azure-arc

Name: azure-arc
Author: vinayaklatthe

161stars34forks

How to install azure-arc?

vinayaklatthe/microsoft-security-skills/azure-arc

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-arc

Installs into the current project.

Summary

Guidance for Azure Arc — projecting on-premises, multicloud (AWS/GCP), and edge servers, Kubernetes, and data services into Azure Resource Manager for unified governance, security, and management. Covers Arc-enabled servers onboarding, extending Defender for Cloud and Azure Polic

Files · 1

View on GitHub

SKILL.md

1	# Azure Arc
2
3	Azure Arc projects on-premises, multicloud, and edge resources into Azure Resource Manager so
4	they can be governed, secured, and managed with the same control plane as Azure-native
5	resources, extending Azure Policy, Microsoft Defender for Cloud, and Azure Monitor to hybrid
6	estates.
7
8	## When to use
9	Bringing non-Azure servers, Kubernetes clusters, and data services under consistent Azure
10	governance and security. Use this skill when you need one pane of glass and policy plane
11	across hybrid / multicloud machines.
12
13	Do not use this skill for Azure-native VMs (use ARM directly), Intune-managed endpoints
14	(`intune-device-mgmt`), or Azure Stack HCI deployment.
15
16	## Pick the Arc capability by resource type
17
18	\| Resource type \| Arc service \| What you get \|
19	\|---\|---\|---\|
20	\| On-prem / AWS / GCP server \| Arc-enabled servers \| Defender for Cloud, Policy, Update Manager, Monitor, RBAC \|
21	\| Non-AKS Kubernetes (on-prem, EKS, GKE) \| Arc-enabled Kubernetes \| GitOps via Flux, Policy, Monitor, Defender for Containers \|
22	\| SQL Server on-prem / other cloud \| Arc-enabled SQL Server \| Inventory, best-practice assessment, Defender \|
23	\| PostgreSQL / SQL MI at edge \| Arc-enabled data services \| Managed PaaS-like experience at edge \|
24	\| Hybrid app platform (containerised) \| Arc-enabled App Services / Functions \| PaaS runtime on Arc-enabled K8s \|
25
26	> Rule of thumb: start with Arc-enabled servers for hybrid posture - it's the
27	> highest-value, lowest-friction step. The Connected Machine agent gives you Defender for
28	> Cloud and Azure Policy across the hybrid estate for the price of an outbound HTTPS connection.
29
30	## Approach
31
32	1. Plan the onboarding scope and identity — Decide which subscriptions / resource groups
33	own the Arc resources. Define the target resource group per region / per business unit.
34	Pre-create service principals if onboarding at scale via script.
35	*Verify: target RG exists with the `Azure Connected Machine Onboarding` role assigned to
36	the onboarding identity.*
37
38	2. Plan network and proxy requirements — Connected Machine agent needs outbound HTTPS
39	(443) to a defined list of Microsoft endpoints. If servers are behind a corporate proxy,
40	configure the agent for proxy + auth. Some endpoints require firewall allowlisting.
41	Verify: a pilot server can reach `.his.arc.azure.com`, `*.guestconfiguration.azure.com`,
42	`.dp.kubernetesconfiguration.azure.com` (for K8s); agent install completes.
43
44	3. Onboard servers at scale — Pilot 5-10 servers manually (one Windows, one Linux).
45	Then script the rollout: GPO / Ansible / Configuration Manager for Windows; cloud-init /
46	Ansible for Linux. The agent script accepts service principal + tags.
47	Verify: Arc resource appears in the target RG; `Connected` status; tags applied.
48
49	4. Govern with Azure Policy + machine configuration — Assign Azure Policy initiatives
50	(e.g. Azure Security Benchmark) at the RG / subscription scope. **Machine configuration
51	(formerly guest configuration)** audits in-OS settings on Arc machines just like Azure
52	VMs.
53	*Verify: ASB initiative shows compliance state for Arc machines; in-OS audit returns
54	results (e.g. password complexity).*
55
56	5. Extend Defender for Cloud — Enable Defender for Servers Plan 2 on the subscription
57	that contains the Arc resources. Defender deploys MDE, file integrity monitoring, and
58	adaptive controls to the Arc machines.
59	Verify: Defender for Servers shows Arc machines as protected; MDE shows them onboarded.
60
61	6. Unify monitoring + updates — Send Arc machines' logs to Log Analytics via Azure
62	Monitor Agent (extension). Use Azure Update Manager to assess and deploy updates from
63	Azure across the hybrid fleet.
64
65	7. Grant access via Azure RBAC — Arc machines are ARM resources. Use Azure RBAC + PIM
66	for who can manage them. The Arc agent also enables a managed identity on the machine
67	for outbound calls to Azure services.
68
69	## Guardrails
70	- **Secure the Connected Machine agent and its outbound connectivity; scope its managed
71	identity to least p

People who liked this also viewed

6 picks

Type

azure-arc

161stars34forks

View on GitHub

How to install azure-arc?

vinayaklatthe/microsoft-security-skills/azure-arc

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-arc

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Azure Arc
2
3	Azure Arc projects on-premises, multicloud, and edge resources into Azure Resource Manager so
4	they can be governed, secured, and managed with the same control plane as Azure-native
5	resources, extending Azure Policy, Microsoft Defender for Cloud, and Azure Monitor to hybrid
6	estates.
7
8	## When to use
9	Bringing non-Azure servers, Kubernetes clusters, and data services under consistent Azure
10	governance and security. Use this skill when you need one pane of glass and policy plane
11	across hybrid / multicloud machines.
12
13	Do not use this skill for Azure-native VMs (use ARM directly), Intune-managed endpoints
14	(`intune-device-mgmt`), or Azure Stack HCI deployment.
15
16	## Pick the Arc capability by resource type
17
18	\| Resource type \| Arc service \| What you get \|
19	\|---\|---\|---\|
20	\| On-prem / AWS / GCP server \| Arc-enabled servers \| Defender for Cloud, Policy, Update Manager, Monitor, RBAC \|
21	\| Non-AKS Kubernetes (on-prem, EKS, GKE) \| Arc-enabled Kubernetes \| GitOps via Flux, Policy, Monitor, Defender for Containers \|
22	\| SQL Server on-prem / other cloud \| Arc-enabled SQL Server \| Inventory, best-practice assessment, Defender \|
23	\| PostgreSQL / SQL MI at edge \| Arc-enabled data services \| Managed PaaS-like experience at edge \|
24	\| Hybrid app platform (containerised) \| Arc-enabled App Services / Functions \| PaaS runtime on Arc-enabled K8s \|
25
26	> Rule of thumb: start with Arc-enabled servers for hybrid posture - it's the
27	> highest-value, lowest-friction step. The Connected Machine agent gives you Defender for
28	> Cloud and Azure Policy across the hybrid estate for the price of an outbound HTTPS connection.
29
30	## Approach
31
32	1. Plan the onboarding scope and identity — Decide which subscriptions / resource groups
33	own the Arc resources. Define the target resource group per region / per business unit.
34	Pre-create service principals if onboarding at scale via script.
35	*Verify: target RG exists with the `Azure Connected Machine Onboarding` role assigned to
36	the onboarding identity.*
37
38	2. Plan network and proxy requirements — Connected Machine agent needs outbound HTTPS
39	(443) to a defined list of Microsoft endpoints. If servers are behind a corporate proxy,
40	configure the agent for proxy + auth. Some endpoints require firewall allowlisting.
41	Verify: a pilot server can reach `.his.arc.azure.com`, `*.guestconfiguration.azure.com`,
42	`.dp.kubernetesconfiguration.azure.com` (for K8s); agent install completes.
43
44	3. Onboard servers at scale — Pilot 5-10 servers manually (one Windows, one Linux).
45	Then script the rollout: GPO / Ansible / Configuration Manager for Windows; cloud-init /
46	Ansible for Linux. The agent script accepts service principal + tags.
47	Verify: Arc resource appears in the target RG; `Connected` status; tags applied.
48
49	4. Govern with Azure Policy + machine configuration — Assign Azure Policy initiatives
50	(e.g. Azure Security Benchmark) at the RG / subscription scope. **Machine configuration
51	(formerly guest configuration)** audits in-OS settings on Arc machines just like Azure
52	VMs.
53	*Verify: ASB initiative shows compliance state for Arc machines; in-OS audit returns
54	results (e.g. password complexity).*
55
56	5. Extend Defender for Cloud — Enable Defender for Servers Plan 2 on the subscription
57	that contains the Arc resources. Defender deploys MDE, file integrity monitoring, and
58	adaptive controls to the Arc machines.
59	Verify: Defender for Servers shows Arc machines as protected; MDE shows them onboarded.
60
61	6. Unify monitoring + updates — Send Arc machines' logs to Log Analytics via Azure
62	Monitor Agent (extension). Use Azure Update Manager to assess and deploy updates from
63	Azure across the hybrid fleet.
64
65	7. Grant access via Azure RBAC — Arc machines are ARM resources. Use Azure RBAC + PIM
66	for who can manage them. The Arc agent also enables a managed identity on the machine
67	for outbound calls to Azure services.
68
69	## Guardrails
70	- **Secure the Connected Machine agent and its outbound connectivity; scope its managed
71	identity to least p

People who liked this also viewed

6 picks

Type