benefit exists for Windows Server 2016 ESU, so those cores are paid cores.

Exit dates. Windows Server 2012 R2 needs a plan that ends before November 2026. Windows Server 2016 needs an ESU-or-migrate decision before January 2027; our Windows Server 2016 end of support assessment is built for that decision.

Is Azure Arc itself charged?

The control plane, meaning the resource, tags, Resource Graph search, RBAC and extensions, is offered at no extra cost. Every Azure service you attach, from Defender for Servers to Log Analytics, is charged at its own price, and ESU licenses are billed monthly per core.

Do we need Software Assurance?

Not to connect a server. Windows Server Management benefits need an attestation to active Software Assurance or Windows Server subscription licenses. Windows Server ESU licenses, for 2012 R2 and 2016 alike, need Software Assurance, a Server Subscription or SPLA licensing; Microsoft states that SPLA and Server Subscription customers do not need Software Assurance.

Can Arc patch our servers?

Azure Update Manager assesses and installs updates on Arc-enabled servers on schedules and maintenance windows. It still needs an update source such as Microsoft Update or WSUS; our WSUS replacement with Azure Update Manager service does that swap.

What if a server goes offline?

It shows Disconnected within 15 to 30 minutes and can become Expired after 45 days, after which it must be reconnected. The included benefits require a Connected status.

Does Arc replace migration?

No. It is the management plane for what stays. Windows Server 2012 R2 on Arc lost ESU on October 13, 2026 and stops receiving new Arc agent versions in November 2026, with the last compatible agent supported for twelve more months; Arc buys visibility, not time.