Azure Arc Fleet

MANAGED ESTATE

PROGRAM PATH

From discovery to steady state

Gated delivery

DECISIONS

Before pilot approval

5

CONTROL MODEL

Ownership by plane

REFERENCE DESIGN

Outbound-only hybrid control

Azure Arc projects each machine into Azure Resource Manager. Workloads remain in AWS; management metadata and extension control flow outbound to Azure.

AWS ESTATE

AWS EC22,000 Windows + Linux instances

AWS accountsMulti-account, multi-region inventory

AWS Systems ManagerInventory, targeting and Run Command

OUTBOUND CONTROL PLANEHTTPS 443Direct, proxy, VPN or ExpressRoute

AZURE PUBLIC CLOUD

Azure Arc-enabled ServersMicrosoft.HybridCompute

Azure PolicyMachine Configuration

Azure MonitorAMA + DCR

Defender for CloudOptional plan

Public endpoint baseline

Fastest path for AWS. Permit documented Arc endpoints through egress controls. Traffic is outbound and TLS encrypted.

Proxy-supported
No inbound Azure connection
Automate endpoint review

Private Link option

Use VPN or ExpressRoute to an Azure VNet private endpoint. Entra ID and some dependent services still require separate routing.

DNS design is mandatory
One scope per machine
Validate extension dependencies

Design ruleDo not treat Private Link as “no internet required.” Identity, Resource Manager, and extension dependencies must be assessed independently.

WELL-ARCHITECTED ARC

Hub-and-spoke landing zone placement

Centralize shared connectivity and operations in the platform landing zone. Keep each workload's Arc resources, extensions, and data collection associations in its application landing-zone subscription.

Control-plane placement

Tenant and management-group scopePolicy initiatives, Defender for Cloud settings, RBAC guardrails, naming, tagging, and compliance are inherited by the platform and every spoke. CROSS-CUTTING

EXTERNAL ESTATE On-premises and multicloud servers Connected Machine agent initiates outbound HTTPS 443

VPN / EXPRESSROUTE

PLATFORM LANDING ZONEShared hub and managementPLATFORM TEAM

Connectivity subscriptionHub VNet and shared network services

Firewall / NVAControlled egress

VPN gatewayHybrid route

ExpressRoutePrivate circuit

Private DNSHybrid resolution

Arc Private LinkScope + endpoint

Arc gatewayPublic path option

Management subscriptionCentral operations and security data

Azure Monitor

Log Analytics workspace

Defender for Cloud

SHARED SERVICES

APPLICATION LANDING ZONESIndividual workload spokesWORKLOAD + PLATFORM

Spoke subscription AProduction workload boundary

Arc-enabled server resourcesResource group, region, tags, workload RBAC

Extensions + DCR associationsAMA, Machine Configuration, workload collection

Spoke subscription NSeparate owner, environment, or business unit

Arc-enabled server resourcesIndependent lifecycle and access boundary

Workload policy assignmentsInherit baseline; add workload-specific controls

Azure control-plane projectionThe servers stay in their source networks; these spokes contain their Azure resource representations and workload-owned management configuration.

Place in the platform landing zoneHub network, hybrid gateways, firewall or proxy, DNS resolver, Arc Private Link scope and endpoint, central workspaces, organization-wide policy and security configuration.

Place in each spokeArc machine resources, workload resource groups and RBAC, extensions, DCR associations, tags, and policy assignments specific to that workload.

Architecture basis: Azure landing zones, hub-spoke topology, and Arc-enabled Servers connectivity guidance.

PRE-FLIGHT

Readiness gates

Mark evidence complete only when it is attached to the change record. Progress is saved in this browser.

WAVE ENGINE

Controlled deployment plan

Pilot first, pause on signal degradation, and never expand a wave while the previous cohort is below threshold.

AWS target Pilot size Wave size Pause (hours)

Cohort	Machines	Cumulative	Entry gate	Exit gate

GENERATED DELIVERY KIT

Deployment artifacts

Files are rendered locally from the configuration. Secrets are referenced by environment variable or secret-store path and are never persisted here.

DAY 2

Operating model

Manage Arc as a fleet service with measurable health, controlled agent change, and explicit incident ownership.

SERVICE LEVEL INDICATORS

Recommended controls

Rollback boundaryStopping a rollout and disconnecting a newly onboarded cohort is supported. Removing extensions, policy assignments, Defender plans, or historical Azure resources requires separate approved change procedures.