For the servers that are not moving to the cloud — and were never going to — IT Partner onboards your on-premises and other-cloud Windows and Linux servers to Azure Arc, so they get Azure-side inventory, governance, patching, and security visibility while staying exactly where they are. The two-week engagement covers connectivity design, at-scale rollout of the Connected Machine agent, a tagging and inventory taxonomy, an Azure Policy compliance baseline, Azure Update Manager patching schedules with maintenance windows, and optional Microsoft Defender for Cloud enrollment. Pricing is an estimate at $25 per server plus a $1,950 base fee, confirmed in writing once the server inventory is agreed. One boundary stated plainly: Azure charges for the management services you attach — patching for Arc servers, Defender plans, log ingestion — are billed by Microsoft separately, and the design phase models them before you switch anything on.
Not every server belongs in the cloud, and we say that as a company that migrates servers for a living. Some workloads are latency-bound to the factory floor, some talk to hardware, some are anchored by licensing or data-residency constraints, and some are simply not worth moving — the business case says stay. What those servers usually get is the worst of both worlds: none of the cloud's management surface and all of the operational sprawl of scattered infrastructure — patching by spreadsheet, inventory by memory, and security visibility that stops at the datacenter door. Azure Arc exists for exactly this population, and this engagement is the alternative we offer when the answer to migration was no. Arc projects your non-Azure servers into Azure Resource Manager: each machine — on-premises, at a colocation site, or in another cloud — appears in Azure as a resource you can tag, query, govern, and secure alongside everything else. The Connected Machine agent connects outbound only; nothing dials into your network, and no workload moves anywhere. On that foundation the engagement builds the management layer in a deliberate order. A tagging and inventory taxonomy first, so the estate becomes searchable and reportable. Then an Azure Policy baseline, which audits and enforces configuration standards on machines that have never seen the cloud. Then Azure Update Manager: patching schedules with real maintenance windows for Windows and Linux alike, replacing whatever mixture of WSUS, cron, and optimism is doing the job today. And optionally, Microsoft Defender for Cloud enrollment, extending threat protection and posture management to servers your Azure-side security tooling currently cannot see — a natural pairing with our Defender for Cloud CSPM service. There is also a licensing story worth knowing, because Microsoft keeps sweetening it: Arc is the delivery channel for benefits that used to require being in Azure. Windows Server 2025 machines connected through Arc can use hotpatching — security updates without the monthly reboot — which Microsoft made available at no extra cost in mid-2026, and a pay-as-you-go licensing option exists for organizations that want off the traditional licensing cycle. Older servers can receive Extended Security Updates through Arc, paid monthly instead of bought in annual blocks. None of this requires migrating anything; it requires exactly what this engagement delivers — a connected, governed estate. And if some of these servers do move to Azure later, the work is not throwaway: the inventory, tags, and policy assignments carry into the migration as its ready-made assessment. Sometimes the reason is a checklist rather than an engineering preference. A parent company, an acquirer or an insurer writes "central management of all servers" as a row on a security questionnaire, and the evidence they expect is an inventory, a patch-compliance view and access control for every server in one place, plus a change record they can audit. Arc with Azure Update Manager meets that row without moving a workload, and the pieces they ask for — read-only access for the parent group's team, maintenance windows that match your after-hours schedule, the paid add-ons left switched off until someone asks for them — are configuration, not projects. Where the date is set by someone else and the server count is a dozen or two, the narrower fixed-fee version of this work is the Azure Arc Onboarding with Azure Update Manager for an Audited Estate: one subscription, up to 25 servers, maintenance windows configured, a change record and a hand-over document in one week. How to meet the checklist and what the change record looks like is in Central management of all servers as an audit requirement.
What Microsoft charges for on an Arc-enabled server and what it does not, in the rules rather than the numbers — the rows the design-phase cost model starts from. Microsoft revises these terms; the model carries the current prices, this table carries the conditions.
| Microsoft charge | Condition | |
|---|---|---|
| Azure Arc control plane — the resource, tags, Resource Graph search, Azure RBAC, templates and extensions | No extra cost | None beyond your Azure subscription, per Microsoft's Azure Arc overview. This is the inventory layer. |
| Windows Server Management enabled by Azure Arc — Azure Update Manager, Change Tracking and Inventory, Azure Machine Configuration, Windows Admin Center in Azure, Remote Support, Best Practices Assessment, Azure Site Recovery configuration, Network HUD on Windows Server 2025 | No extra cost beyond networking, storage and log ingestion | Active Software Assurance or Windows Server subscription licenses, attested per server in Azure; Connected Machine agent 1.47 or later and a Connected status. Microsoft states eligibility is not inferred from the Arc connection itself. |
| Azure Update Manager | Included, or metered per server | Included for servers covered by that attestation or enrolled in Extended Security Updates through Arc; otherwise purchasable for Arc-enabled servers and metered by Microsoft per server. |
| Extended Security Updates through Arc — Windows Server 2016 billing from 13 January 2027 | Metered monthly per core | Standard or Datacenter, physical or virtual cores, with a 16-core physical and 8-core virtual minimum; Software Assurance or an equivalent subscription attested. Enrolled servers get Azure Update Manager, Change Tracking and Inventory and Azure Policy guest configuration at no additional charge. |
| Hotpatch for Windows Server 2025 | No additional charge since 19 May 2026 | Arc-connected Windows Server 2025 Standard or Datacenter with Virtualization-Based Security enabled (Microsoft's prerequisite at the time of writing); Microsoft removed the hotpatch subscription charge on 19 May 2026 per our deadlines register. |
| Microsoft Defender for Servers | Charged | Per the Microsoft Defender for Cloud price list, per server, billed by Microsoft to your subscription; it is not on the Software Assurance benefits list. |
| Log Analytics ingestion — Change Tracking and Inventory, Best Practices Assessment, VM insights, Azure Monitor logs, Microsoft Sentinel | Charged | Data ingestion and retention at the workspace's pricing, even where the feature itself is included; the meter most likely to surprise. |
Every meter in this table is Microsoft's charge on your Azure invoice and is not part of this fee; the cost model in the design phase prices each one for your estate before it is enabled.
Inventory the candidate estate: server count, operating systems and versions, network segments, egress rules, and proxies. Produce the design — connectivity model, resource structure, tag schema, policy set, patch groups — and the attached-services cost model. You approve both before anything is deployed.
Onboard a pilot group spanning your real diversity — Windows and Linux, each network segment, the oldest OS in scope. Validate agent health, connectivity, tagging, and a policy assignment on the pilot before scaling anything.
Roll the agent out at scale using the chosen mechanism, reconcile connected machines against the inventory, apply the tag taxonomy, and chase the stragglers — there are always stragglers, and the closeout report names them rather than ignoring them.
Assign the Azure Policy baseline, configure Update Manager schedules and maintenance windows, run the pilot patch cycle, and enable Defender for Cloud where in scope — each service switched on against the acknowledged cost model, never silently.
Verify success criteria end to end, run the handover session with your team, and deliver the runbook, as-built documentation, and closeout report.
A way to make servers that are not in Azure manageable as if they were. An agent on each server connects outbound to Azure, and the machine appears in Azure Resource Manager as a first-class resource — you can tag it, inventory it with queries, apply policy to it, patch it on a schedule, and point security tooling at it. The workload itself does not move, and nothing about Arc requires it ever to move.
No — it is the service we propose when migration was evaluated and declined, which happens for good reasons: latency, attached hardware, licensing anchors, data residency, or a business case that says stay. Arc gives those servers cloud-side governance without relocation. If circumstances change later, the connected estate doubles as a ready-made migration assessment — but that is your option, not our agenda.
Arc's core control plane — connecting machines, inventory, tagging, organizing them in Azure — carries no Azure charge. Costs come from the management services you attach: patching for Arc-enabled servers, Defender for Servers plans, and log ingestion are metered by Microsoft, and some charges are waived in specific bundling cases, such as patching being included for machines covered by certain Defender or ESU arrangements. Microsoft revises these prices, so we model your exact configuration against the current price list in the design phase — nothing gets enabled until you have seen its monthly number.
The Connected Machine agent supports current Windows Server versions and the mainstream Linux distributions — Ubuntu, Red Hat, SUSE, and peers — and we confirm your specific OS list against Microsoft's support matrix during discovery. End-of-life systems outside the matrix cannot be onboarded and are dispositioned honestly in the closeout: sometimes the answer is an OS upgrade, sometimes ESU through Arc for versions that qualify, and sometimes retirement.
No. The agent connects outbound over HTTPS only — directly, through your existing proxy, or via Azure Private Link for organizations that want traffic off the public internet entirely. Nothing in Azure initiates connections into your network, and no inbound firewall rules are opened for this engagement. Fully air-gapped segments are the one hard limit: no outbound path, no Arc.
It audits — and where you explicitly choose, enforces — configuration standards on the connected machines: things like required security settings, expected agents, and OS configuration state. The practical win is one compliance view across cloud and on-premises instead of a separate standard for each. We default to audit mode wherever there is doubt, because enforcement changes machine state, and that switch gets flipped by your signature, not our assumption.
It replaces the machinery, not the discipline. Update Manager schedules and orchestrates Windows and Linux patching from Azure — one console, real maintenance windows, per-group schedules, and reporting that shows the truth per machine — without a WSUS server to feed and water. For Arc-enabled machines it is a metered Azure service, which the cost model covers. The engagement configures pilot-first patching so schedule mistakes surface on ten servers, not two hundred.
Security posture and threat protection for machines your Azure security tooling currently cannot see: vulnerability findings, attack-surface recommendations, and alerting, in the same Defender for Cloud view as your Azure resources. It is optional in this engagement on purpose — plan selection depends on what endpoint protection you already run and pay for, and we choose against your existing stack rather than stacking duplicates. For the fuller posture-management picture, this pairs naturally with our Defender for Cloud CSPM implementation.
Discovered and flagged, yes; configured, no. The rollout surfaces SQL instances, and Arc-enabled SQL Server can add instance-level inventory, best-practice assessment, and licensing options — but SQL-specific enablement and the licensing questions that come with it deserve their own conversation, and bundling them quietly into a server-management project is how scope goes wrong. We include pointers and an honest recommendation in the closeout.
Microsoft has been routing genuine licensing value through Arc. Windows Server 2025 machines connected via Arc can use hotpatching — most security updates applied without rebooting, cutting patch reboots to a handful of planned events a year — and Microsoft dropped the separate subscription charge for it in mid-2026. There is also a pay-as-you-go licensing option for Windows Server 2025 through Arc, and older servers can buy Extended Security Updates month to month through Arc instead of in annual blocks. Terms are Microsoft's and move over time, so the design phase verifies what applies to your estate at engagement time. A hotpatched server still restarts in every baseline month — one planned baseline every three months, plus any unplanned one — which is why the maintenance configurations distinguish baseline months from hotpatch months; the calendar and the window layout are in the hotpatch restart calendar for Windows Server 2025.
Minimally, by design. Installing the Connected Machine agent does not require a reboot and does not touch workloads — it is a lightweight service making outbound connections. The pilot group exists to prove exactly that on your own estate before we scale. The only activities with real change impact are the ones scheduled deliberately: the pilot patch cycle and any enforce-mode policies, both inside maintenance windows you approve.
Your team, equipped to do it — the handover session and runbook cover onboarding new servers, reading compliance and patch status, and adjusting schedules, and the taxonomy is documented so the estate stays coherent after we leave. If you would rather have it operated for you, our Azure Resource Monitoring and Maintenance service can take the keys as a separate, explicit engagement — we do not bundle a retainer into an implementation.