You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: learn-pr/azure/plan-deploy-azure-arc-enabled-servers/includes/3-test-azure-arc-enabled-server-capabilities.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -91,4 +91,4 @@ To install with the script, you must run the downloaded script from PowerShell i
91
91
92
92
1. Change to the folder or share where you copied the script and execute it on the server by running the `./OnboardingScript.ps1` script.
93
93
94
-
Now that you have an Azure Arc-enabled server, you can begin to test Microsoft Defender for Cloud, Azure Monitor, Azure Policies, VM Extensions, and the range of Azure Arc-enabled server capabilities.
94
+
Now that you have an Azure Arc-enabled server, you can begin to test its functionality. Including, Microsoft Defender for Cloud, Azure Monitor, Azure Policies, VM Extensions, and the range of Azure Arc-enabled server capabilities.
Copy file name to clipboardExpand all lines: learn-pr/azure/plan-deploy-azure-arc-enabled-servers/includes/4-plan-secure-configuration.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ The Azure Connected Machine Onboarding role is available for at-scale onboarding
16
16
17
17
Users with the Azure Connected Machine Resource Administrator role can read, modify, reonboard, and delete a machine. This role is designed to support management of Azure Arc-enabled servers, but not other resources in the resource group or subscription.
18
18
19
-
Additionally, the Azure Connected Machine agent uses public-key authentication to communicate with the Azure service. After you onboard a server to Azure Arc, a private key is saved to the disk and used whenever the agent communicates with Azure. If stolen, the private key can be used on another server to communicate with the service and act as if it were the original server. This includes getting access to the system-assigned identity and any resources to which that identity has access. The private key file is protected to only allow the HIMDS account access to read it. To prevent offline attacks, we strongly recommend the use of full disk encryption (for example, BitLocker, dm-crypt, etc.) on the operating system volume of your server.
19
+
Additionally, the Azure Connected Machine agent uses public-key authentication to communicate with the Azure service. After you onboard a server to Azure Arc, a private key is saved to the disk and used whenever the agent communicates with Azure. If stolen, the private key can be used on another server to communicate with the service and act as if it were the original server. A stolen private key can also get access to the system-assigned identity and any resources to which that identity has access. The private key file is protected to only allow the HIMDS account access to read it. To prevent offline attacks, we strongly recommend the use of full disk encryption (for example, BitLocker, dm-crypt, etc.) on the operating system volume of your server.
20
20
21
21
## Azure Policy Governance
22
22
@@ -38,7 +38,7 @@ Regulatory Compliance in Azure Policy provides Microsoft created and managed ini
38
38
- NIST SP 800-53 Rev. 5
39
39
- UK OFFICIAL and UK NHS
40
40
41
-
Before deploying Azure Arc-enabled servers to a resource group, you can systemically define and assign Azure Policies with their respective remediation tasks at the resource group, subscription, or management group level, to ensure that auditing and compliance guardrails are in place.
41
+
Before deploying Azure Arc-enabled servers to a resource group, you can systemically define and assign Azure Policies with their respective remediation tasks at the resource group, subscription, or management group level. By configuring your Azure Policies up front, you ensure that auditing and compliance guardrails are in place.
Copy file name to clipboardExpand all lines: learn-pr/azure/plan-deploy-azure-arc-enabled-servers/includes/5-explore-methods-onboard-servers.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,7 +21,7 @@ For at-scale deployment of Arc-enabled servers, you can use a privileged identit
21
21
22
22
| Method | Description |
23
23
|---|---|
24
-
|**Connect Multiple Machines with Service Principal**| To securely connect machines to Azure Arc at scale, you can use a Microsoft Entra service principal instead of using your privileged identity to interactively connect the machine. A service principal is a special limited-management identity that's granted only the minimum permission necessary to connect machines to Azure using the `azcmagent` command. This approach is safer than using a higher privilege and follows our access control security best practices. The service principal is used only during onboarding. It isn't used for any other purpose. |
24
+
|**Connect Multiple Machines with Service Principal**| To securely connect machines to Azure Arc at scale, you can use a Microsoft Entra service principal instead of using your privileged identity to interactively connect the machine. A special limited-management identity, a service principal is only granted the minimum permission necessary to connect machines to Azure using the `azcmagent` command. This approach is safer than using a higher privilege and follows our access control security best practices. The service principal is used only during onboarding. It isn't used for any other purpose. |
25
25
|**Update Management (Azure portal)**| You can easily connect non-Azure servers managed by the Update Management service to Azure via Azure Arc. You can select these non-Azure servers directly in the Azure portal, and the deployment happens automatically. |
26
26
27
27
You can use a range of existing software configuration products to deploy the Arc-enabled server agent to machines at scale. The script for deployment should rely on the Azure Service Principal method, because the single server script for deployment requires separate authentication for each server.
Copy file name to clipboardExpand all lines: learn-pr/azure/plan-deploy-azure-arc-enabled-servers/includes/6-best-practices-server-management.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ Arc-enabled servers can be monitored through Azure Monitor or Log Analytics. Eva
10
10
11
11
## Ensure Arc-enabled Server Connectivity
12
12
13
-
Create a Resource Health alert to alert when an Arc-enabled Server is no longer connected. If a server stops sending heartbeats to Azure for longer than 15 minutes, it can mean that it's offline, the network connection has been blocked, or the agent isn't running. Develop a plan for how you'll respond and investigate these incidents and use Resource Health alerts to get notified when they start. Specify the following settings when configuring the alert:
13
+
Create a Resource Health alert to alert when an Arc-enabled Server is no longer connected. If a server stops sending heartbeats to Azure for longer than 15 minutes, it might be offline, the network connection could be blocked, or the agent isn't running. You should develop a plan for how to respond and investigate these incidents and use Resource Health alerts to be notified when they start. Specify the following settings when configuring the alert:
14
14
15
15
-**Resource type = Azure Arc-enabled servers**
16
16
@@ -28,10 +28,10 @@ For the best experience and most recent security and bug fixes, we recommend kee
28
28
29
29
## Beginning using Azure services
30
30
31
-
As a foundation for managing Azure Arc-enabled servers, we recommend organizing machines with tags, connecting to Log Analytics workspaces, and assigning Azure Policies. With the right observability and governance in place, you'll be able to more easily use other Azure services like Microsoft Defender for Cloud, Microsoft Sentinel, and Azure Automanage.
31
+
As a foundation for managing Azure Arc-enabled servers, we recommend organizing machines with tags, connecting to Log Analytics workspaces, and assigning Azure Policies. With the right observability and governance in place, you're able to more easily use other Azure services like Microsoft Defender for Cloud, Microsoft Sentinel, and Azure Automanage.
32
32
33
33
| Recommendation | Description |
34
34
|---|---|
35
35
| Apply tags to help organize machines | Evaluate and develop an IT-aligned tagging strategy that can help reduce the complexity of managing your Azure Arc-enabled servers and simplify making management decisions. |
36
36
| Design and deploy Azure Monitor Logs | Evaluate design and deployment considerations to determine if your organization should use an existing or implement another Log Analytics workspace to store collected log data from hybrid servers and machines. |
37
-
| Develop an Azure Policy governance plan | Determine how you'll implement governance of hybrid servers and machines at the subscription or resource group scope with Azure Policy. |
37
+
| Develop an Azure Policy governance plan | Determine how you want to implement governance of hybrid servers and machines at the subscription or resource group scope with Azure Policy. |
Copy file name to clipboardExpand all lines: learn-pr/azure/plan-deploy-azure-arc-enabled-servers/includes/8-summary.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,8 +1,8 @@
1
-
Over the course of this module, you've explored the planning and deployment of Azure Arc-enabled servers at scale for customers like Wide World Importers. You understood how Azure Arc-enabled servers delivers Azure services such as Microsoft Defender for Cloud, Azure Policy, Azure Monitor, and VM extensions to servers across on-premises, multicloud, and edge environments through the Connected Machine Agent.
1
+
Over the course of this module, you explored the planning and deployment of Azure Arc-enabled servers at scale for customers like Wide World Importers. You understood how Azure Arc-enabled servers delivers Azure services. Such as, Microsoft Defender for Cloud, Azure Policy, Azure Monitor, and virtual machine (VM) extensions to servers across on-premises, multicloud, and edge environments through the Connected Machine Agent.
2
2
3
-
First, you explored how to easily simulate an Azure Arc-enabled server using an Azure VM. Next, you learned about the built-in and added security considerations around planning a large deployment. You also learned about the range of different deployment methods that Azure Arc-enabled servers supports. Finally, you learned about best practices with deploying Azure Arc-enabled servers.
3
+
First, you explored how to easily simulate an Azure Arc-enabled server using an Azure VM. Next, you learned about the built-in and added security considerations around planning a large deployment. You also learned about the range of different deployment methods supported by Azure Arc-enabled servers. Finally, you learned about best practices with deploying Azure Arc-enabled servers.
4
4
5
-
Wide World Importers' compute infrastructure is complex, global, and hybrid. Azure Arc-enabled servers offers a powerful way to streamline security, governance, and visibility across your firm's entire digital estate. While deploying at-scale across your enterprise can be daunting, Azure Arc-enabled servers offers the testing, security, and support guidance to help you realize Azure capabilities more easily.
5
+
The compute infrastructure of Wide World Importersis complex, global, and hybrid. Your testing and research found that using Azure Arc-enabled servers is a powerful way to streamline security, governance, and visibility across your firm's entire digital estate. While deploying at-scale across your enterprise can be daunting, Azure Arc-enabled servers offers the testing, security, and support guidance to help you realize Azure capabilities more easily.
0 commit comments