Azure Arc-enabled servers

Load the network IDs and add outbound access for this lab:

$v = Get-Content C:\azure-lab\vnet-saat.json | ConvertFrom-Json
$sub = az account show --query id -o tsv
$tenant = az account show --query tenantId -o tsv
az network public-ip create --resource-group rg-saat-core --name pip-saat-natgw --sku Standard --location centralindia --tags course=saatvedha-azure lesson=40 -o none
az network nat gateway create --resource-group rg-saat-core --name natgw-saat --public-ip-addresses pip-saat-natgw --idle-timeout 4 --location centralindia --tags course=saatvedha-azure lesson=40 -o none
az network vnet subnet update --ids $v.'snet-web' --nat-gateway natgw-saat -o none

1Create a throwaway “outside” server

A small Ubuntu VM in its own group, and a separate group for the Arc resource:

az group create --name rg-saat-l40 --location centralindia --tags course=saatvedha-azure lesson=40 -o none
az group create --name rg-saat-arc --location centralindia --tags course=saatvedha-azure lesson=40 -o none
az vm create --resource-group rg-saat-l40 --name arc01 --image Canonical:ubuntu-24_04-lts:server:latest --size Standard_B2ats_v2 --subnet $v.'snet-web' --public-ip-address '""' --nsg '""' --admin-username azureuser --generate-ssh-keys --tags course=saatvedha-azure lesson=40 -o none
"subscription: $sub"
"tenant: $tenant"

2Make it look like a non-Azure server

Open arc01 in the portal, Connect, Bastion, and sign in as azureuser with your SSH key. In the browser terminal, run Microsoft’s evaluation steps: stop and remove the Azure VM agent, and block the metadata service.

current_hostname=$(hostname)
sudo systemctl stop walinuxagent
sudo waagent -deprovision -force
sudo rm -rf /var/lib/waagent
sudo hostnamectl set-hostname $current_hostname
sudo ufw --force enable
sudo ufw deny out from any to 169.254.169.254
sudo ufw default allow incoming
curl -s -m 5 -H Metadata:true "http://169.254.169.254/metadata/instance?api-version=2021-02-01" || echo "IMDS blocked"

The last line should print this:

IMDS blocked

From now on, Run Command and VM extensions no longer work on arc01; it behaves like a server outside Azure. Keep the Bastion tab open.

3Install the agent and connect

Still in the Bastion terminal (use the subscription and tenant IDs printed in step 1):

wget -q https://aka.ms/azcmagent -O ~/install_linux_azcmagent.sh
sudo bash ~/install_linux_azcmagent.sh
sudo azcmagent connect --resource-group rg-saat-arc --location centralindia --subscription-id <subscription-id> --tenant-id <tenant-id> --use-device-code

The agent prints a device code. Open the link on your laptop, enter the code and sign in. After a minute it reports that the machine is connected.

Check from your laptop:

az connectedmachine show --resource-group rg-saat-arc --name arc01 --query "{name:name, status:status, os:osName, agent:agentVersion, lastSeen:lastStatusChange}" -o table

You should see something like this:

Name    Status     Os     Agent         LastSeen
------  ---------  -----  ------------  --------------------------------
arc01   Connected  linux  1.58.03104.2  2026-10-22T09:41:20.117000+00:00

4Manage it like an Azure VM

Tag it, add the Azure Monitor Agent as an Arc extension, and point it at the DCR from Lesson 32:

$arcId = az connectedmachine show --resource-group rg-saat-arc --name arc01 --query id -o tsv
az tag update --resource-id $arcId --operation Merge --tags env=lab owner=saatvedha -o none
az connectedmachine extension create --resource-group rg-saat-arc --machine-name arc01 --name AzureMonitorLinuxAgent --publisher Microsoft.Azure.Monitor --type AzureMonitorLinuxAgent --location centralindia -o none
$dcrId = "/subscriptions/$sub/resourceGroups/rg-saat-core/providers/Microsoft.Insights/dataCollectionRules/dcr-saat-basic"
Set-Content -Path C:\azure-lab\dcr-assoc.json -Value ('{"properties": {"dataCollectionRuleId": "' + $dcrId + '"}}')
az rest --method put --url "https://management.azure.com${arcId}/providers/Microsoft.Insights/dataCollectionRuleAssociations/dcra-saat-basic?api-version=2022-06-01" --body '@C:\azure-lab\dcr-assoc.json' -o none

After about 10 minutes, query law-saat in the portal:

Heartbeat
| where Computer == 'arc01'
| summarize LastSeen = max(TimeGenerated) by Computer, ComputerEnvironment, ResourceProvider

You should see something like this:

Computer  ComputerEnvironment  ResourceProvider        LastSeen
arc01     Non-Azure            Microsoft.HybridCompute 2026-10-22 09:55:10

Same workspace, same DCR, same KQL as your Azure VMs, but this machine counts as non-Azure. That’s the whole idea of Arc.

✅ Checkpoint: arc01 shows as a Connected Arc machine with tags, the Azure Monitor Agent, and heartbeats in law-saat as Non-Azure.