Manage Windows Servers and workloads in a hybrid environment
The hybrid management stack
This domain tests whether you can pick the right Azure service for a Windows Server that is not an Azure VM. Azure Arc-enabled servers onboards machines running outside Azure by installing the Azure Connected Machine agent; extensions then add Azure Monitor Agent, Azure Update Manager support, guest configuration, and other capabilities. The agent must reach Azure endpoints over outbound HTTPS 443.
Azure Update Manager schedules patching through maintenance configurations and covers Azure VMs, Arc-enabled servers, and machines managed through Arc. Legacy Update Management in Azure Automation is retired, and the legacy Log Analytics (MMA) agent is retired in favor of Azure Monitor Agent.
Azure Automanage machine best practices applies a curated profile (backup, monitoring, update management, change tracking, and more) to Azure VMs and Arc-enabled servers. Windows Admin Center handles day-to-day server administration and can register its gateway with Azure. The MARS agent sends files, folders, and system state to a Recovery Services vault. Azure Automation hybrid runbook workers run runbooks against on-premises resources.
Traps
Arc is for machines outside Azure; do not propose it for an Azure VM. The connected machine agent installs, while extensions extend. Guest configuration assignments using user-assigned identities need the right identity and permissions. A backup policy that protects files and folders is not the same as a full server or workload backup.
Rule of thumb
If a machine is outside Azure and you need Azure management features, the first step is almost always onboarding to Azure Arc, then enabling the specific service.
Worked example: a physical server in a datacenter must be patched on a schedule visible in Azure. Install the Connected Machine agent, verify outbound connectivity, create a maintenance configuration in Azure Update Manager, and assign the machine to it.