Azure Arc Onboarding with Azure Update Manager for an Audited Estate is the fixed-fee answer to one checklist row — a parent company's, an acquirer's, an insurer's or an auditor's requirement that every server be under central management — for one Azure subscription and up to 25 Windows or Linux servers on supported operating systems. IT Partner provisions and configures the subscription and resource groups for Azure Arc, builds the onboarding automation and connects the Azure Connected Machine agent on each server as it reaches a supported operating system, hands your firewall team the outbound endpoint list, configures Azure Update Manager with maintenance windows that match your after-hours schedule and patch compliance reporting, grants your IT team working access and the parent group or auditor read-only access, keeps the optional paid add-ons — log collection, Microsoft Defender for Cloud, Microsoft Defender for Servers — switched off unless a checklist row requires them, and hands over a per-server change record (server, change, before, after, timestamp, who, verification) the auditor can read, a mapping of each checklist row to the control that evidences it, a hand-over document and a 30-minute walkthrough. One decision is captured at kickoff and written down: whether the servers land in your own Azure subscription, which passes with the tenant in an acquisition, or in the parent's. $1,950 plus $25 per server, fixed for the standard scope and quoted in writing before work begins; the engineering effort is one week, paced to the schedule on which your servers reach a supported operating system; larger estates are quoted in writing. Not included: operating system upgrades of unsupported servers, Extended Security Updates enrollment, Microsoft Defender for Servers deployment, Log Analytics design, and hotpatch enrollment beyond enabling it where the prerequisites already exist. Microsoft's charges are always yours: Azure Arc's control plane carries no charge, Azure Update Manager is included for servers with Windows Server subscription licensing or Software Assurance that you attest to and for servers enrolled in Extended Security Updates through Arc, and is otherwise a per-server monthly charge from Microsoft, prorated for the days a server is managed; any add-on you later switch on is metered by Microsoft. If what you want is the full hybrid management layer — tagging taxonomy, an Azure Policy baseline, Defender for Cloud enrollment, Private Link — rather than the audit answer, use the Azure Arc Hybrid Server Management Implementation instead.
"We have to have central management for all servers" is not a technology wish. It is a row on a checklist that somebody else wrote — a hospital group acquiring a medical practice, a parent company absorbing a subsidiary, a cyber-insurer renewing a policy, an auditor working through a control framework — and it has a date attached that somebody else chose. What the row's owner will accept as evidence is narrower than the technology it names: an inventory of every server in one place, the patch state of each one with a date, who can reach them and with what rights, and a record of what was changed, by whom, when. Azure Arc with Azure Update Manager is the smallest Microsoft-native configuration that produces all four, and this engagement delivers exactly that configuration and the evidence, nothing more. The shape we are planning it around today: a medical practice of about 200 users being acquired by a hospital group, a possession date about four weeks out, about a dozen servers — new domain controllers, Hyper-V hosts, file and print, the Entra Connect server, application servers — rebuilt on Windows Server 2022 and connected to Azure Arc as each one reaches a supported operating system, with maintenance windows matching the after-hours schedule, read-only access for the acquirer's team, and the paid add-ons left off because a third-party endpoint detection and response tool and a security operations center are already in place. That is a plan in progress, written here as a shape, not an outcome. The work runs in a fixed order because each step is the evidence for the next. First the landing: the subscription and resource groups for Arc, named and tagged so the auditor's query returns the servers and nothing else — with the one decision that cannot be deferred captured in writing at kickoff: your own subscription, which passes to the acquirer with the tenant, or the parent's. Either works; re-pointing the agents later is small work, and we say which we would choose and why. Second the path out: the outbound HTTPS endpoint list from Microsoft's published network requirements, handed to your firewall team as a list to apply, with proxy settings where you use one — the agent connects outbound only, nothing in Azure dials into your network. Third the agents: onboarding automation built on a service principal with the Azure Connected Machine Onboarding role, run against a pilot server, then against each server as it reaches a supported operating system — so a server rebuilt next week is onboarded next week inside the same fee. Fourth, Azure Update Manager: periodic assessment on, maintenance configurations whose windows match your after-hours schedule, every server attached, the first scheduled cycle watched and its report kept. Fifth, access: your IT team with the rights to operate, the parent group or auditor with Reader on the resource group and nothing more, both recorded. Sixth, the evidence: the per-server change record, the mapping from each checklist row to the control in Azure that evidences it, the hand-over document and the walkthrough. What we deliberately leave off, and why it is written down. Azure Arc's control plane — the resource, the inventory, tags, Azure Resource Graph, role-based access — carries no charge from Microsoft. The services you can attach do: log collection into a Log Analytics workspace, Microsoft Defender for Cloud and Defender for Servers plans, Azure Monitor. An estate with a third-party endpoint tool and a managed security operations center does not need Defender switched on to pass the row, and switching it on by default creates a second security vendor, a second alert queue and a second invoice that nobody asked for. So the add-ons stay off unless a checklist row names them, and the hand-over document lists each one with who would pay Microsoft for it, so the parent group can turn one on later with its eyes open. The same discipline applies to WSUS: Update Manager replaces the need for it on the servers in scope, and the WSUS question is settled on the hand-over document rather than left open; retiring a large WSUS estate with patch rings and pre and post events is the WSUS Replacement with Azure Update Manager, not this page. What Microsoft charges after we leave, in words rather than figures, because Microsoft revises the figures. Azure Update Manager is included at no additional charge for an Arc-enabled server whose Windows Server license carries active Software Assurance or is a Windows Server subscription license, once you attest to that licensing in Azure (Microsoft calls this Windows Server Management enabled by Azure Arc, and it needs a current Connected Machine agent), and for a server enrolled in Extended Security Updates through Arc; for any other Arc-enabled server Microsoft bills Update Manager per server per month, prorated for the days the server is connected and managed, and waives it where Microsoft Defender for Servers Plan 2 is enabled on the subscription. Hotpatching — security updates without the monthly reboot — is available at no additional charge from Microsoft since 19 May 2026 for Arc-connected Windows Server 2025 Standard and Datacenter machines with virtualization-based security enabled; we enable it where those prerequisites already exist, and Windows Server 2022 hosts outside Azure are not eligible. The hand-over document names the rule that applies to each server. Servers that cannot reach a supported operating system by the date are not left out of the answer: they go to the Windows Server 2016 to 2025 Upgrade Service, to Windows Server ESU Enrollment through Azure Arc for the interim, or are named as exceptions with an owner and a date on the checklist mapping — which is what an auditor expects to see. The mail, files and identity half of an acquisition is a different project: the Microsoft 365 Mergers and Acquisitions Tenant Consolidation covers it when the tenants merge, and our tenant-to-tenant migration guide explains the shape when they do not.
Confirm the checklist row as written, the server list with operating systems, and the date. Decide and record: which subscription (yours or the parent's), the maintenance windows that match your after-hours schedule, and who gets which access. The outbound endpoint list goes to your firewall team the same day.
Provision the resource groups, register the providers, build the onboarding automation and connect a pilot server from each operating system family. Confirm connectivity through your firewall or proxy before onboarding anything else.
Connect every server that is already on a supported operating system, enable periodic assessment, attach each to its maintenance configuration, and schedule the first cycle. Enable hotpatch where the prerequisites already exist.
Assign working access for your team and read-only access for the parent or auditor, save the compliance query and export method, complete the per-server change record and the checklist-row mapping, and hold the 30-minute walkthrough.
Where servers reach a supported operating system over several weeks, we onboard each one as it lands within the same fee, append it to the change record, and close out once the last in-scope server is connected and has completed a scheduled cycle.
Arc with Azure Update Manager is enough for the row as it is usually written, and the way you show it is the evidence this engagement produces rather than the technology itself. The auditor or the parent's team gets read-only access to a resource group where every server appears with its operating system, its Arc connection status, its patch compliance and the date of its last assessment; a saved query returns the same list on demand; and the per-server change record shows what was done to each machine, by whom and when, in a file they can read without an Azure sign-in. The checklist-row mapping ties each line of their requirement to the control that evidences it, or names the exception with an owner and a date. Where a row asks for more than central management — endpoint protection, configuration enforcement, central logging — the mapping says so and names the service that covers it.
For the servers in this scope, yes: Update Manager gives you scheduled patching with maintenance windows, periodic assessment and compliance reporting from Azure, without a WSUS server to keep alive, and the WSUS question is closed on the hand-over document. What Microsoft charges depends on the server's license, not on the tool: Update Manager is included for an Arc-enabled server whose Windows Server license has active Software Assurance or is a subscription license, once you attest to that in Azure, and for a server enrolled in Extended Security Updates through Arc; for any other Arc-enabled server Microsoft bills a per-server monthly charge, prorated daily, which it waives where Defender for Servers Plan 2 is enabled on the subscription. We do not print Microsoft's rate because Microsoft revises it; the hand-over document names the rule for each of your servers. Retiring a large WSUS estate with patch rings and pre and post events is the WSUS Replacement with Azure Update Manager service, not this page.
Either works, and the decision is recorded at kickoff so nobody relitigates it in week three. Your own subscription passes to the acquirer with the tenant, keeps billing and access where they are today, and is the natural choice when the acquirer will not migrate data and will retire the tenant later on its own schedule. The acquirer's subscription puts the servers where its operations team already works and avoids a move later. Re-pointing the Connected Machine agents from one subscription to another afterwards is small work for an estate of this size — disconnect, reconnect, re-attach the maintenance configuration — so the wrong choice is cheap to fix and the right choice is the one the acquirer's team will actually use.
The central-management row, completely, if the servers are on a supported operating system or reach one inside those weeks. The engineering effort is one week: the subscription and resource groups, the firewall list, the automation, the agents, Update Manager with your windows, the access, the records. Servers being rebuilt during the period are onboarded as each one lands, inside the same fee, and the closeout happens once the last one is connected and has completed a scheduled cycle. What does not fit in four weeks is pretended nowhere: a server that cannot reach a supported operating system by the date is named as an exception on the mapping with an owner and a date, and Extended Security Updates through the same Arc connection cover it in the interim. The mail, files and identity rows of the checklist are a different project and are linked from this page.
A resource group in Azure they can read and not change. In it, every in-scope server as an Azure Arc resource with its name, operating system, connection status and tags; the Update Manager view with each server's patch compliance, missing updates and last assessment date; the maintenance configurations with their windows; and the role assignments, including their own. Outside Azure, the per-server change record and the checklist-row mapping as files. They do not see your Microsoft 365 tenant, your Entra ID, or anything on the servers themselves — Arc exposes management state, not file systems or applications.
Nothing for Azure Arc itself: the control plane — the server resource, inventory, tags, queries, access control — carries no charge. Azure Update Manager is included for servers whose Windows Server license has active Software Assurance or is a subscription license once you attest to it, and for servers enrolled in Extended Security Updates through Arc; for other Arc-enabled servers Microsoft bills a per-server monthly charge prorated for the days the server is managed. Hotpatching on eligible Windows Server 2025 machines has carried no additional charge since 19 May 2026. Everything else is an add-on you would have to switch on — log collection, Defender for Cloud, Defender for Servers — and each is off at hand-over with its payer named in the add-on register. Microsoft bills your subscription directly; none of it passes through this fee.
Outbound HTTPS on port 443 from each server to the endpoints on Microsoft's published list for the Azure Connected Machine agent, which we hand to your firewall team as a list to apply, with proxy settings where you use one. Nothing inbound: the agent initiates every connection, nothing in Azure connects into your network, and no inbound rule is requested. Where your policy restricts outbound traffic by destination, the list is the destinations; where a server has no outbound path at all, it cannot be onboarded and is named as an exception.
They are handled, not hidden. A server that can be upgraded goes through the Windows Server 2016 to 2025 Upgrade Service on your schedule and is onboarded when it lands. A server that must stay on Windows Server 2016 for now is enrolled in Extended Security Updates through the same Arc connection — which also makes Update Manager included for it — through the ESU enrollment service, with Microsoft billing the ESU from 13 January 2027. A server the vendor will not move at all is named as an exception on the checklist mapping with an owner, the compensating control and a date, which is what an auditor expects to find; keeping such a server supported with a different operating system edition or by isolation is a separate conversation we will have plainly.
No, and this engagement will not do it by default. The central-management row does not require Microsoft Defender, and a second endpoint agent with a second alert queue and a second invoice is a cost the checklist did not ask for. The Defender add-ons stay off, the add-on register records what each would do and who would pay Microsoft for it, and the decision to switch one on later belongs to you or to the parent. If a checklist row explicitly requires Defender for Servers, that is the separate Defender for Servers deployment, scoped against the endpoint tool you already run so the two do not fight.
Yes, where the prerequisites already exist, and with no host changes: a Windows Server 2025 Standard or Datacenter machine at a baseline cumulative update, connected to Arc by this engagement, with virtualization-based security already on is enrolled inside the fee and the enrollment is written into the change record. Microsoft removed the hotpatch charge for Arc-connected Windows Server 2025 machines on 19 May 2026. What we do not do inside this fee is change a server to make it qualify — enabling virtualization-based security on a host built without it, or moving a Windows Server 2022 server to 2025 — and Windows Server 2022 hosts outside Azure are not eligible, which for an estate rebuilt on 2022 means the answer is usually 'not yet, and here is what it would take'. An enrolled server still restarts in every baseline month, one planned every three months plus any unplanned one, so its maintenance window stays on the calendar; the schedule is in the hotpatch restart calendar for Windows Server 2025.
One line per change on every server: the server, the change, the state before, the state after, the timestamp, who made it, and how it was verified. It matters because the parent's or acquirer's security team may audit the period before possession, and 'we onboarded everything to Arc' is a claim while a record is evidence. The record covers the agent installation, the Update Manager attachment, the access assignments, any hotpatch enablement and the add-ons left off, and it is written for a reader without an Azure sign-in. It is yours to keep and to hand to the parent; it is not an audit report and we do not sign the auditor's attestation.
When the goal is to run the servers from Azure rather than to evidence that they are managed. That engagement builds the full hybrid management layer — a tagging and inventory taxonomy, an Azure Policy compliance baseline with audit and enforce decisions per policy, Update Manager with pilot rings, optional Defender for Cloud enrollment, connectivity design including Private Link — over two weeks for estates of any size. This page is deliberately narrower: one subscription, up to 25 servers, the controls a checklist row needs, the add-ons off, the records an auditor reads, in one week of effort. If you start here and later want the governance layer, nothing is thrown away; the Arc connection and the maintenance configurations carry forward.
$1,950 plus $25 per server, fixed for the standard scope and quoted in writing before work begins; you pay after you approve delivery. A server counts once even if it is rebuilt and onboarded again during the engagement. Above 25 servers, more than one subscription, or several requirement documents from different parties, we quote in writing — usually still per server, with the base fee adjusted for the extra windows and records. Microsoft's charges are separate and are described in words above; the hand-over document names the rule that applies to each server.