Edit

Share via

Virtual machine extension management with Azure Arc-enabled servers

Virtual machine (VM) extensions are small applications that provide post-deployment configuration and automation tasks on Azure VMs.

For example, VM extensions can be used to enable functionality such as:

  • Collect log data for analysis with Azure Monitor Logs by enabling the Azure Monitor agent VM extension.

  • With VM insights, analyze the performance of your Windows and Linux VMs, and monitor their processes and dependencies on other resources and external processes. You achieve these capabilities by enabling both the Azure Monitor agent and the Dependency agent VM extensions.

  • Download and run scripts on hybrid connected machines by using the Custom Script extension. This extension is useful for post-deployment configuration, software installation, or any other configuration or management tasks.

  • Automatically refresh certificates stored in Azure Key Vault.

With Azure Arc-enabled servers, you can deploy, remove, and update Azure VM extensions to non-Azure Windows and Linux VMs. This ability simplifies the management of your hybrid machines through their life cycle. You can deploy VM extensions to hybrid machines managed by Azure Arc-enabled servers via the following methods:

Many VM extensions can be configured for automatic upgrades.

Availability

VM extension functionality is available only in the supported regions. Be sure to onboard your machine in one of these regions.

For the regional availabilities of Azure services and VM extensions that are available for Azure Arc-enabled servers, refer to the Azure Global Product Availability Roadmap.

You can configure lists of the extensions that you want to allow and block on servers. For more information, see Extensions security for Azure Arc-enabled servers.

Extensions

Many VM extensions are supported with Azure Arc-enabled servers. While the lists shown here are not exhaustive, they include some of the most popular extensions that you can use with Azure Arc-enabled servers.

Windows extensions

The following table lists some of the key VM extensions that are available for Azure Arc-enabled servers running Windows. For more information about usage and support, see the "additional information" links.

Extension Publisher Type Additional information Supported OS
Microsoft Antimalware extension Microsoft.Azure.Security IaaSAntimalware Microsoft Antimalware extension for Windows Supported OS link
Custom Script extension Microsoft.Compute CustomScriptExtension Windows Custom Script Extension Supported OS link
Azure Monitor agent Microsoft.Azure.Monitor AzureMonitorWindowsAgent Deployment options for Azure Monitor agent on Azure Arc-enabled servers Supported OS link
Azure Monitor Dependency agent Microsoft.Azure.Monitoring.DependencyAgent DependencyAgentWindows Dependency agent virtual machine extension for Windows Supported OS link
Azure Key Vault extension for Windows Microsoft.Azure.Key.Vault KeyVaultForWindows Key Vault virtual machine extension for Windows Supported OS link
Microsoft Defender for Endpoint Microsoft.Azure.AzureDefenderForServers MDE.Windows Enable Defender for Endpoint integration Supported OS link
Azure Automation Hybrid Runbook Worker extension Microsoft.Compute HybridWorkerForWindows Deploy an extension-based user Hybrid Runbook Worker (to execute runbooks locally) Supported OS link
Windows Admin Center Microsoft.AdminCenter AdminCenter Manage Azure Arc-enabled servers by using Windows Admin Center in Azure Supported OS link
Windows OS Update Extension Microsoft.SoftwareUpdateManagement WindowsOsUpdateExtension Overview of Azure Update Manager Supported OS link
Windows Patch extension Microsoft.CPlat.Core WindowsPatchExtension Automatic guest patching for Azure virtual machines and scale sets Supported OS link
Network Watcher agent Microsoft.Azure.NetworkWatcher NetworkWatcherAgentWindows Manage Network Watcher Agent virtual machine extension for Windows Supported OS link
Boot Integrity Monitoring - Guest Attestation Microsoft.Azure.Security.WindowsAttestation GuestAttestation Boot integrity monitoring overview Supported OS link
Open SSH for Windows Microsoft.Azure.OpenSSH WindowsOpenSSH Connect using Secure Shell (SSH) and sign on to a VM running Windows Supported OS link
Azure Site Recovery Microsoft.SiteRecovery.Dra Windows Configure Azure Site Recovery for Arc-enabled Windows servers Supported OS link
Azure Extension for SQL Server Microsoft.AzureData WindowsAgent.SqlServer Connect your SQL Server to Azure Arc (installs the extension automatically) Supported OS link
Defender for SQL Servers Advanced Threat Protection Microsoft.Azure.AzureDefenderForSQL AdvancedThreatProtection.Windows Enable Defender for SQL Servers on Machines Supported OS link
SQL Server Backup Microsoft.Azure.RecoveryServices.WorkloadBackup AzureBackupWindowsWorkload About SQL Server Backup in Azure VMs Supported OS link
Microsoft Entra login extension Microsoft.Azure.ActiveDirectory AADSSHLoginForWindows Sign in to a Windows virtual machine in Azure by using Microsoft Entra ID Supported OS link

Linux extensions

The following table lists some of the key VM extensions that are available for Azure Arc-enabled servers running Linux. For more information about usage and support, see the "additional information" links.

Extension Publisher Type Additional information Supported OS
Custom Script extension Microsoft.Azure.Extensions CustomScript Linux Custom Script Extension version 2 Supported OS link
Azure Monitor agent Microsoft.Azure.Monitor AzureMonitorLinuxAgent Deployment options for Azure Monitor agent on Azure Arc-enabled servers Supported OS link
Azure Monitor for VMs (insights) Microsoft.Azure.Monitoring.DependencyAgent DependencyAgentLinux Dependency agent virtual machine extension for Linux Supported OS link
Azure Key Vault extension for Linux Microsoft.Azure.Key.Vault KeyVaultForLinux Key Vault virtual machine extension for Linux Supported OS link
Microsoft Defender for Endpoint Microsoft.Azure.AzureDefenderForServers MDE.Linux Enable Defender for Endpoint integration Supported OS link
Azure Automation Hybrid Runbook Worker extension Microsoft.Compute HybridWorkerForLinux Deploy an extension-based user Hybrid Runbook Worker (to execute runbooks locally) Supported OS link
Linux OS Update Extension Microsoft.SoftwareUpdateManagement LinuxOsUpdateExtension Overview of Azure Update Manager Supported OS link
Linux Patch Extension Microsoft.CPlat.Core LinuxPatchExtension Automatic guest patching for Azure virtual machines and scale sets Supported OS link
Network Watcher agent Microsoft.Azure.NetworkWatcher NetworkWatcherAgentLinux Manage Network Watcher Agent virtual machine extension for Linux Supported OS link
Boot Integrity Monitoring - Guest Attestation Microsoft.Azure.Security.LinuxAttestation GuestAttestation Boot integrity monitoring overview Supported OS link
Microsoft Entra login extension Microsoft.Azure.ActiveDirectory AADSSHLoginForLinux SSH access to Azure Arc-enabled servers Supported OS link
Azure Extension for SQL Server Microsoft.AzureData LinuxAgent.SqlServer Connect your SQL Server to Azure Arc (installs the extension automatically) Supported OS link

Extensions from partner publishers

Several extensions from partner publishers are supported on Azure Arc-enabled servers. The extensions listed here are available for both Windows and Linux.

Extension Publisher Type Additional information Supported OS
Datadog Agent Datadog.Agent DatadogWindowsAgent
DatadogLinuxAgent		 Introducing Azure monitoring with one-click Datadog deployment Supported OS link
Dynatrace OneAgent Dynatrace.Ruxit OneAgentWindows
OneAgentLinux		 What is Azure Native Dynatrace Service? Supported OS link
New Relic NewRelic.Infrastructure.Extensions newrelic-infra-windows
newrelic-infra		 What is Azure Native New Relic Service? Supported OS link

Note

The Desired State Configuration VM extension is no longer available for Azure Arc-enabled servers. We recommend that you migrate to machine configuration or use the Custom Script Extension to manage the post-deployment configuration of your server.

Extension deployment prerequisites

Review the documentation for each VM extension referenced in the previous tables to understand its network and system requirements beyond the general prerequisites and networking requirements for Arc-enabled servers. This effort can help prevent connectivity issues with an Azure service or feature that relies on that VM extension.

To deploy an extension to Azure Arc-enabled servers, a user needs the following permissions:

  • microsoft.hybridcompute/machines/read
  • microsoft.hybridcompute/machines/extensions/read
  • microsoft.hybridcompute/machines/extensions/write

The role Azure Connected Machine Resource Administrator includes the permissions required to deploy extensions. It also includes permission to delete Azure Arc-enabled server resources.

Azure Arc-enabled servers with one or more VM extensions installed can be moved between resource groups, or to another Azure subscription, without experiencing any impact to their configuration. The source and destination scopes must exist within the same Microsoft Entra tenant. For more information about moving resources and considerations before you proceed, see Move resources to a new resource group or subscription.

Related content

  • Last updated on