The checklist says every server must be centrally managed. Here is the plan, the evidence and the fixed price.
Tell us the server count, the date and who set the requirement. We come back with the Azure Arc plus Azure Update Manager plan, the row-to-control mapping the reviewer reads, and a fixed price for the work.
- One row, four kinds of evidence
- A row that reads "central management of all servers" is answered with an inventory of every server in one place, the patch state of each with a date, who can reach them and with what rights, and a record of what changed, by whom and when. Azure Arc with Azure Update Manager is the smallest Microsoft-native configuration that produces all four; the reviewer gets read-only access and two files they can open without an Azure sign-in.
- $25 per server plus a $1,950 tenant fee, fixed
- The Azure Arc Onboarding with Azure Update Manager for an Audited Estate: one Azure subscription, up to 25 Windows or Linux servers on supported operating systems, one week of engineering effort paced to the schedule on which each server reaches a supported release. Quoted in writing before work begins; you pay after you approve delivery. Larger estates are quoted in writing.
- The full management layer, if that is the goal
- Where the aim is hybrid management beyond the audit answer, with a tagging taxonomy, an Azure Policy baseline and optional Microsoft Defender for Cloud enrollment, the Azure Arc Hybrid Server Management Implementation is $25 per server plus a $1,950 base fee over two weeks, an estimate confirmed in writing once the server inventory is agreed.
Four pieces of evidence, from one place.
The row's owner accepts evidence, not a product name. Each of the four is produced by the engagement, recorded, and shown to the reviewer in a dry run before the date.
Every server on one list
Azure Arc makes each server an Azure resource in a resource group named and tagged so the reviewer's query returns the servers and nothing else: operating system, connection status, tags, and the agent's own connectivity check recorded per server. Windows and Linux alike, on premises or in another cloud, with no workload moved.
The Connected Machine agent connects outbound only, over HTTPS on port 443, to the endpoints on Microsoft's published list. Your firewall team gets that list to apply, with proxy settings where you use one; no inbound rule is requested.
Patch state with a date, inside your windows
Azure Update Manager with periodic assessment on every server, maintenance configurations whose windows match your after-hours schedule, every server attached, and the first scheduled cycle observed and reported. For the servers in scope it replaces WSUS, and the WSUS question is closed on the hand-over document rather than left open.
The compliance view is the one your IT team and the reviewer's read-only identities both use, with a saved Azure Resource Graph query and an export method for the auditor's file.
Read-only access for the parent or auditor
Your IT team gets the rights to onboard, patch and report. The parent group or auditor gets Reader on the resource group and nothing more, as guest identities or identities from their own tenant, as their policy requires, with every assignment recorded.
They see every server, its patch state and the change history; they cannot patch, reconfigure or remove anything, and they do not see your Microsoft 365 tenant, your Entra ID or anything on the servers themselves. Arc exposes management state, not file systems or applications.
The change record and the row-to-control mapping
One line per change on every in-scope server: server, change, before, after, timestamp, who, verification, in a file the auditor can read without an Azure sign-in. Each row of the requirement you gave us mapped to the control in Azure that evidences it, marked out of scope with the service that covers it, or named as an exception with an owner and a date.
With them: a hand-over document, an add-on register, and a 30-minute walkthrough on how to onboard the next server, read compliance, change a window and find the records.
Microsoft's charges are yours, billed by Microsoft to the subscription the servers sit in. Azure Arc's control plane carries no charge. Azure Update Manager is included for a server whose Windows Server license has active Software Assurance or is a subscription license once you attest to it in Azure, and for a server enrolled in Extended Security Updates through Arc; for any other Arc-enabled server Microsoft bills a per-server monthly charge, prorated for the days it is managed. Log collection, Microsoft Defender for Cloud and Microsoft Defender for Servers stay off unless a checklist row names them; each is metered by Microsoft if it is switched on later, and the add-on register says which party would pay.
What the four weeks hold, and what each week leaves behind.
The engineering effort is one week; the calendar follows the schedule on which your servers reach a supported operating system. Four weeks holds a dozen to twenty-five servers on, or being rebuilt to, a supported release.
Inventory, the subscription decision and the firewall list
Every server listed with operating system, role, owner and whether it is being rebuilt, upgraded or retired. The one decision that cannot be deferred, recorded in writing: your own Azure subscription, which passes with the tenant in an acquisition, or the parent's. The outbound endpoint list goes to your firewall team the same day.
Onboarding and the Update Manager schedules
The resource groups provisioned, a pilot server connected from each operating system family, then each server connected as it reaches a supported operating system, by onboarding script or Group Policy. Periodic assessment on, maintenance windows matching your after-hours schedule, the first scheduled cycle watched and its report kept.
Access, the change record and the exceptions list
Working access for your team, Reader for the parent's or auditor's named reviewers. The change record format agreed and back-filled from week one. Every server not onboarded listed with the reason, the compensating control and the closing date.
The mapping document and a dry run
Each row of the requirement mapped to the control that evidences it. The reviewer signs in, finds each item, and what they could not find is fixed before the date. The hand-over document and the 30-minute walkthrough close it out.
Servers that cannot reach a supported operating system by the date are routed, not hidden.
The Windows Server 2016 to 2025 Upgrade Service brings a server to the line this work starts from, and it is onboarded when it lands. A server that will stay on Windows Server 2016 past 12 January 2027 is enrolled through Windows Server ESU Enrollment through Azure Arc on the same Arc connection for the interim. A server the vendor will not move is named as an exception on the mapping with an owner, the compensating control and a date, which is what an auditor expects to find. Nothing is ordered until a person at IT Partner confirms it with you.
Tell us about the requirement.
Six answers and an optional note. A person reads it and replies within one business day with the plan outline and the written quote.
The answers, in the open, before you send anything.
Four articles and the two service pages cover most of what the plan will say. Read them first if you would rather check our reasoning than take our word.
"Central management of all servers" as an audit requirement
What the row asks for, the row-by-row mapping to Azure Arc and Update Manager, the change record, the subscription question and the four-week plan.
Azure Arc for the servers you are keeping
What Arc does for a server that stays where it is, every Microsoft meter it can attach, and which ones stay off.
Hotpatching Windows Server 2025 domain controllers through Arc
What enrollment needs, the virtualization-based security prerequisite, and the hotpatch charge Microsoft removed on 19 May 2026.
The one server you cannot replace
ESU through Arc, a Windows IoT Enterprise LTSC rebuild, or isolation: the decision table for the box the vendor will not move, and how it sits on the exceptions list.
Azure Arc Onboarding with Azure Update Manager for an Audited Estate
$25 per server plus a $1,950 tenant fee, fixed: one subscription, up to 25 servers, maintenance windows, change record, mapping document and walkthrough.
Azure Arc Hybrid Server Management Implementation
$25 per server plus a $1,950 base fee over two weeks: connectivity design, agent rollout at scale, tagging taxonomy, Azure Policy baseline, Update Manager schedules.