1 00:00:00,000 --> 00:00:01,380 Let's start with the problem. 2 00:00:01,380 --> 00:00:04,200 You've probably felt it even if you never had a name for it. 3 00:00:04,200 --> 00:00:06,340 Most companies today don't have one single place 4 00:00:06,340 --> 00:00:07,580 where everything lives. 5 00:00:07,580 --> 00:00:09,220 You've got servers in your own data center 6 00:00:09,220 --> 00:00:11,100 that once your predecessor set up 10 years ago 7 00:00:11,100 --> 00:00:12,120 that still run payroll. 8 00:00:12,120 --> 00:00:14,020 You've got virtual machines in Azure, 9 00:00:14,020 --> 00:00:16,520 maybe for a new application, your team built last year. 10 00:00:16,520 --> 00:00:18,300 You've got stuff running on Amazon Web Services 11 00:00:18,300 --> 00:00:21,240 because a department went rogue and spun up their own account. 12 00:00:21,240 --> 00:00:24,040 Maybe even some Google Cloud for a specific analytics job. 13 00:00:24,040 --> 00:00:24,920 Here's the thing. 14 00:00:24,920 --> 00:00:27,280 Each one of those environments has its own portal. 15 00:00:27,280 --> 00:00:30,260 Its own management tools, its own way of applying policies, 16 00:00:30,260 --> 00:00:32,760 its own security dashboard, its own patching schedule. 17 00:00:32,760 --> 00:00:33,980 So what does that mean for you? 18 00:00:33,980 --> 00:00:36,260 Your team ends up jumping between four different consoles 19 00:00:36,260 --> 00:00:38,500 just to see what you have let alone manage it. 20 00:00:38,500 --> 00:00:40,440 Security policies get applied unevenly 21 00:00:40,440 --> 00:00:43,060 because nobody remembers to check every environment. 22 00:00:43,060 --> 00:00:44,240 Patches slip through the cracks 23 00:00:44,240 --> 00:00:46,560 because one environment uses a different update tool 24 00:00:46,560 --> 00:00:47,400 than the others. 25 00:00:47,400 --> 00:00:50,420 And when something breaks, you're digging through multiple log 26 00:00:50,420 --> 00:00:53,040 sources trying to piece together what happened. 27 00:00:53,040 --> 00:00:54,880 This fragmentation creates blind spots 28 00:00:54,880 --> 00:00:56,200 and blind spots create risk. 29 00:00:56,200 --> 00:00:59,360 You don't know if every server has the latest security patch. 30 00:00:59,360 --> 00:01:01,040 You don't know if a configuration drifted 31 00:01:01,040 --> 00:01:03,120 on that one machine running in AWS. 32 00:01:03,120 --> 00:01:05,080 You don't even know how many servers you actually have 33 00:01:05,080 --> 00:01:06,360 across all these environments. 34 00:01:06,360 --> 00:01:07,320 The pain is real. 35 00:01:07,320 --> 00:01:09,200 Managing a hybrid or multi-cloud world 36 00:01:09,200 --> 00:01:10,600 without a single control plane 37 00:01:10,600 --> 00:01:12,840 leads to wasted time, security gaps, 38 00:01:12,840 --> 00:01:14,960 and operational inefficiency. 39 00:01:14,960 --> 00:01:17,000 You're spending more time switching tools 40 00:01:17,000 --> 00:01:18,640 than actually managing your infrastructure. 41 00:01:18,640 --> 00:01:21,040 But what if you could bring all those environments together 42 00:01:21,040 --> 00:01:22,040 under one roof? 43 00:01:22,040 --> 00:01:25,640 What Azure Arc actually is, the bridge. 44 00:01:25,640 --> 00:01:27,280 That's where Azure Arc comes in. 45 00:01:27,280 --> 00:01:29,520 Let me be clear about what it is right from the start. 46 00:01:29,520 --> 00:01:31,240 Azure Arc is not a cloud. 47 00:01:31,240 --> 00:01:32,680 It doesn't replace your data center. 48 00:01:32,680 --> 00:01:34,600 It doesn't migrate your servers anywhere. 49 00:01:34,600 --> 00:01:35,800 Think of it as a bridge. 50 00:01:35,800 --> 00:01:38,040 A connection between the servers you already have 51 00:01:38,040 --> 00:01:39,440 and Azure's management tools. 52 00:01:39,440 --> 00:01:40,440 Here's how it works. 53 00:01:40,440 --> 00:01:43,000 Azure Arc projects any machine running outside Azure 54 00:01:43,000 --> 00:01:44,280 into Azure Resource Manager. 55 00:01:44,280 --> 00:01:46,360 That's the engine that powers everything in Azure. 56 00:01:46,360 --> 00:01:48,600 Every virtual machine, every database, 57 00:01:48,600 --> 00:01:50,200 every resource you see in the portal 58 00:01:50,200 --> 00:01:52,200 has a record in Azure Resource Manager. 59 00:01:52,200 --> 00:01:54,280 With Arc, a server sitting in your basement, 60 00:01:54,280 --> 00:01:56,240 a virtual machine running on AWS, 61 00:01:56,240 --> 00:01:57,920 or a Kubernetes cluster at the edge 62 00:01:57,920 --> 00:02:00,000 all get their own Azure Resource ID. 63 00:02:00,000 --> 00:02:02,760 They show up in the portal just like native Azure resources. 64 00:02:02,760 --> 00:02:04,680 And once they're there, you can do things with them. 65 00:02:04,680 --> 00:02:07,680 You can apply Azure Policy to enforce security settings. 66 00:02:07,680 --> 00:02:10,600 You can use Azure Monitor to collect performance data and logs. 67 00:02:10,600 --> 00:02:12,880 You can enable Microsoft Defender for Cloud 68 00:02:12,880 --> 00:02:15,560 to scan for vulnerabilities and detect threats. 69 00:02:15,560 --> 00:02:17,400 All on servers that aren't running in Azure. 70 00:02:17,400 --> 00:02:18,600 The core idea is simple. 71 00:02:18,600 --> 00:02:19,920 You don't need to migrate anything 72 00:02:19,920 --> 00:02:21,880 to get Azure's management capabilities. 73 00:02:21,880 --> 00:02:23,240 You don't move your workloads. 74 00:02:23,240 --> 00:02:25,000 You don't re-architect your applications. 75 00:02:25,000 --> 00:02:26,400 You just connect what you already have 76 00:02:26,400 --> 00:02:27,960 to Azure's management plane. 77 00:02:27,960 --> 00:02:29,280 This works with Windows Server. 78 00:02:29,280 --> 00:02:30,480 It works with Linux. 79 00:02:30,480 --> 00:02:32,960 It works with Kubernetes clusters running anywhere. 80 00:02:32,960 --> 00:02:34,560 It works with SQL Server instances. 81 00:02:34,560 --> 00:02:37,040 It even works with Azure Data Services 82 00:02:37,040 --> 00:02:38,640 that you can run on your own hardware. 83 00:02:38,640 --> 00:02:40,760 So whether your server is in a data center, 84 00:02:40,760 --> 00:02:43,320 a remote branch office, an AWS region, 85 00:02:43,320 --> 00:02:44,720 or a Google Cloud Zone, 86 00:02:44,720 --> 00:02:46,840 Arc brings it into the same management experience. 87 00:02:46,840 --> 00:02:48,400 That's the simplest definition. 88 00:02:48,400 --> 00:02:50,920 Azure Arc brings Azure's management plane 89 00:02:50,920 --> 00:02:52,400 to where your servers already live. 90 00:02:52,400 --> 00:02:53,920 So how does this bridge actually work? 91 00:02:53,920 --> 00:02:56,040 It starts with a small piece of software. 92 00:02:56,040 --> 00:02:58,480 The secret source, the connected machine agent. 93 00:02:58,480 --> 00:03:01,040 So what exactly is the Azure connected machine agent? 94 00:03:01,040 --> 00:03:02,640 It's a lightweight piece of software 95 00:03:02,640 --> 00:03:05,560 you install on each server you want to manage through Arc. 96 00:03:05,560 --> 00:03:07,360 Once installed, the agent connects outbound 97 00:03:07,360 --> 00:03:10,200 to Azure over HTTPS on port 443, 98 00:03:10,200 --> 00:03:11,720 the same port your browser uses. 99 00:03:11,720 --> 00:03:14,800 So you don't need to open inbound ports or set up a VPN. 100 00:03:14,800 --> 00:03:17,160 The server reaches out to Azure, not the other way around, 101 00:03:17,160 --> 00:03:18,520 which means better security 102 00:03:18,520 --> 00:03:20,520 without punching holes in your firewall. 103 00:03:20,520 --> 00:03:22,600 Once that connection is made, your server, 104 00:03:22,600 --> 00:03:25,080 whether it's in your data center or running on AWS, 105 00:03:25,080 --> 00:03:27,760 appears in the Azure portal as a full Azure resource. 106 00:03:27,760 --> 00:03:29,880 It gets a resource ID, a region assignment, 107 00:03:29,880 --> 00:03:32,160 and a resource group just like any Azure VM. 108 00:03:32,160 --> 00:03:34,920 You can tag it, apply policies, monitor it, and manage it. 109 00:03:34,920 --> 00:03:35,880 Here's the best part. 110 00:03:35,880 --> 00:03:36,720 The agent is free. 111 00:03:36,720 --> 00:03:39,560 Connecting a server to Azure Arc costs nothing. 112 00:03:39,560 --> 00:03:41,520 You only pay for the services you enable on top, 113 00:03:41,520 --> 00:03:43,120 like Microsoft Defender for Cloud, 114 00:03:43,120 --> 00:03:45,080 Azure Update Manager, or Azure Monitor. 115 00:03:45,080 --> 00:03:47,040 So your bill only covers what you actually use. 116 00:03:47,040 --> 00:03:48,280 What does the agent actually do? 117 00:03:48,280 --> 00:03:50,960 It keeps the communication channel with Azure open. 118 00:03:50,960 --> 00:03:52,320 It handles extensions. 119 00:03:52,320 --> 00:03:55,240 Think of those as add-ons for monitoring or security scanning. 120 00:03:55,240 --> 00:03:56,640 And it sends inventory data back 121 00:03:56,640 --> 00:03:59,320 so you always know what's running on that machine. 122 00:03:59,320 --> 00:04:01,040 Installation is straightforward. 123 00:04:01,040 --> 00:04:03,600 In the Azure portal, navigate to Azure Arc, 124 00:04:03,600 --> 00:04:06,560 select servers, and generate an onboarding script, 125 00:04:06,560 --> 00:04:08,960 PowerShell for Windows, or Shell for Linux. 126 00:04:08,960 --> 00:04:10,960 Run it on the target machine with admin rights, 127 00:04:10,960 --> 00:04:12,960 authenticate to Azure, and within minutes, 128 00:04:12,960 --> 00:04:14,520 the server appears in your portal. 129 00:04:14,520 --> 00:04:17,000 All you need is admin rights and internet access. 130 00:04:17,000 --> 00:04:19,840 Once connected, you manage it just like any Azure VM. 131 00:04:19,840 --> 00:04:22,040 Install extensions, run scripts, apply policies, 132 00:04:22,040 --> 00:04:24,200 monitor performance, the experience is identical. 133 00:04:24,200 --> 00:04:26,360 With the agent in place, you unlock capabilities 134 00:04:26,360 --> 00:04:28,360 that change how you manage that server. 135 00:04:28,360 --> 00:04:30,160 Let's start with governance. 136 00:04:30,160 --> 00:04:31,280 What arc unlocks? 137 00:04:31,280 --> 00:04:32,520 Governance at scale. 138 00:04:32,520 --> 00:04:34,440 So you've connected a server to Arc. 139 00:04:34,440 --> 00:04:35,280 Now what? 140 00:04:35,280 --> 00:04:36,880 The first thing you'll notice is that you can apply 141 00:04:36,880 --> 00:04:38,120 Azure policy to it. 142 00:04:38,120 --> 00:04:40,520 The same policy engine that governs Azure resources 143 00:04:40,520 --> 00:04:43,520 now extends to your on-prem or AWS servers. 144 00:04:43,520 --> 00:04:45,840 In practice, you enforce compliance rules 145 00:04:45,840 --> 00:04:48,760 across your entire fleet, no matter where machines live. 146 00:04:48,760 --> 00:04:51,200 Need every server to have a specific security setting, 147 00:04:51,200 --> 00:04:53,560 write a policy, assign it to your Arc enabled servers, 148 00:04:53,560 --> 00:04:55,720 and Azure continuously checks compliance. 149 00:04:55,720 --> 00:04:57,480 If a server drift, you get an alert. 150 00:04:57,480 --> 00:04:59,160 You can even set up automatic remediation 151 00:04:59,160 --> 00:05:01,120 in some cases, tagging is another piece. 152 00:05:01,120 --> 00:05:03,080 You already tag Azure resources 153 00:05:03,080 --> 00:05:05,520 with environment, cost center, and owner tags. 154 00:05:05,520 --> 00:05:07,440 With Arc, you tag hybrid servers the same way. 155 00:05:07,440 --> 00:05:10,280 So that machine in your basement gets the same tags 156 00:05:10,280 --> 00:05:13,000 as your Azure VMs, making cost tracking, ownership, 157 00:05:13,000 --> 00:05:16,360 and environment separation consistent across your whole estate. 158 00:05:16,360 --> 00:05:17,920 Next up is access control. 159 00:05:17,920 --> 00:05:20,160 Azure RBAC lets you define who can do what 160 00:05:20,160 --> 00:05:22,960 on your on-prem servers through the Azure portal. 161 00:05:22,960 --> 00:05:25,080 Give your junior admin read only access 162 00:05:25,080 --> 00:05:27,320 to see inventory without making changes 163 00:05:27,320 --> 00:05:29,800 and let your security team run vulnerability scans 164 00:05:29,800 --> 00:05:33,040 without full admin access, or control from Azure, 165 00:05:33,040 --> 00:05:35,160 not from local policies on each server. 166 00:05:35,160 --> 00:05:36,880 Azure machine configuration goes further. 167 00:05:36,880 --> 00:05:38,760 It audits and sets OS level settings 168 00:05:38,760 --> 00:05:41,080 across your entire fleet from one place. 169 00:05:41,080 --> 00:05:43,800 Want Bitlocker enabled on every Windows server? 170 00:05:43,800 --> 00:05:46,160 Write a policy that checks and reports compliance. 171 00:05:46,160 --> 00:05:48,160 Need a specific registry key set correctly 172 00:05:48,160 --> 00:05:49,560 on all your Linux machines? 173 00:05:49,560 --> 00:05:50,320 Same thing. 174 00:05:50,320 --> 00:05:53,000 Define the desired state once, and Azure evaluates 175 00:05:53,000 --> 00:05:55,240 every Arc enabled server against it. 176 00:05:55,240 --> 00:05:56,560 Let me give you a concrete example. 177 00:05:56,560 --> 00:05:59,120 Say you have servers spread across three data centers, 178 00:05:59,120 --> 00:06:01,880 two cloud providers, and a dozen remote retail locations. 179 00:06:01,880 --> 00:06:03,960 You want to enforce a security baseline? 180 00:06:03,960 --> 00:06:06,080 Encryption enabled, certain ports closed, 181 00:06:06,080 --> 00:06:07,760 a specific antivirus installed. 182 00:06:07,760 --> 00:06:09,920 Without Arc, you'd check each environment 183 00:06:09,920 --> 00:06:11,080 with different tools. 184 00:06:11,080 --> 00:06:14,480 With Arc, you write one policy, assign it to the relevant scope, 185 00:06:14,480 --> 00:06:16,800 and Azure shows you which servers are compliant 186 00:06:16,800 --> 00:06:19,560 and which aren't, all in a single dashboard. 187 00:06:19,560 --> 00:06:20,760 That's governance at scale. 188 00:06:20,760 --> 00:06:22,600 One set of rules, one view of compliance, 189 00:06:22,600 --> 00:06:24,240 no matter where your servers live. 190 00:06:24,240 --> 00:06:26,160 Once you have that governance layer in place, 191 00:06:26,160 --> 00:06:27,920 the next thing to tackle is security, 192 00:06:27,920 --> 00:06:30,880 because threats don't care where your server runs. 193 00:06:30,880 --> 00:06:32,080 What Arc unlocks? 194 00:06:32,080 --> 00:06:33,520 Security and monitoring. 195 00:06:33,520 --> 00:06:37,040 Here's where Arc really shows its value, security. 196 00:06:37,040 --> 00:06:39,120 The hard truth is, a vulnerability sitting 197 00:06:39,120 --> 00:06:41,200 on a server in your data center is just as dangerous 198 00:06:41,200 --> 00:06:42,480 as one running in Azure. 199 00:06:42,480 --> 00:06:44,400 But without Arc, you're probably handling those 200 00:06:44,400 --> 00:06:46,080 with different tools, different processes, 201 00:06:46,080 --> 00:06:47,440 maybe even different teams. 202 00:06:47,440 --> 00:06:48,840 That changes now. 203 00:06:48,840 --> 00:06:51,040 With Arc, Microsoft Defender for Cloud extends 204 00:06:51,040 --> 00:06:52,280 to your hybrid servers. 205 00:06:52,280 --> 00:06:53,800 So the same vulnerability assessments, 206 00:06:53,800 --> 00:06:55,600 threat detection, and security recommendations 207 00:06:55,600 --> 00:06:58,320 you already get for Azure VMs, now applied to machines 208 00:06:58,320 --> 00:07:00,840 running on-prem, on AWS, or at the edge. 209 00:07:00,840 --> 00:07:02,680 Defender scans your entire hybrid fleet 210 00:07:02,680 --> 00:07:04,520 for missing patches, weak configurations, 211 00:07:04,520 --> 00:07:05,800 and suspicious activity. 212 00:07:05,800 --> 00:07:07,440 Then surfaces everything in the dashboard 213 00:07:07,440 --> 00:07:09,320 you already use for Azure resources. 214 00:07:09,320 --> 00:07:10,840 No more juggling separate tools. 215 00:07:10,840 --> 00:07:12,240 What about incident response? 216 00:07:12,240 --> 00:07:15,000 Microsoft Sentinel can pull logs from Arc machines too. 217 00:07:15,000 --> 00:07:16,840 So if Sentinel is your security information 218 00:07:16,840 --> 00:07:18,160 and event management tool, 219 00:07:18,160 --> 00:07:20,120 you get one unified security dashboard 220 00:07:20,120 --> 00:07:21,200 for every environment. 221 00:07:21,200 --> 00:07:22,960 No more jumping between different log sources, 222 00:07:22,960 --> 00:07:24,840 trying to piece together what happened. 223 00:07:24,840 --> 00:07:28,400 All your security data from all your servers lands in one place. 224 00:07:28,400 --> 00:07:29,480 Then there's monitoring. 225 00:07:29,480 --> 00:07:31,960 Azure Monitor collects performance metrics, logs, 226 00:07:31,960 --> 00:07:33,640 and alerts from hybrid machines, 227 00:07:33,640 --> 00:07:35,760 just like it does from native Azure VMs. 228 00:07:35,760 --> 00:07:37,440 Set up a log analytics workspace, 229 00:07:37,440 --> 00:07:39,160 configure your data collection rules, 230 00:07:39,160 --> 00:07:41,720 and start seeing CPU, memory, disk, and network data 231 00:07:41,720 --> 00:07:43,320 from every Arc enabled server. 232 00:07:43,320 --> 00:07:46,320 Want to know if a server's CPU stays above 90% 233 00:07:46,320 --> 00:07:47,760 for more than 15 minutes? 234 00:07:47,760 --> 00:07:48,960 You create an alert, 235 00:07:48,960 --> 00:07:51,880 and that alert fires whether that server lives in Azure, 236 00:07:51,880 --> 00:07:54,240 your data center, or in AWS region. 237 00:07:54,240 --> 00:07:56,440 VM Insights gives you real-time visibility 238 00:07:56,440 --> 00:07:59,360 into CPU, memory, and disk usage across your entire fleet. 239 00:07:59,360 --> 00:08:01,280 You can open a map of your servers, 240 00:08:01,280 --> 00:08:02,920 spot which ones are running hot, 241 00:08:02,920 --> 00:08:04,440 and drill into performance details 242 00:08:04,440 --> 00:08:06,360 without leaving the Azure portal. 243 00:08:06,360 --> 00:08:09,000 And this works for servers on-prem in AWS 244 00:08:09,000 --> 00:08:11,000 anywhere they happen to be. 245 00:08:11,000 --> 00:08:13,680 One more piece, extended security updates. 246 00:08:13,680 --> 00:08:15,080 Running an out-of-support version 247 00:08:15,080 --> 00:08:17,800 like SQL Server 2012 or Windows Server 2012, 248 00:08:17,800 --> 00:08:19,800 before you have to migrate those workloads 249 00:08:19,800 --> 00:08:21,560 to Azure to keep getting security patches. 250 00:08:21,560 --> 00:08:23,600 With Arc, you get those patches on-prem, 251 00:08:23,600 --> 00:08:25,160 no migration required. 252 00:08:25,160 --> 00:08:26,840 The updates come through the Arc channel, 253 00:08:26,840 --> 00:08:30,240 keeping your legacy system secure while you plan your next move. 254 00:08:30,240 --> 00:08:31,200 And here's a key point. 255 00:08:31,200 --> 00:08:34,800 You don't need a VPN or a bastion host to get remote visibility. 256 00:08:34,800 --> 00:08:37,120 All that monitoring data flows through the Arc agent 257 00:08:37,120 --> 00:08:38,720 secure outbound channel, 258 00:08:38,720 --> 00:08:40,760 no inbound ports, no complex networking, 259 00:08:40,760 --> 00:08:43,360 just the agent talking to Azure over HTPS. 260 00:08:43,360 --> 00:08:46,320 So you can see your servers monitor them and keep them secure, 261 00:08:46,320 --> 00:08:48,240 but what happens when you actually need to fix something 262 00:08:48,240 --> 00:08:49,720 or install an update? 263 00:08:49,720 --> 00:08:50,760 What Arc unlocks? 264 00:08:50,760 --> 00:08:52,400 Updates and remote management. 265 00:08:52,400 --> 00:08:55,520 You can see your servers, monitor them, and enforce policies. 266 00:08:55,520 --> 00:08:57,200 But eventually you need to do things, 267 00:08:57,200 --> 00:08:59,800 install updates, run scripts, troubleshoot issues. 268 00:08:59,800 --> 00:09:00,720 Arc handles that too. 269 00:09:00,720 --> 00:09:02,920 Azure Update Manager lets you schedule patching across 270 00:09:02,920 --> 00:09:05,320 all your Arc machines from a single dashboard. 271 00:09:05,320 --> 00:09:06,560 See which servers need updates, 272 00:09:06,560 --> 00:09:08,760 create a maintenance window and deploy patches, 273 00:09:08,760 --> 00:09:10,320 and it's not just Arc machines. 274 00:09:10,320 --> 00:09:13,560 You can include Azure VMs and even AWS EC2 instances 275 00:09:13,560 --> 00:09:14,480 in the same schedule. 276 00:09:14,480 --> 00:09:16,040 One dashboard, one patching rhythm, 277 00:09:16,040 --> 00:09:17,520 no matter where the server lives. 278 00:09:17,520 --> 00:09:19,280 Need to run a script on a remote machine. 279 00:09:19,280 --> 00:09:21,440 The custom script extension works on Arc servers 280 00:09:21,440 --> 00:09:23,360 just like it does on Azure VMs. 281 00:09:23,360 --> 00:09:25,120 Upload a PowerShell or Bash script, 282 00:09:25,120 --> 00:09:26,640 pick which servers to target 283 00:09:26,640 --> 00:09:28,680 and Azure executes it through the Arc agent. 284 00:09:28,680 --> 00:09:31,600 No RDP, no SSH into each machine individually. 285 00:09:31,600 --> 00:09:33,840 You can run the same script across hundreds of servers 286 00:09:33,840 --> 00:09:34,840 with a few clicks. 287 00:09:34,840 --> 00:09:36,840 Windows Admin Center in Azure gives you 288 00:09:36,840 --> 00:09:38,920 browser-based management for Arc servers. 289 00:09:38,920 --> 00:09:41,480 Open a console, view event logs, manage services, 290 00:09:41,480 --> 00:09:44,000 work with files, all through the Azure portal 291 00:09:44,000 --> 00:09:46,840 without a VPN or a public IP on the target server. 292 00:09:46,840 --> 00:09:49,360 The connection goes through the Arc agent's secure channel. 293 00:09:49,360 --> 00:09:52,160 That's a game changer for servers in remote locations 294 00:09:52,160 --> 00:09:53,800 or locked down environments 295 00:09:53,800 --> 00:09:56,600 where opening remote access ports isn't an option. 296 00:09:56,600 --> 00:09:58,600 Remote support provides just in time access 297 00:09:58,600 --> 00:10:00,080 with full audit logging. 298 00:10:00,080 --> 00:10:01,680 When you need to troubleshoot a problem, 299 00:10:01,680 --> 00:10:03,880 you grant temporary access through Arc. 300 00:10:03,880 --> 00:10:06,800 The session gets logged, everything that happens is recorded 301 00:10:06,800 --> 00:10:08,800 and when you're done, the access is revoked, 302 00:10:08,800 --> 00:10:11,880 no standing admin accounts, no permanent remote access paths. 303 00:10:11,880 --> 00:10:14,160 And as your automation runbooks can automate workflows 304 00:10:14,160 --> 00:10:16,840 across your hybrid environment, onboarding new servers, 305 00:10:16,840 --> 00:10:19,400 fixing configuration drift, responding to alerts. 306 00:10:19,400 --> 00:10:20,480 You write a runbook once 307 00:10:20,480 --> 00:10:22,680 and it runs across all your Arc enabled machines. 308 00:10:22,680 --> 00:10:24,520 So now you've got governance, security, monitoring, 309 00:10:24,520 --> 00:10:26,080 updates and remote management, 310 00:10:26,080 --> 00:10:28,240 all from one place for servers that aren't even in Azure. 311 00:10:28,240 --> 00:10:30,600 That's the core of what Arc delivers. 312 00:10:30,600 --> 00:10:34,360 Beyond servers, Kubernetes, SQL Server and data. 313 00:10:34,360 --> 00:10:36,560 So far, we've been talking about individual servers, 314 00:10:36,560 --> 00:10:38,320 your physical or virtual machines, 315 00:10:38,320 --> 00:10:39,840 but Arc doesn't stop there. 316 00:10:39,840 --> 00:10:43,680 It extends to Kubernetes clusters, SQL Server instances 317 00:10:43,680 --> 00:10:44,800 and even data services. 318 00:10:44,800 --> 00:10:46,040 Let's start with Kubernetes. 319 00:10:46,040 --> 00:10:47,840 If you're running Kubernetes on premises, 320 00:10:47,840 --> 00:10:51,200 on AWS, EKS or at the edge, Azure Arc projects 321 00:10:51,200 --> 00:10:53,520 those clusters into Azure resource manager, 322 00:10:53,520 --> 00:10:56,720 so they show up in the portal right alongside your other resources. 323 00:10:56,720 --> 00:11:00,040 You see all your clusters in one inventory, no matter where they run. 324 00:11:00,040 --> 00:11:01,440 Once the cluster is connected, 325 00:11:01,440 --> 00:11:04,640 you can use GitOps with Flux to define your cluster's desired state 326 00:11:04,640 --> 00:11:06,960 in a Git repository and Flux continuously 327 00:11:06,960 --> 00:11:08,720 reconciles the cluster to match it. 328 00:11:08,720 --> 00:11:10,960 Deployments, configurations, namespace settings, 329 00:11:10,960 --> 00:11:13,960 all managed through code and consistent across every environment. 330 00:11:13,960 --> 00:11:16,040 Plus, you get performance monitoring through Azure Monitor 331 00:11:16,040 --> 00:11:17,960 for containers or from the same dashboard 332 00:11:17,960 --> 00:11:19,400 you use for everything else. 333 00:11:19,400 --> 00:11:22,560 For SQL Server, Arc brings a whole new set of capabilities. 334 00:11:22,560 --> 00:11:24,440 Best practice assessments run automatically 335 00:11:24,440 --> 00:11:27,280 to evaluate your SQL instances for configuration issues, 336 00:11:27,280 --> 00:11:28,960 performance problems and security gaps 337 00:11:28,960 --> 00:11:31,960 while vulnerability scanning identifies potential weaknesses. 338 00:11:31,960 --> 00:11:33,920 And you get pay as you go licensing, 339 00:11:33,920 --> 00:11:36,600 paying per core per hour through your Azure subscription, 340 00:11:36,600 --> 00:11:38,880 even though the instance runs on your own hardware. 341 00:11:38,880 --> 00:11:42,240 Arc enabled SQL managed instance is where things get really interesting. 342 00:11:42,240 --> 00:11:44,320 It lets you run a fully managed SQL instance 343 00:11:44,320 --> 00:11:45,680 on your own infrastructure 344 00:11:45,680 --> 00:11:48,160 with the same engine as Azure SQL managed instance, 345 00:11:48,160 --> 00:11:51,320 including automatic updates, built in higher availability 346 00:11:51,320 --> 00:11:52,520 and elastic scaling. 347 00:11:52,520 --> 00:11:54,680 But it runs on your hardware in your data center, 348 00:11:54,680 --> 00:11:57,320 perfect for workloads that can't move to the cloud yet 349 00:11:57,320 --> 00:12:00,400 due to latency, regulation or legacy dependencies, 350 00:12:00,400 --> 00:12:02,680 but still need modern management. 351 00:12:02,680 --> 00:12:05,880 Migration assessments run automatically every seven days, 352 00:12:05,880 --> 00:12:08,320 evaluating your SQL databases and telling you 353 00:12:08,320 --> 00:12:09,920 what's ready to move to Azure, 354 00:12:09,920 --> 00:12:12,640 whether the right target is Azure SQL database, 355 00:12:12,640 --> 00:12:15,720 SQL managed instance or a SQL VM. 356 00:12:15,720 --> 00:12:17,600 And what blockers you need to address. 357 00:12:17,600 --> 00:12:20,680 This runs continuously so you always know where you stand. 358 00:12:20,680 --> 00:12:22,920 And for SQL Server 2012 and older, 359 00:12:22,920 --> 00:12:25,360 Arc delivers extended security updates 360 00:12:25,360 --> 00:12:27,640 without requiring you to migrate to Azure. 361 00:12:27,640 --> 00:12:29,560 The security patches come through the Arc channel 362 00:12:29,560 --> 00:12:31,240 to keep your legacy systems protected 363 00:12:31,240 --> 00:12:32,800 while you plan your next steps. 364 00:12:32,800 --> 00:12:35,160 This is where Arc becomes more than a management tool. 365 00:12:35,160 --> 00:12:36,920 You get cloud-like management and security 366 00:12:36,920 --> 00:12:38,400 on your existing infrastructure 367 00:12:38,400 --> 00:12:41,320 with a clear path to migration when you're ready. 368 00:12:41,320 --> 00:12:45,720 The multi-cloud reality, managing AWS and GCP. 369 00:12:45,720 --> 00:12:48,880 What about when your servers live inside another cloud entirely? 370 00:12:48,880 --> 00:12:50,440 Arc has an answer for that too. 371 00:12:50,440 --> 00:12:52,840 The multi-cloud connector for AWS is a resource 372 00:12:52,840 --> 00:12:55,680 you create an Azure that connects to your AWS environment, 373 00:12:55,680 --> 00:13:00,680 discovers EC2 instances, S3 buckets, and over 125 resource types, 374 00:13:00,680 --> 00:13:03,200 and replicates them all into Azure resource manager. 375 00:13:03,200 --> 00:13:06,640 So you see AWS resources alongside your Azure resources 376 00:13:06,640 --> 00:13:09,440 in the portal across Azure resource graph queries 377 00:13:09,440 --> 00:13:10,800 and in your dashboards. 378 00:13:10,800 --> 00:13:13,200 The connector can automatically install the Arc agent 379 00:13:13,200 --> 00:13:15,160 on discovered EC2 instances 380 00:13:15,160 --> 00:13:17,400 so you don't have to manually onboard each one. 381 00:13:17,400 --> 00:13:19,600 It identifies your AWS servers, 382 00:13:19,600 --> 00:13:22,960 installs the agent and brings them under Azure management. 383 00:13:22,960 --> 00:13:25,240 And when new instances spin up in AWS, 384 00:13:25,240 --> 00:13:27,920 they're automatically discovered and onboarded. 385 00:13:27,920 --> 00:13:29,360 For Google Cloud Platform, 386 00:13:29,360 --> 00:13:31,920 a similar connector brings inventory visibility 387 00:13:31,920 --> 00:13:33,360 and management capabilities. 388 00:13:33,360 --> 00:13:35,200 You provide your GCP project details 389 00:13:35,200 --> 00:13:36,760 and the connector discovers resources 390 00:13:36,760 --> 00:13:38,480 and makes them visible in Azure. 391 00:13:38,480 --> 00:13:40,040 Once these machines are connected, 392 00:13:40,040 --> 00:13:43,360 you can run Azure Policy and Azure Update Manager across them. 393 00:13:43,360 --> 00:13:45,400 The same policies you apply to your Azure VMs 394 00:13:45,400 --> 00:13:48,240 and on-prem servers now apply to machines running in AWS 395 00:13:48,240 --> 00:13:50,400 and GCP with the same update schedules 396 00:13:50,400 --> 00:13:53,320 and the same compliance reporting or from one place. 397 00:13:53,320 --> 00:13:54,760 This gives you a single pane of glass 398 00:13:54,760 --> 00:13:57,120 for all servers regardless of provider. 399 00:13:57,120 --> 00:14:00,640 You stop thinking about my Azure servers and my AWS servers 400 00:14:00,640 --> 00:14:02,840 and start thinking about simply my servers. 401 00:14:02,840 --> 00:14:04,880 The location becomes a property of the resource, 402 00:14:04,880 --> 00:14:06,880 not a separate management domain. 403 00:14:06,880 --> 00:14:08,160 What Arc is not? 404 00:14:08,160 --> 00:14:09,560 Clearing up confusion. 405 00:14:09,560 --> 00:14:11,280 Now that you've seen what Arc can do, 406 00:14:11,280 --> 00:14:12,880 let's clear up a few common myths. 407 00:14:12,880 --> 00:14:14,040 Here's what Arc is not. 408 00:14:14,040 --> 00:14:16,280 Myth number one is Azure Arc a Cloud? 409 00:14:16,280 --> 00:14:16,960 No. 410 00:14:16,960 --> 00:14:19,320 It doesn't give you compute storage or networking. 411 00:14:19,320 --> 00:14:21,040 It doesn't run your applications. 412 00:14:21,040 --> 00:14:22,400 Think of it as a management layer. 413 00:14:22,400 --> 00:14:24,080 It connects your existing infrastructure 414 00:14:24,080 --> 00:14:25,320 to Azure's management tools. 415 00:14:25,320 --> 00:14:26,840 Your workloads stay where they are. 416 00:14:26,840 --> 00:14:28,760 Arc just gives you a better way to manage them. 417 00:14:28,760 --> 00:14:31,120 Imagine you have a building with its own security system. 418 00:14:31,120 --> 00:14:32,440 Arc doesn't move the building. 419 00:14:32,440 --> 00:14:33,840 It just installs a new smart lock 420 00:14:33,840 --> 00:14:35,720 you can control from anywhere. 421 00:14:35,720 --> 00:14:38,320 Myth number two, does Arc migrate your servers? 422 00:14:38,320 --> 00:14:39,160 Not at all. 423 00:14:39,160 --> 00:14:40,120 Nothing moves. 424 00:14:40,120 --> 00:14:42,120 The machine stays right where it is. 425 00:14:42,120 --> 00:14:45,320 In your data center on AWS or wherever you run it, 426 00:14:45,320 --> 00:14:48,080 Arc creates a pointer in Azure resource manager, not a copy. 427 00:14:48,080 --> 00:14:50,080 Think of it as a bookmark instead of a photocopied. 428 00:14:50,080 --> 00:14:52,920 The actual workload never leaves its original location. 429 00:14:52,920 --> 00:14:55,760 Myth number three, do you need Arc on a VM that's already in Azure? 430 00:14:55,760 --> 00:14:56,600 No. 431 00:14:56,600 --> 00:14:59,200 Native Azure VMs already have the Azure VM agent built in. 432 00:14:59,200 --> 00:15:01,480 That agent gives you the same management capabilities. 433 00:15:01,480 --> 00:15:03,280 Arc is only for machines outside Azure. 434 00:15:03,280 --> 00:15:06,600 If your VM is already in Azure, you're already set. 435 00:15:06,600 --> 00:15:10,080 Myth number four is Arc a replacement for your current tools? 436 00:15:10,080 --> 00:15:10,720 No. 437 00:15:10,720 --> 00:15:13,680 It adds Azure's capabilities on top of what you already have. 438 00:15:13,680 --> 00:15:16,600 You can keep using System Center, Configuration Manager, 439 00:15:16,600 --> 00:15:18,280 or whatever tools you've invested in, 440 00:15:18,280 --> 00:15:19,800 Arc complements those tools. 441 00:15:19,800 --> 00:15:21,960 It adds a new layer of cloud-based governance 442 00:15:21,960 --> 00:15:25,960 and security that your existing tools might not offer. 443 00:15:25,960 --> 00:15:27,920 Myth number five, what about the agent? 444 00:15:27,920 --> 00:15:28,600 Is it heavy? 445 00:15:28,600 --> 00:15:29,880 No, it's lightweight. 446 00:15:29,880 --> 00:15:32,520 Uses minimal CPU and memory, and it's free. 447 00:15:32,520 --> 00:15:34,760 The cost comes from the services you enable on top, 448 00:15:34,760 --> 00:15:36,760 like Defender for Cloud or Azure Monitor, 449 00:15:36,760 --> 00:15:38,800 connecting a server costs nothing. 450 00:15:38,800 --> 00:15:41,200 Zero, Zilch. 451 00:15:41,200 --> 00:15:44,080 Myth number six is Arc only for servers? 452 00:15:44,080 --> 00:15:46,680 No, it works with Kubernetes, SQL Server, 453 00:15:46,680 --> 00:15:48,160 data services, and more. 454 00:15:48,160 --> 00:15:50,240 It's a platform that extends as your management 455 00:15:50,240 --> 00:15:53,320 to any resource type anywhere you have it running. 456 00:15:53,320 --> 00:15:55,120 The big picture, one control plane. 457 00:15:55,120 --> 00:15:56,680 So what does all of this add up to? 458 00:15:56,680 --> 00:15:59,000 Here's the thing, the real value of Azure Arc 459 00:15:59,000 --> 00:16:00,280 isn't any single feature. 460 00:16:00,280 --> 00:16:02,920 It's integration, not the agent, not the policies, 461 00:16:02,920 --> 00:16:04,040 not the monitoring. 462 00:16:04,040 --> 00:16:05,920 It's how all these pieces work together 463 00:16:05,920 --> 00:16:07,680 to give you one consistent way 464 00:16:07,680 --> 00:16:09,720 to manage every server you own. 465 00:16:09,720 --> 00:16:11,160 Now imagine your day to day. 466 00:16:11,160 --> 00:16:13,440 You stop jumping between four different portals. 467 00:16:13,440 --> 00:16:15,160 You stop worrying if a policy was applied 468 00:16:15,160 --> 00:16:17,400 to that one server running in AWS. 469 00:16:17,400 --> 00:16:18,880 You stop searching through different tools 470 00:16:18,880 --> 00:16:19,960 for the information you need. 471 00:16:19,960 --> 00:16:22,720 Instead, you have one place to govern, one to monitor, 472 00:16:22,720 --> 00:16:24,760 one to secure, one to patch. 473 00:16:24,760 --> 00:16:27,160 Your entire server estate, no matter where it lives, 474 00:16:27,160 --> 00:16:28,800 managed through a single control plane. 475 00:16:28,800 --> 00:16:30,080 That's the magic of it. 476 00:16:30,080 --> 00:16:32,120 And getting started is easier than you think. 477 00:16:32,120 --> 00:16:34,360 The hardest part only takes about 10 minutes. 478 00:16:34,360 --> 00:16:36,200 First, register the resource providers 479 00:16:36,200 --> 00:16:37,560 in your Azure subscription, 480 00:16:37,560 --> 00:16:39,400 then install the agent on one server. 481 00:16:39,400 --> 00:16:40,880 Watch it appear in the portal 482 00:16:40,880 --> 00:16:43,120 from there you add capabilities one at a time. 483 00:16:43,120 --> 00:16:45,440 Enable Azure policy, turn on Defender for Cloud, 484 00:16:45,440 --> 00:16:47,080 set up update manager. 485 00:16:47,080 --> 00:16:48,400 Each step builds on the last. 486 00:16:48,400 --> 00:16:50,080 You don't have to do everything at once. 487 00:16:50,080 --> 00:16:52,080 Start small and grow from there. 488 00:16:52,080 --> 00:16:52,960 Start simple. 489 00:16:52,960 --> 00:16:55,480 Head to the Azure portal, find Azure Arc, 490 00:16:55,480 --> 00:16:57,520 pick servers and hit create. 491 00:16:57,520 --> 00:16:59,360 Choose your subscription and resource group, 492 00:16:59,360 --> 00:17:00,840 generate the onboarding script 493 00:17:00,840 --> 00:17:02,320 and run it on a test machine. 494 00:17:02,320 --> 00:17:03,960 About 10 minutes later, you'll see a server 495 00:17:03,960 --> 00:17:05,920 that isn't inside Azure sitting right there 496 00:17:05,920 --> 00:17:07,840 in your portal ready to manage. 497 00:17:07,840 --> 00:17:10,040 That one experiment teaches you more about what Arc 498 00:17:10,040 --> 00:17:12,080 actually does than anything I can explain here. 499 00:17:12,080 --> 00:17:14,520 Subscribe to the show for more knowledge nuggets like this. 500 00:17:14,520 --> 00:17:17,480 Every week we break down Microsoft's platform in plain English 501 00:17:17,480 --> 00:17:18,920 and drop a comment with your biggest question 502 00:17:18,920 --> 00:17:20,800 about hybrid or multi-cloud management. 503 00:17:20,800 --> 00:17:22,040 I read every single one.