Arc is the vehicle that brings Defender for Servers onto non-Azure machines. The article turns on one decision: reach it through Arc for full capability, or through direct onboarding for visibility only.
Walk Extended Security Updates through Arc from eligibility to exit: attest coverage, provision and size the license, activate with the back bill in mind, link machines, and deactivate deliberately at program end.
Many adopt Arc for money, not management: Extended Security Updates with sharp billing edges, a closing 2012 deadline, the 2016 wave, pay-as-you-go traps, and the attestation benefit that makes management free.
Running an Arc server day to day is extensions, monitoring, and remote access. Each is good, and each has an edge: version drift, ingestion cost, and three remote-access paths that Conditional Access governs differently.
Stand up server patching: periodic assessment by policy, a maintenance configuration scoped by tag, hotpatch enrollment on Windows Server 2025, the meter and its waivers, and an end-to-end test.
WSUS is deprecated and Azure Update Manager is the server successor: workspace-free assessment, dynamic schedules, a WSUS coexistence path, an authority that moved into Azure, and now free hotpatching.
Take a built-in baseline from audit to enforcement: make the drift-visibility decision, remediate machines already adrift, check the meter, and prove it with a deliberately broken setting.
Machine configuration is the closest thing the cloud has to a GPO. It genuinely enforces state, but it is machine-scope only, it lags, one mode costs you the drift interval, and it meters. Here is where the analogy stops.
