The cloud half of Defender for Identity lights up on licensing, with no workspace, no connection, and no switch. The discipline is not standing it up, it is knowing what is automatic, what you still connect, and how you confirm a surface you never had to build.
The capstone: Arc is not a replacement for the domain but the management plane that lets a server outlive its dependence on one. How to sort a fleet between the two, and where the larger shrinking-AD story goes next.
Arc is the vehicle that brings Defender for Servers onto non-Azure machines. The article turns on one decision: reach it through Arc for full capability, or through direct onboarding for visibility only.
Walk Extended Security Updates through Arc from eligibility to exit: attest coverage, provision and size the license, activate with the back bill in mind, link machines, and deactivate deliberately at program end.
Many adopt Arc for money, not management: Extended Security Updates with sharp billing edges, a closing 2012 deadline, the 2016 wave, pay-as-you-go traps, and the attestation benefit that makes management free.
Running an Arc server day to day is extensions, monitoring, and remote access. Each is good, and each has an edge: version drift, ingestion cost, and three remote-access paths that Conditional Access governs differently.
Stand up server patching: periodic assessment by policy, a maintenance configuration scoped by tag, hotpatch enrollment on Windows Server 2025, the meter and its waivers, and an end-to-end test.
WSUS is deprecated and Azure Update Manager is the server successor: workspace-free assessment, dynamic schedules, a WSUS coexistence path, an authority that moved into Azure, and now free hotpatching.
