|
1 | 1 | Microsoft Defender for Cloud can monitor the security posture of your non-Azure computers, but first, you need to connect them to Azure. |
2 | 2 |
|
3 | | -You can connect your non-Azure computers in any of the following ways: |
| 3 | +There are several different ways you can connect your existing Windows and Linux machines to Azure Arc: |
4 | 4 |
|
5 | 5 | - Using Azure Arc enabled servers (recommended) |
6 | | - |
7 | | -- From Defender for Cloud's pages in the Azure portal (Getting started and Inventory) |
| 6 | +- Azure Arc-enabled VMware vSphere |
| 7 | +- Azure Arc-enabled System Center Virtual Machine Manager (SCVMM) |
| 8 | +- Azure Local |
8 | 9 |
|
9 | 10 | ## Add non-Azure machines with Azure Arc |
10 | 11 |
|
11 | | -Azure Arc enabled servers is the preferred way of adding your non-Azure machines to Defender for Cloud. A machine with Azure Arc enabled servers becomes an Azure resource and appears in Defender for Cloud with recommendations like your other Azure resources. In addition, Azure Arc enabled servers provides enhanced capabilities such as the option to enable guest configuration policies on the machine, deploy the Log Analytics agent as an extension, simplify deployment with other Azure services, and more. |
| 12 | +Azure Arc enabled servers is the preferred way of adding your non-Azure machines to Defender for Cloud. A machine with Azure Arc enabled servers becomes an Azure resource and appears in Defender for Cloud with recommendations like your other Azure resources. In addition, Azure Arc enabled servers provides enhanced capabilities such as the option to enable guest configuration policies on the machine, deploy the Azure Monitor agent as an extension, simplify deployment with other Azure services, and more. |
12 | 13 |
|
13 | 14 | ### What is Azure Arc enabled servers? |
14 | 15 |
|
15 | | -Azure Arc enabled servers allows you to manage your Windows and Linux machines hosted outside of Azure, on your corporate network, or other cloud providers, just like you manage native Azure virtual machines. When a hybrid machine is connected to Azure, it becomes a connected machine and is treated as a resource in Azure. Each connected machine has a Resource ID, is included in a resource group, and benefits from standard Azure constructs such as Azure Policy and applying tags. Service providers who manage a customer's on-premises infrastructure can manage their hybrid machines, just like they do today with native Azure resources, across multiple customer environments, using Azure Lighthouse with Azure Arc. |
16 | | - |
17 | | -To deliver this experience with your hybrid machines hosted outside of Azure, the Azure Connected Machine agent needs to be installed on each machine that you plan on connecting to Azure. **This agent does not deliver any other functionality, and it doesn't replace the Azure Log Analytics agent**. The Log Analytics agent for Windows and Linux is required when you want to proactively monitor the OS and workloads running on the machine. You can then manage the machines using Automation runbooks, solutions like Update Management, or use other Azure services like Defender for Cloud. |
18 | | - |
19 | | -## Add non-Azure machines from the Azure portal |
20 | | - |
21 | | -You can start the process of adding a non-Azure server from two different locations in Defender for Cloud: |
22 | | - |
23 | | -1. From Defender for Cloud's menu, open the **Getting started** page. |
24 | | -1. Select the **Get started** tab. |
25 | | -1. Below Add non-Azure servers, select **Configure**. |
26 | | -1. From Defender for Cloud's menu, open the Inventory page. |
27 | | -1. Select the **+ Add non-Azure servers** button. |
28 | | - |
29 | | -A list of your Log Analytics workspaces is shown. The list includes, if applicable, the default workspace created for you by Defender for Cloud when automatic provisioning was enabled. Select this workspace or another workspace you want to use. |
30 | | - |
31 | | -You can add computers to an existing workspace or create a new workspace. Optionally, to create a new workspace, select **Create new workspace**. |
32 | | - |
33 | | -From the list of workspaces, select **Add Servers** for the relevant workspace. The Agents management page appears. |
34 | | - |
35 | | -From here, choose the relevant procedure below depending on the type of machines you're onboarding: |
36 | | - |
37 | | -- Onboard your Azure Stack VMs |
38 | | - |
39 | | -- Onboard your Linux machines |
40 | | - |
41 | | -- Onboard your Windows machines |
42 | | - |
43 | | -### Onboard your Azure Stack VMs |
44 | | - |
45 | | -To add Azure Stack VMs, you need the information on the Agents management page and to configure the Azure Monitor, Update and Configuration Management virtual machine extension on the virtual machines running on your Azure Stack. |
46 | | - |
47 | | -1. From the Agents management page, copy the Workspace ID and Primary Key into Notepad. |
48 | | - |
49 | | -1. Log into your Azure Stack portal and open the Virtual machines page. |
50 | | - |
51 | | -1. Select the virtual machine that you want to protect with Defender for Cloud. |
52 | | - |
53 | | -1. Select Extensions. The list of virtual machine extensions installed on this virtual machine is shown. |
54 | | - |
55 | | -1. Select the **Add** tab. The New Resource menu shows the list of available virtual machine extensions. |
56 | | - |
57 | | -1. Select the Azure Monitor, Update and Configuration Management extension and select **Create**. The Install extension configuration page opens. |
58 | | - |
59 | | -1. On the Install extension configuration page, paste the Workspace ID and Workspace Key (Primary Key) that you copied into Notepad in the previous step. |
60 | | - |
61 | | -1. When you complete the configuration, select **OK**. The extension's status will show as *Provisioning Succeeded*. It might take up to one hour for the virtual machine to appear in Defender for Cloud. |
62 | | - |
63 | | -### Onboard your Linux machines |
64 | | - |
65 | | -To add Linux machines, you need the WGET command from the Agents management page. |
66 | | - |
67 | | -1. From the Agents management page, copy the WGET command into Notepad. Save this file to a location that is accessible from your Linux computer. |
68 | | - |
69 | | -1. On your Linux computer, open the file with the WGET command. Select the entire content and copy and paste it into a terminal console. |
70 | | - |
71 | | -1. When the installation completes, you can validate that the *omsagent* is installed by running the [pgrep] command. The command will return the omsagent PID. The logs for the Agent can be found at: /var/opt/microsoft/omsagent/workspace id/log/ It might take up to 30 minutes for the new Linux machine to appear in Defender for Cloud. |
72 | | - |
73 | | -### Onboard your Windows machines |
| 16 | +Azure Arc enabled servers allows you to manage your Windows and Linux machines hosted outside of Azure, on your corporate network, or other cloud providers, just like you manage native Azure virtual machines. When a hybrid machine is connected to Azure, it becomes a connected machine and is treated as a resource in Azure. Each connected machine has a Resource ID, is included in a resource group, and benefits from standard Azure constructs such as Azure Policy and applying tags. Service providers who manage a customer's on-premises infrastructure can manage their hybrid machines just like they do today with native Azure resources, across multiple customer environments, using Azure Lighthouse with Azure Arc. |
74 | 17 |
|
75 | | -To add Windows machines, you need to read the information on the Agents management page and to download the appropriate agent file (32/64-bit). |
| 18 | +To deliver this experience with your hybrid machines hosted outside of Azure, the *Azure Connected Machine agent* needs to be installed on each machine that you plan on connecting to Azure. **This agent doesn't replace the Azure Monitor Agent**. The Azure Monitor Agent for Windows and Linux is required when you want to proactively monitor the OS and workloads running on the machine. You can then manage the machines using Automation runbooks, solutions like Update Management, or use other Azure services like Defender for Cloud. |
76 | 19 |
|
77 | | -1. Select the Download Windows Agent link applicable to your computer processor type to download the setup file. |
| 20 | +## Onboard non-Azure machines with the Azure Connected Machine agent |
78 | 21 |
|
79 | | -1. From the Agents management page, copy the Workspace ID and Primary Key into Notepad. |
| 22 | +Connecting machines in your hybrid environment directly with Azure can be accomplished using different methods, depending on your requirements and the tools you prefer to use. |
80 | 23 |
|
81 | | -1. Copy the downloaded setup file to the target computer and run it. |
| 24 | +### Onboarding methods |
82 | 25 |
|
83 | | -1. Follow the installation wizard (Next, I Agree, Next, Next). |
| 26 | +The following table highlights each method so you can determine which works best for your deployment. For detailed information, follow the links to view the steps for each article. |
84 | 27 |
|
85 | | -1. On the Azure Log Analytics page, paste the Workspace ID and Workspace Key (Primary Key) that you copied into Notepad. |
| 28 | +| Method | Description | |
| 29 | +|--------|-------------| |
| 30 | +| Interactively | Manually install the agent on a single or small number of machines by [connecting machines using a deployment script](/azure/azure-arc/servers/onboard-portal). From the Azure portal, you can generate a script and execute it on the machine to automate the install and configuration steps of the agent.| |
| 31 | +| Interactively | [Connect machines from Windows Admin Center](/azure/azure-arc/servers/onboard-windows-admin-center) | |
| 32 | +| Interactively | [Connect Windows Servers machines to Azure through Azure Arc Setup](/azure/azure-arc/servers/onboard-windows-server) | |
| 33 | +| Interactively or at scale | [Connect machines using PowerShell](/azure/azure-arc/servers/onboard-powershell) | |
| 34 | +| At scale | [Connect machines using a service principal](/azure/azure-arc/servers/onboard-service-principal) to install the agent at scale non-interactively.| |
| 35 | +| At scale | [Connect machines by running PowerShell scripts with Configuration Manager](/azure/azure-arc/servers/onboard-configuration-manager-powershell) | |
| 36 | +| At scale | [Connect machines with a Configuration Manager custom task sequence](/azure/azure-arc/servers/onboard-configuration-manager-custom-task) | |
| 37 | +| At scale | [Connect Windows machines using Group Policy](/azure/azure-arc/servers/onboard-group-policy-powershell) | |
| 38 | +| At scale | [Connect machines from Automation Update Management](/azure/azure-arc/servers/onboard-update-management-machines) to create a service principal that installs and configures the agent for multiple machines managed with Azure Automation Update Management to connect machines non-interactively. | |
| 39 | +| At scale | [Install the Arc agent on VMware VMs at scale using Arc enabled VMware vSphere](/azure/azure-arc/vmware-vsphere/enable-guest-management-at-scale). Arc enabled VMware vSphere allows you to [connect your VMware vCenter server to Azure](/azure/azure-arc/vmware-vsphere/quick-start-connect-vcenter-to-arc-using-script), automatically discover your VMware VMs, and install the Arc agent on them. Requires VMware tools on VMs.| |
| 40 | +| At scale | [Install the Arc agent on SCVMM VMs at scale using Arc-enabled System Center Virtual Machine Manager](/azure/azure-arc/system-center-virtual-machine-manager/enable-guest-management-at-scale). Arc-enabled System Center Virtual Machine Manager allows you to [connect your SCVMM management server to Azure](/azure/azure-arc/system-center-virtual-machine-manager/quickstart-connect-system-center-virtual-machine-manager-to-arc), automatically discover your SCVMM VMs, and install the Arc agent on them. | |
| 41 | +| At scale | [Connect your AWS cloud through the multicloud connector enabled by Azure Arc](/azure/azure-arc/multicloud-connector/connect-to-aws) and [enable the **Arc onboarding** solution](/azure/azure-arc/multicloud-connector/onboard-multicloud-vms-arc) to autodiscover and onboard EC2 VMs. | |
86 | 42 |
|
87 | | -1. If the computer should report to a Log Analytics workspace in Azure Government cloud, select **Azure US Government** from the Azure Cloud dropdown list. |
| 43 | +> [!NOTE] |
| 44 | +> The Azure Arc Setup feature only applies to Windows Server 2022 and later. It was released in the [Cumulative Update of 10/10/2023](https://support.microsoft.com/topic/october-10-2023-kb5031364-os-build-20348-2031-7f1d69e7-c468-4566-887a-1902af791bbc). |
88 | 45 |
|
89 | | -1. If the computer needs to communicate through a proxy server to the Log Analytics service, select **Advanced** and provide the proxy server's URL and port number. |
| 46 | +## Supported cloud operations |
90 | 47 |
|
91 | | -1. When you've entered all of the configuration settings, select **Next**. |
| 48 | +With Azure Arc-enabled servers, you can perform many operational functions, just as you would with native Azure virtual machines. Below are some of the key supported actions for connected machines. |
92 | 49 |
|
93 | | -1. From the Ready to Install page, review the settings to be applied and select **Install**. |
| 50 | +* **Govern**: |
| 51 | + * Assign [Azure machine configurations](/azure/governance/machine-configuration/overview) to audit settings inside the machine. To understand the cost of using Azure Machine Configuration policies with Arc-enabled servers, see Azure Policy [pricing guide](https://azure.microsoft.com/pricing/details/azure-policy/). |
| 52 | +* **Protect**: |
| 53 | + * Protect non-Azure servers with [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint), included through [Microsoft Defender for Cloud](/azure/security-center/defender-for-servers-introduction), for threat detection, for vulnerability management, and to proactively monitor for potential security threats. Microsoft Defender for Cloud presents the alerts and remediation suggestions from the threats detected. |
| 54 | + * Use [Microsoft Sentinel](scenario-onboard-azure-sentinel.md) to collect security-related events and correlate them with other data sources. |
| 55 | +* **Configure**: |
| 56 | + * Use [Azure Automation](/azure/automation/extension-based-hybrid-runbook-worker-install?tabs=windows) for frequent and time-consuming management tasks using PowerShell and Python [runbooks](/azure/automation/automation-runbook-execution). Assess configuration changes for installed software, Microsoft services, Windows registry and files, and Linux daemons using the Azure Monitor agent for [change tracking and inventory](/azure/automation/change-tracking/overview-monitoring-agent?tabs=win-az-vm). |
| 57 | + * Use [Azure Update Manager](/azure/update-manager/overview) to manage operating system updates for your Windows and Linux servers. Automate onboarding and configuration of a set of Azure services when you use [Azure Automanage](/azure/automanage/automanage-arc). |
| 58 | + * Perform post-deployment configuration and automation tasks using supported [Arc-enabled servers VM extensions](manage-vm-extensions.md) for your non-Azure Windows or Linux machine. |
| 59 | +* **Monitor**: |
| 60 | + * Monitor operating system performance and discover application components to monitor processes and dependencies with other resources using [VM insights](/azure/azure-monitor/vm/vminsights-overview). |
| 61 | + * Collect other log data, such as performance data and events, from the operating system or workloads running on the machine with the [Azure Monitor Agent](/azure/azure-monitor/agents/azure-monitor-agent-overview). This data is stored in a [Log Analytics workspace](/azure/azure-monitor/logs/log-analytics-workspace-overview). |
94 | 62 |
|
95 | | -1. On the Configuration completed successfully page, select **Finish**. |
| 63 | +Log data collected and stored in a Log Analytics workspace from the hybrid machine contains properties specific to the machine, such as a Resource ID, to support [resource-context](/azure/azure-monitor/logs/manage-access#access-mode) log access. |
96 | 64 |
|
97 | | -When complete, the Microsoft Monitoring agent appears in Control Panel. You can review your configuration there and verify that the agent is connected. |
| 65 | +Watch this video to learn more about Azure monitoring, security, and update services across hybrid and multicloud environments. |
98 | 66 |
|
| 67 | +> [!VIDEO https://www.youtube.com/embed/mJnmXBrU1ao] |
0 commit comments