You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Azure Arc for servers allows you to manage machines which are outside of Azure.
18
-
When a non-Azure machine is connected to Azure, it becomes a **Connected Machine** and is treated as a resource in Azure. Each **Connected Machine**
19
-
has a Resource ID, is managed as part of a Resource Group inside a subscription, and benefits from standard Azure constructs such as Azure Policy and tagging.
17
+
Azure Arc for servers (preview) allows you to manage your Windows and Linux machines hosted outside of Azure on your corporate network or other cloud provider, similarly to how you manage native Azure virtual machines. When a hybrid machine is connected to Azure, it becomes a connected machine and is treated as a resource in Azure. Each connected machine has a Resource ID, is managed as part of a resource group inside a subscription, and benefits from standard Azure constructs such as Azure Policy and applying tags.
20
18
21
-
An agent package needs to be installed on each machine to connect it to Azure. The rest of this document explains the process in more detail.
19
+
To deliver this experience with your hybrid machines hosted outside of Azure, the Azure Connected Machine agent needs to be installed on each machine that you plan on connecting to Azure. This agent does not deliver any other functionality, and it doesn't replace the Azure[Log Analytics agent](../../azure-monitor/platform/log-analytics-agent.md). The Log Analytics agent for Windows and Linux is required when you want to proactively monitor the OS and workloads running on the machine, manage it using Automation runbooks or solutions like Update Management, or use other Azure services like [Azure Security Center](../../security-center/security-center-intro.md).
22
20
23
-
Machines will have a status of **Connected** or **Disconnected** based on how recently the agent has checked in. Each check-in is called a heartbeat. If a machine has not checked-in within the past 5 minutes, it will show as offline until connectivity is restored. <!-- For more information on troubleshooting agent connectivity, see [Troubleshooting Azure Arc for servers](troubleshoot/arc-for-servers.md). -->
21
+
>[!NOTE]
22
+
>This preview release is intended for evaluation purposes and we recommend you don't manage critical production machines.
Azure Arc for servers (preview) supports the following scenarios with connected machines:
28
28
29
-
### Supported Operating Systems
29
+
- Assign [Azure Policy guest configurations](../../governance/policy/concepts/guest-configuration.md) using the same experience as policy assignment for Azure virtual machines.
30
+
- Log data collected by the Log Analytics agent and stored in the Log Analytics workspace the machine is registered with now contains properties specific to the machine, such as Resource ID, which can be used to support [resource-context](../../azure-monitor/platform/design-logs-deployment.md#access-mode) log access.
30
31
31
-
In Public Preview, we support:
32
+
## Supported regions
32
33
33
-
- Windows Server 2012 R2 and newer
34
+
With Azure Arc for servers (preview), only certain regions are supported:
35
+
36
+
- WestUS2
37
+
- WestEurope
38
+
- WestAsia
39
+
40
+
## Prerequisites
41
+
42
+
### Supported operating systems
43
+
44
+
The following versions of the Windows and Linux operating system are officially supported for the Azure Connected Machine agent:
45
+
46
+
- Windows Server 2012 R2 and higher
34
47
- Ubuntu 16.04 and 18.04
35
48
36
-
The Public Preview release is designed for evaluation purposes and should not be used to manage critical production resources.
49
+
>[!NOTE]
50
+
>This preview release of the Connected Machine agent for Windows only supports Windows Server configured to use the English language.
51
+
>
37
52
38
-
## Azure Subscription and Service Limits
53
+
###Azure subscription and service limits
39
54
40
-
Please make sure you read the Azure Resource Manager limits, and plan for the number of the machines to be connected according to the guideline listed for the [subscription](../../azure-resource-manager/management/azure-subscription-service-limits.md#subscription-limits---azure-resource-manager), and for the [resource groups](../../azure-resource-manager/management/azure-subscription-service-limits.md#resource-group-limits). In particular, by default there is a limit of 800 servers per resource group.
55
+
Before configuring your machines with Azure Arc for servers (preview), you should review the Azure Resource Manager [subscription limits](../../azure-resource-manager/management/azure-subscription-service-limits.md#subscription-limits---azure-resource-manager) and [resource group limits](../../azure-resource-manager/management/azure-subscription-service-limits.md#resource-group-limits) to plan for the number of machines to be connected.
41
56
42
-
## Networking Configuration
57
+
###Networking Configuration
43
58
44
-
During installation and runtime, the agent requires connectivity to **Azure Arc service endpoints**. If outbound connectivity is blocked by Firewalls, make sure that the following URLs are not blocked by default. All connections are outbound from the agent to Azure, and are secured with **SSL**. All traffic can be routed via an **HTTPS** proxy. If you allow the IP ranges or domain names that the servers are allowed to connect to, you must allow port 443 access to the following Service Tags and DNS Names.
59
+
The Connected Machine agent for Linux and Windows communicates outbound securely to Azure Arc over TCP port 443. If the machine connects through a firewall or proxy server to communicate over the Internet, review requirements below to understand the network configuration requirements.
45
60
46
-
Service Tags:
61
+
If outbound connectivity is restricted by your firewall or proxy server, make sure the URLs listed below are not blocked. If you only allow the IP ranges or domain names required for the agent to communicate with the service, you must also allow access to the following Service Tags and URLs.
47
62
48
-
* AzureActiveDirectory
49
-
* AzureTrafficManager
63
+
Service Tags:
50
64
51
-
For a list of IP addresses for each service tag/region, see the JSON file - [Azure IP Ranges and Service Tags – Public Cloud](https://www.microsoft.com/download/details.aspx?id=56519). Microsoft publishes weekly updates containing each Azure Service and the IP ranges it uses. See [Service tags](https://docs.microsoft.com/azure/virtual-network/security-overview#service-tags), for more details.
65
+
- AzureActiveDirectory
66
+
- AzureTrafficManager
52
67
53
-
These DNS Names are provided in addition to the Service Tag IP range information because the majority of services do not currently have a Service Tag registration and, as such, the IPs are subject to change. If IP ranges are required for your firewall configuration, then the **AzureCloud** Service Tag should be used to allow access to all Azure services. Do not disable security monitoring or inspection of these URLs, but allow them as you would other internet traffic.
68
+
URLs:
54
69
55
-
|Domain Environment|Required Azure service endpoints|
70
+
|Agent resource|Description|
56
71
|---------|---------|
57
72
|management.azure.com|Azure Resource Manager|
58
73
|login.windows.net|Azure Active Directory|
@@ -61,116 +76,58 @@ These DNS Names are provided in addition to the Service Tag IP range information
Download the [Azure Connected Machine Agent package](https://aka.ms/AzureConnectedMachineAgent) from our official distribution servers the below sites must be accessible from your environment. You may choose to download the package to a file share and have the agent installed from there. In this case, the onboarding script generated from the Azure portal may need to be modified.
67
-
68
-
Windows:
79
+
For a list of IP addresses for each service tag/region, see the JSON file - [Azure IP Ranges and Service Tags – Public Cloud](https://www.microsoft.com/download/details.aspx?id=56519). Microsoft publishes weekly updates containing each Azure Service and the IP ranges it uses. For more information, review [Service tags](https://docs.microsoft.com/azure/virtual-network/security-overview#service-tags).
69
80
70
-
*`aka.ms`
71
-
*`download.microsoft.com`
81
+
The URLs in the previous table are required in addition to the Service Tag IP address range information because the majority of services do not currently have a Service Tag registration. As such, the IP addresses are subject to change. If IP address ranges are required for your firewall configuration, then the **AzureCloud** Service Tag should be used to allow access to all Azure services. Do not disable security monitoring or inspection of these URLs, allow them as you would other Internet traffic.
72
82
73
-
Linux:
83
+
### Register Azure resource providers
74
84
75
-
*`aka.ms`
76
-
*`packages.microsoft.com`
85
+
Azure Arc for servers depends on the following Azure resource providers in your subscription in order to use this service:
77
86
78
-
See the section [Proxy server configuration](quickstart-onboard-powershell.md#proxy-server-configuration), for information on how to configure the agent to use your proxy.
87
+
-**Microsoft.HybridCompute**
88
+
-**Microsoft.GuestConfiguration**
79
89
80
-
## Register the required Resource Providers
90
+
If they are not registered, you can register them using the following commands:
81
91
82
-
In order to use Azure Arc for Servers, you must register the required Resource Providers.
83
-
84
-
***Microsoft.HybridCompute**
85
-
***Microsoft.GuestConfiguration**
86
-
87
-
You can register the resource providers with the following commands:
88
-
89
-
Azure PowerShell:
92
+
Azure PowerShell:
90
93
91
94
```azurepowershell-interactive
92
95
Login-AzAccount
93
-
Set-AzContext-SubscriptionId[subscriptionyouwant to onboard]
You can also register the Resource Providers using the portal by following the steps under [Azure portal](../../azure-resource-manager/management/resource-providers-and-types.md#azure-portal).
107
-
108
-
## Machine changes after installing the agent
109
-
110
-
If you have a change tracking solution deployed in your environment, you can use the list below to track, identify, and allow the changes made by the **Azure Connected Machine Agent (AzCMAgent)** installation package.
111
-
112
-
After you install the agent you see the following changes made to your servers.
113
-
114
-
### Windows
115
-
116
-
Services installed:
117
-
118
-
*`Himds` - The **Azure Connected Machine Agent** service.
119
-
*`Dscservice` or `gcd` - The **Guest Configuration** service.
120
-
121
-
Files added to the server:
122
-
123
-
*`%ProgramFiles%\AzureConnectedMachineAgent\*.*` - Location of **Azure Connected Machine Agent** files.
After you register a node you can start managing your nodes using other Azure services.
145
-
146
-
In Public Preview, the following scenarios are supported for **Connected Machines**.
147
-
148
-
## Guest Configuration
149
-
150
-
After connect the machine to Azure, you can assign Azure policies to **Connected Machines** using the same experience as policy assignment to Azure virtual machines.
151
-
152
-
For more information, see [Understand Azure Policy's Guest Configuration](../../governance/policy/concepts/guest-configuration.md).
109
+
You can also register the resource providers in the Azure portal by following the steps under [Azure portal](../../azure-resource-manager/management/resource-providers-and-types.md#azure-portal).
153
110
154
-
The Guest Configuration Agent logs for a **Connected Machine** are in the following locations:
111
+
## Connected Machine agent
155
112
156
-
* Windows - `%ProgramFiles%\AzureConnectedMachineAgent\logs\dsc.log`
157
-
* Linux: - `/opt/logs/dsc.log`
113
+
You can download the Azure Connected Machine Agent package for Windows and Linux from the locations listed below.
158
114
159
-
## Log Analytics
115
+
-[Windows agent Windows Installer package](https://aka.ms/AzureConnectedMachineAgent) from the Microsoft Download Center.
116
+
- Linux agent package is distributed from Microsoft's [package repository](https://packages.microsoft.com/) using the preferred package format for the distribution (.RPM or .DEB).
160
117
161
-
Log data collected by the [Microsoft Monitoring Agent (MMA)](https://docs.microsoft.com/azure/azure-monitor/log-query/log-query-overview) and stored in Log Analytics workspace will now contain properties specific to the machine such as **ResourceId**, which can be used for the Resource centric log access.
118
+
>[!NOTE]
119
+
>During this preview, only one package has been released, which is suitable for Ubuntu 16.04 or 18.04.
162
120
163
-
- Machines that already have the MMA agent installed, will have **Azure Arc** functionality enabled via updated Management Packs.
164
-
-[MMA agent version 10.20.18011 or above](https://docs.microsoft.com/azure/virtual-machines/extensions/oms-windows#agent-and-vm-extension-version) is required for Azure Arc for servers integration.
165
-
- When querying for log data in [Azure Monitor](https://docs.microsoft.com/azure/azure-monitor/log-query/log-query-overview), the returned data schema will contain the Hybrid **ResourceId** in the form `/subscriptions/<SubscriptionId/resourceGroups/<ResourceGroup>/providers/Microsoft.HybridCompute/machines/<MachineName>`.
121
+
## Install and configure agent
166
122
167
-
For more information, see [Get started with Log Analytics in Azure Monitor](https://docs.microsoft.com/azure/azure-monitor/log-query/get-started-portal).
123
+
Connecting machines in your hybrid environment directly with Azure can be accomplished using different methods depending on your requirements. The following table highlights each method to determine which works best for your organization.
168
124
169
-
<!-- MMA agent version 10.20.18011 and later -->
125
+
| Method | Description |
126
+
|--------|-------------|
127
+
| Interactively | Manually install the agent on a single or small number of machines following the steps in [Connect machines from Azure portal](quickstart-onboard-portal.md).<br> From the Azure portal, you can generate a script and execute it on the machine to automate the install and configuration steps of the agent.|
128
+
| At scale | Install and configure the agent for multiple machines following the [Connect machines using a Service Principal](quickstart-onboard-powershell.md).<br> This method creates a service principal to connect machines non-interactively.|
170
129
171
-
## Next Steps
172
130
173
-
There are two methods to connect machines using Azure Arc for servers.
131
+
## Next steps
174
132
175
-
***Interactively** - Follow the [Portal Quickstart](quickstart-onboard-portal.md) to generate a script from the portal and execute it on the machine. This is the best option if you are connecting one machine at a time.
176
-
***At Scale** - Follow the [PowerShell Quickstart](quickstart-onboard-powershell.md) to create a Service Principal to connect machines non-interactively.
133
+
- To begin evaluating Azure Arc for servers, follow the article [Connect hybrid machines to Azure from the Azure portal](quickstart-onboard-portal.md).
0 commit comments