Azure Arc for servers: extending the Azure management plane to servers beyond the domain.
The operations surface in practice: install an extension, wire monitoring with the Azure Monitor Agent, run a PowerShell script on a machine from Azure, open a session with no inbound port, and set the local blocklist that lets a server refuse all of it.
The capstone: Arc is not a replacement for the domain but the management plane that lets a server outlive its dependence on one. How to sort a fleet between the two, and where the larger shrinking-AD story goes next.
Arc is the vehicle that brings Defender for Servers onto non-Azure machines. The article turns on one decision: reach it through Arc for full capability, or through direct onboarding for visibility only.
Walk Extended Security Updates through Arc from eligibility to exit: attest coverage, provision and size the license, activate with the back bill in mind, link machines, and deactivate deliberately at program end.
Many adopt Arc for money, not management: Extended Security Updates with sharp billing edges, a closing 2012 deadline, the 2016 wave, pay-as-you-go traps, and the attestation benefit that makes management free.
Running an Arc server day to day is extensions, monitoring, and remote access. Each is good, and each has an edge: version drift, ingestion cost, and three remote-access paths that Conditional Access governs differently.
Stand up server patching: periodic assessment by policy, a maintenance configuration scoped by tag, hotpatch enrollment on Windows Server 2025, the meter and its waivers, and an end-to-end test.
WSUS is deprecated and Azure Update Manager is the server successor: workspace-free assessment, dynamic schedules, a WSUS coexistence path, an authority that moved into Azure, and now free hotpatching.
