Skip to main content
Microsoft Solutions Partner — Hybrid & Multicloud · 11,000+ engagements

Azure Arc Hybrid + Multicloud Enterprise Guide (2026)

One Azure governance plane projected onto every server, Kubernetes cluster, SQL Server instance, and managed data service — wherever the workload runs. Designed and operated by a senior-architect-led Microsoft Solutions Partner founded in 1997.

Book an Azure Arc briefingCall 888-381-9725
What is Azure Arc and how do enterprises use it across hybrid and multicloud? Azure Arc is the Microsoft management plane that projects on-premises, AWS, GCP, and edge resources into Azure Resource Manager as first-class objects — servers, Kubernetes clusters, SQL Server instances, and managed data services. Enterprises use Arc to apply one set of Azure Policy initiatives, one Microsoft Defender for Cloud security plane, one tag taxonomy, and one Resource Graph reporting surface across an estate that spans many clouds and data centers. EPC Group deploys Arc through a five-phase Assess, Onboard, Govern, Operate, Extend accelerator that produces a unified governance plane in eight to sixteen weeks, fixed-fee.

Azure Arc projects on-prem, AWS, GCP, and edge resources into Azure as first-class objects. Five resource classes are supported — Servers, Kubernetes, SQL Server, Data Services, and App Services. Arc projection is free; Microsoft monetizes through Defender, Policy add-ons, Log Analytics, and managed-service consumption. EPC Group delivers full Arc activation in a fixed-fee five-phase accelerator between $150K and $500K.

Key Facts

  • Five Arc resource classes: Servers, Kubernetes, SQL Server, Arc-enabled Data Services, and Arc-enabled App Services
  • Arc projection itself is free; monetization is through Defender plans, Log Analytics, Machine Configuration, and managed-service vCores
  • Arc-enabled Kubernetes supports EKS, GKE, OpenShift, AKS, Rancher, Tanzu, K3s, and AKS Edge Essentials
  • Defender for Servers Plan 2 on AWS EC2 or GCP Compute requires the Arc agent — multi-cloud workload protection only works through Arc
  • Azure Arc-enabled SQL Server enables pay-as-you-go SQL license mobility — converting SA-bound licenses into Azure consumption
  • Azure Stack HCI and AKS Edge Essentials are Arc-enabled by design for retail, manufacturing, and defense edge deployments
  • EPC Group five-phase Arc Accelerator delivers full activation in 8 to 16 weeks, fixed-fee $150K to $500K
  • Microsoft Solutions Partner founded in 1997, 70+ Fortune 500 clients, 216+ M&A tenant consolidations

What Azure Arc projects — five resource classes

Azure Arc is one control plane that exposes five distinct resource classes. Each projects a different kind of workload — physical or virtual server, Kubernetes cluster, SQL Server instance, Arc-managed database, or Arc-managed PaaS service — into Azure Resource Manager as a first-class Azure object subject to Policy, RBAC, and Defender.

Azure Arc-enabled Servers

Projects: Windows and Linux servers running anywhere — on-premises VMware, Hyper-V, bare metal, AWS EC2, GCP Compute Engine, Oracle Cloud, edge appliances, and disconnected sites — projected into Azure as first-class Microsoft.HybridCompute/machines resources.

  • Azure Policy evaluation and remediation on every Arc machine, identical surface to native Azure VMs
  • Azure Monitor agent ingestion into Log Analytics for unified telemetry across on-prem, AWS, and GCP servers
  • Microsoft Defender for Servers Plan 1 and Plan 2 protection — EDR, FIM, just-in-time access, vulnerability assessment
  • Update Manager for OS patching from the Azure portal — Windows, Linux, monthly maintenance windows
  • Azure Automation runbooks, Change Tracking and Inventory, and Machine Configuration (DSC v3) guest config
  • Tag-based RBAC delegation so a cloud-ops team can govern AWS and on-prem servers without an AWS or vSphere account

Pricing: Arc connection is free. Per-machine fees apply only to add-ons enabled: Defender for Servers (~$15/server/month Plan 2), Update Manager (free for Arc, license-aligned for Azure VMs), Log Analytics ingestion (per-GB), Machine Configuration (per-node-month).

Related reading

Related EPC Group Services

Azure Arc-enabled Kubernetes

Projects: Any CNCF-conformant Kubernetes cluster — Amazon EKS, Google GKE, Red Hat OpenShift, Rancher, Tanzu, AKS on Azure Stack HCI, AKS Edge Essentials, kubeadm, K3s, MicroK8s — registered into Azure Resource Manager as Microsoft.Kubernetes/connectedClusters.

  • GitOps with Flux v2 — declarative app and platform delivery to every cluster from a single Git source of truth
  • Azure Policy for Kubernetes (Gatekeeper-based) — pod security, image allow-listing, network policy enforcement at scale
  • Microsoft Defender for Containers — runtime threat detection, registry scanning, Kubernetes posture management across clouds
  • Open Service Mesh, Dapr, Azure App Configuration, and Key Vault extensions installed and managed as Arc resources
  • Azure Monitor Container Insights with Prometheus and Grafana managed service integration across EKS, GKE, and on-prem
  • Cluster Connect zero-touch kubectl access through Azure RBAC — no inbound firewall rules, no jump boxes, no VPNs

Pricing: Arc Kubernetes connection is free for the cluster itself. Per-vCore pricing applies to enabled add-ons: Defender for Containers, Azure Monitor Container Insights, Azure App Services on Arc, and Machine Learning on Arc.

Related reading

Related EPC Group Services

Azure Arc-enabled SQL Server

Projects: SQL Server 2012 through 2025 instances running on Windows or Linux, on-premises, in AWS RDS Custom or EC2, on GCP Compute, or on edge appliances — registered as Microsoft.AzureArcData/sqlServerInstances resources with per-instance and per-database visibility.

  • Microsoft Defender for SQL — SQL injection detection, anomalous query, vulnerability assessment across hybrid SQL estate
  • Best-practice assessments delivered to the Azure portal — performance, security, and reliability findings per instance
  • License mobility — pay-as-you-go SQL Server Standard or Enterprise billed through Azure consumption, no upfront SA
  • Backup to Azure Blob, Microsoft Purview lineage and classification, and Azure Monitor SQL Insights
  • Migration assessment for the eventual move to Azure SQL Managed Instance, Azure SQL Database, or SQL on Azure VMs

Pricing: Free Arc enrollment with optional Defender for SQL (~$15/server/month), best-practice assessment (free), and PAYG SQL Server license consumption when the customer chooses that monetization path.

Related reading

Related EPC Group Services

Azure Arc-enabled Data Services

Projects: Azure SQL Managed Instance and PostgreSQL Hyperscale (Citus) deployed as Kubernetes operators on any Arc-enabled cluster — bringing managed Azure database services to on-prem, AWS, GCP, and disconnected edge data centers.

  • Azure SQL Managed Instance running on-prem or in AWS with the same engine, same surface, and same SLA as Azure-hosted
  • PostgreSQL Hyperscale (Citus) for distributed Postgres at the edge or in regulated on-prem data centers
  • Direct-connect (Azure-managed) or indirect-connect (customer-managed) modes for fully disconnected operation
  • Automatic upgrades, automated backups to local or Azure storage, point-in-time restore — managed-service operations on customer hardware
  • Built-in HA via Kubernetes operators, integrated with Azure Monitor and Azure Resource Graph

Pricing: vCore-based consumption billed through Azure. General Purpose and Business Critical tiers mirror Azure SQL Managed Instance pricing. Indirect-connect billing reconciles when the customer next connects to Azure.

Related reading

Related EPC Group Services

Azure Arc-enabled App Services

Projects: Azure App Service, Functions, Logic Apps Standard, Event Grid, and API Management Self-Hosted Gateway projected onto any Arc-enabled Kubernetes cluster — moving PaaS into the customer data center, AWS region, or GCP project.

  • Web Apps, Functions, and Logic Apps running on customer Kubernetes with the Azure portal and DevOps surface
  • API Management self-hosted gateway for hybrid API publishing and policy enforcement at the edge
  • Event Grid on Kubernetes for event routing in disconnected or air-gapped environments
  • Identical CI/CD, monitoring, and governance experience as native Azure App Service workloads
  • Use case fit for data residency, latency, and regulatory boundary requirements that prevent moving the workload to an Azure region

Pricing: Per-vCore pricing for the App Service Kubernetes environment. Workload images, ingress, and storage run on customer infrastructure with no Azure consumption beyond the Arc-projection fee.

Related reading

Related EPC Group Services

Six Azure Arc enterprise use cases

Every Arc engagement composes from one or more of these use cases. EPC Group sequences the rollout against the business and regulatory priority list, not against the alphabetical Arc resource catalog.

Use case 1 — On-prem governance with the Azure control plane

A regulated enterprise with twelve thousand on-premises Windows and Linux servers across three colocation facilities and two data centers needs a single governance surface for patching, configuration drift, vulnerability posture, and security telemetry. Azure Arc-enabled Servers enrolls every machine, Azure Policy enforces tag taxonomy, antivirus baseline, and configuration baselines, Update Manager schedules monthly maintenance windows by environment, and Defender for Servers Plan 2 delivers EDR plus file integrity monitoring. The customer keeps every workload in-place — no migration — and gains the same governance plane they already use for native Azure VMs. The Active Directory team owns the OS, the cloud team owns the Arc plane, and audit evidence flows automatically into Azure Resource Graph queries the SOC and the compliance team both consume.

Use case 2 — Multi-cloud Kubernetes operations from one portal

A platform engineering team runs eighteen Kubernetes clusters spread across Amazon EKS, Google GKE, Red Hat OpenShift on VMware, and Azure Kubernetes Service. Without Arc, each cluster has its own kubectl context, its own RBAC, its own observability stack, and its own CI/CD pipeline. With Arc-enabled Kubernetes plus Flux GitOps, every cluster declares its applications from a single Git repository, Azure Policy for Kubernetes enforces pod security standards uniformly, Defender for Containers detects runtime threats across all eighteen clusters, and Azure Monitor Container Insights provides unified Prometheus telemetry. Cluster Connect gives platform engineers RBAC-scoped kubectl access through the Azure portal without opening inbound firewall rules to EKS or GKE — a control-plane consolidation worth tens of full-time-equivalent hours per quarter.

Use case 3 — Edge and disconnected operations

A defense logistics provider operates Azure Stack HCI clusters at forward operating bases, ships, and mobile command posts that may go disconnected from the internet for days at a time. Azure Arc-enabled Data Services running indirect-connect mode delivers Azure SQL Managed Instance and PostgreSQL Hyperscale on local Kubernetes, with automatic backups to local storage, point-in-time restore, and engine parity with the cloud-hosted version. When connectivity returns, telemetry, billing, and policy state reconcile with Azure. The same Arc-enabled Kubernetes plane runs Arc-enabled App Services for the workforce applications. The operator gets cloud-grade managed services in environments where cloud connectivity cannot be assumed.

Use case 4 — AWS and GCP server compliance under Azure governance

An enterprise that picked AWS as its strategic cloud six years ago is now under board pressure to standardize security governance across the entire estate, including its AWS EC2 fleet of four thousand instances and a smaller GCP Compute Engine footprint. Rather than building a parallel CSPM and EDR stack on each cloud, the customer Arc-enrolls every AWS and GCP server, applies Azure Policy and Microsoft Defender for Servers, and pulls telemetry into a single Log Analytics workspace. Defender for Cloud multi-cloud connectors layer Foundational CSPM at no charge across AWS accounts and GCP projects. The Azure control plane becomes the system of record for security posture; the workloads stay where the business put them.

Use case 5 — SQL Server license mobility with PAYG billing

A manufacturer running two hundred SQL Server instances on Windows Server in VMware cannot justify three more years of Software Assurance and does not want to migrate to Azure SQL Managed Instance. With Azure Arc-enabled SQL Server in pay-as-you-go billing mode, the customer converts the entire SQL estate from upfront Enterprise Edition + SA to Azure consumption-based billing — paying only for the cores actually running, with monthly cost visibility in the Azure portal. The same Arc plane enables Defender for SQL anomalous-query detection, best-practice assessments, and Purview classification. The workload stays on existing infrastructure, the financial model converts to OpEx, and the cloud-ops team gets the same governance surface they use for Azure SQL.

Use case 6 — Disaster recovery and business continuity orchestration

A healthcare delivery organization with a HIPAA-bound EHR estate runs primary workloads on VMware in two on-prem data centers and uses Azure as a tertiary disaster recovery target. Azure Arc-enabled Servers and SQL deliver continuous configuration evidence to the Azure portal, Azure Site Recovery orchestrates failover for the Windows VMs, and Arc-enabled Data Services makes the SQL fallback environment a managed Azure SQL Managed Instance — not a brittle scripted restore. Defender for Servers and Defender for SQL run in both environments simultaneously, so the SOC has one view of the active and the DR estate. The compliance team gets Resource Graph queries that prove every server is patched, every database is backed up, and every Arc machine has Defender enabled — without needing access to vSphere or to local SQL Server consoles.

Arc + Defender for Cloud

How Microsoft Defender for Cloud rides on top of the Arc plane

Multi-cloud workload protection — Defender for Servers Plan 2 on AWS EC2, Defender for Containers across EKS and GKE, Defender for SQL on customer infrastructure — only works because Arc projects those resources into Azure Resource Manager. The Arc agent is the anchor that turns Defender from a Microsoft-cloud product into a true multi-cloud security platform. See the Microsoft Defender XDR enterprise guide for the unified XDR story.

Defender for Servers anywhere

Plan 2 delivers Defender for Endpoint integration, file integrity monitoring, just-in-time access, and vulnerability assessment on every Arc-enrolled Windows or Linux machine — on-prem, AWS EC2, GCP Compute, edge — identical surface to native Azure VMs.

Defender for Containers

Runtime threat detection, registry image scanning, and Kubernetes posture management across Arc-enabled EKS, GKE, OpenShift, and on-prem clusters, with one consistent policy library applied through Azure Policy for Kubernetes.

Defender for SQL

Anomalous query detection, SQL injection detection, and vulnerability assessment for every Arc-enabled SQL Server instance, including on-prem SQL on Windows or Linux and SQL on AWS RDS Custom and EC2.

Governance plane

Governance — Azure Policy applied uniformly to Arc resources

Azure Policy is the governance engine that makes Arc strategically valuable. Every policy initiative the customer applies to native Azure subscriptions — HIPAA, ISO 27001, NIST CSF 2.0, FedRAMP Moderate, CMMC 2.0 — applies identically to Arc-enrolled servers, Kubernetes clusters, and SQL instances. Auto-remediation closes drift on configurable controls, audit-only mode captures evidence for the controls that cannot be enforced through configuration, and exception workflows route through one Azure-native approval surface rather than five disconnected ticketing systems.

Initiative-driven

Compliance initiatives — HIPAA HITRUST, NIST 800-53 R5, FedRAMP, PCI DSS, ISO 27001 — apply at management-group scope and inherit down to every Arc resource.

Auto-remediation

Deploy-If-Not-Exists effects install missing agents, enforce TLS configuration, and apply guest configuration on Arc machines without analyst touch.

Resource Graph reporting

Azure Resource Graph queries return compliance state across the entire Arc estate in seconds — the SOC, compliance team, and auditors share one query surface.

Standards alignment

Our standards alignment library publishes the full HIPAA, FedRAMP, FINRA, CMMC, and GxP mappings the EPC Group Arc Accelerator ships with.

HIPAA
SOC 2
FedRAMP
FINRA
CMMC
GxP
Cost model

What Azure Arc actually costs — the projection is free, the extensions are priced

Arc itself is free. Microsoft monetizes the Arc platform through the consumption of Azure-native services that ride on top of the projection — Defender, Log Analytics, Machine Configuration, Arc-enabled Data Services, and Arc-enabled App Services. The financial model is per-resource and per-GB, with deep enterprise discounts available through Microsoft Customer Agreement and Enterprise Agreement vehicles. Most customers land between $25 and $60 per Arc resource per month fully loaded — far below the per-machine cost of running parallel CSPM, EDR, and SIEM agents from third-party vendors.

Arc projection

Free for every resource class — Servers, Kubernetes, SQL Server, Data Services identification, App Services environment registration. No per-resource Arc fee.

Defender for Cloud add-ons

Per-resource pricing: Defender for Servers Plan 2 (~$15/server/month), Defender for SQL (~$15/instance/month), Defender for Containers (per-vCore). Foundational CSPM is free across Azure, AWS, GCP, and Arc resources.

Operations add-ons

Log Analytics per-GB ingestion, Update Manager free for Arc, Machine Configuration per-node-month, Automation per-job and per-runbook-minute, Azure Monitor managed Prometheus and Grafana per-sample and per-user.

Arc-managed services

Arc-enabled SQL Managed Instance, PostgreSQL Hyperscale, App Services, and Functions billed per vCore-hour against the Kubernetes node pool running them. Mirrors native Azure managed-service pricing.

The EPC Group Azure Arc Accelerator — five phases, fixed fee

The accelerator anchors on The EPC Group Lifecycle — Assess, Onboard, Govern, Operate, Extend. Fixed-scope between $150,000 and $500,000 depending on resource count, multi-cloud breadth, regulatory scope, and managed-service tail. Senior-architect led, no offshore handoff.

Phase 1 — Assess

Hybrid and multicloud inventory in three weeks

Phase one is a fixed-fee assessment that inventories every Windows and Linux server, every Kubernetes cluster, every SQL Server instance, and every multi-cloud account the enterprise runs. EPC Group ships an Arc target list grouped by environment, a costed activation roadmap, and a board-ready governance plane design.

  • Server discovery across VMware, Hyper-V, bare metal, AWS EC2, GCP Compute, and Oracle Cloud
  • Kubernetes cluster inventory across EKS, GKE, OpenShift, AKS, Rancher, Tanzu, and edge K3s
  • SQL Server estate inventory by version, edition, Software Assurance status, and license model
  • AWS account and GCP project inventory with proposed Defender for Cloud connector layout

Phase 2 — Onboard

Arc enrollment at scale through automation

Phase two enrolls resources into Azure Arc using the right channel per workload — Group Policy and Configuration Manager for AD-joined Windows, Ansible and Salt for Linux, SCCM and Intune for endpoints, Helm and GitOps for Kubernetes, and PowerShell modules for SQL Server. EPC Group sequences enrollment by ring with named owners and a documented rollback procedure.

  • Service principal hierarchy, RBAC scopes, and onboarding identity standards before any agent ships
  • Ring-based enrollment — pilot ring, broad ring one, broad ring two, long-tail server and edge ring
  • GitOps Flux v2 configuration repo stood up as the source of truth for every Arc Kubernetes cluster
  • Resource Graph dashboards confirming Arc enrollment, agent health, and tag conformance per environment

Phase 3 — Govern

Policy, Defender, and tag taxonomy enforced uniformly

Phase three projects the customer governance model onto every Arc resource. EPC Group ships Azure Policy initiatives mapped to the regulatory reality — HIPAA, FedRAMP, FINRA, CMMC, or GxP — applies Defender for Servers Plan 2, Defender for Containers, and Defender for SQL, and stands up the tag taxonomy that drives cost, ownership, and compliance reporting across the hybrid estate.

  • Azure Policy initiatives for HIPAA, ISO 27001, NIST CSF 2.0, FedRAMP, or CMMC applied at management-group scope
  • Defender for Cloud regulatory compliance dashboards configured across Azure, AWS, GCP, and Arc resources
  • Tag taxonomy enforced through Policy with auto-remediation for missing or non-conformant tags
  • Machine Configuration (DSC v3) baselines for Windows and Linux guest config drift detection

Phase 4 — Operate

Patching, monitoring, and runtime operations at hybrid scale

Phase four operationalizes the Arc plane. Update Manager runs monthly maintenance windows by environment, Azure Monitor Container Insights captures Prometheus telemetry across multi-cloud Kubernetes, Defender posts incidents to Sentinel, and Automation runbooks handle the day-two operations the SRE team would otherwise script in five different tools.

  • Update Manager monthly maintenance windows scoped by environment, geography, and criticality
  • Azure Monitor agent shipping Windows event logs, Linux syslog, and custom logs to one Log Analytics workspace
  • Defender incident bi-directional sync with Microsoft Sentinel for cross-source SOC investigation
  • Automation runbooks for SQL Server backup validation, Kubernetes node drain workflows, and certificate rotation

Phase 5 — Extend

Arc-enabled Data Services, App Services, and edge workloads

Phase five extends the Arc plane to projected Azure services that move PaaS onto customer infrastructure. EPC Group deploys Arc-enabled SQL Managed Instance and PostgreSQL Hyperscale onto on-prem and AWS Kubernetes for data residency and latency, ships Arc-enabled App Services for the workloads that must run inside a regulatory boundary, and stands up Azure Stack HCI plus AKS Edge Essentials for the edge sites that demand local compute with cloud-grade managed services.

  • Arc-enabled SQL Managed Instance on customer Kubernetes for data residency and engine parity with Azure SQL
  • Arc-enabled App Services and Functions on customer Kubernetes for hybrid PaaS deployments
  • Azure Stack HCI and AKS Edge Essentials onboarded into the Arc plane for retail, manufacturing, and defense edge
  • Disconnected and indirect-connect operating models documented and runbook-tested for air-gapped environments

Why EPC Group leads enterprise Azure Arc deployments

1997
Founded · Microsoft consulting
70+
Fortune 500 clients
216+
M&A tenant consolidations
1.83 million
Users migrated

Microsoft Solutions Partner — Infrastructure & Security

Microsoft Solutions Partner with the Infrastructure and Security designations plus four additional designations covering Modern Work, Data & AI, Digital & App Innovation, and Business Applications. Senior architects average two decades of Microsoft platform delivery experience.

Four-time author for Microsoft Press and Sams

Founder Errin O’Connor has nearly three decades of Microsoft consulting leadership and is a four-time author for Microsoft Press and Sams across Power BI and SharePoint.

Fixed-fee accelerators

Every Azure Arc engagement is fixed-fee with a costed roadmap and named senior architect on-record from kickoff through go-live. No T&M overruns, no offshore handoff, no junior-analyst-led production cutover.

Compliance-native

EPC Group is compliance-native across HIPAA, SOC 2, FedRAMP, FINRA, CMMC, and GxP. Arc deployments ship with auditor-ready control matrices, Defender for Cloud compliance dashboards, and Resource Graph evidence queries.

Frequently asked questions — Azure Arc

How is Azure Arc different from Google Anthos and AWS EKS Anywhere — and which one wins for an enterprise?

Azure Arc, Google Anthos, and AWS EKS Anywhere are the three vendor-led hybrid and multicloud control planes. Anthos is anchored on Google Kubernetes — strong GitOps story through Config Sync, strong service-mesh story through Anthos Service Mesh, but the management plane is Google Cloud. EKS Anywhere extends Amazon EKS to on-prem and bare metal, with the EKS Connector projecting clusters back to the AWS console — narrower scope, no SQL or server story. Azure Arc is the broadest of the three because it projects servers, Kubernetes, SQL, data services, and app services into one Azure governance plane, and Azure Policy plus Microsoft Defender are mature governance and security surfaces that span the entire stack. For Microsoft-anchored enterprises Arc is the obvious choice; for Google or AWS shops Arc still wins on governance breadth but requires accepting Azure as the management cloud. The deeper analysis lives in /microsoft-azure-aws-gcp-multi-cloud-orchestration.

Does Azure Arc require my servers and clusters to be connected to the public internet?

Arc agents need outbound HTTPS to a defined set of Azure endpoints — Resource Manager, Arc data plane, Log Analytics, and the Microsoft download network — but inbound connectivity is never required. For environments without direct internet access, Arc supports Azure ExpressRoute private peering, Azure Private Link for the Arc data plane, and a fully disconnected indirect-connect mode for Azure Arc-enabled Data Services. The disconnected mode buffers telemetry and billing locally, reconciling when the customer next connects to Azure. Most enterprise deployments use HTTP proxies and Private Link rather than direct public-internet access.

What does Azure Arc actually cost — and how does Microsoft monetize the platform?

Arc itself is free for the projection — registering a server, a Kubernetes cluster, or a SQL Server instance into Azure Resource Manager carries no licensing fee. Microsoft monetizes the add-on services consumed on top of the Arc projection. Defender for Servers Plan 2 is roughly $15 per server per month. Defender for SQL is in the same range per SQL instance. Defender for Containers is priced per vCore. Update Manager is free for Arc machines. Log Analytics is per-GB ingested. Machine Configuration is per-node-month. Arc-enabled Data Services and App Services are vCore-based. A realistic enterprise budget envelope is $25 to $60 per Arc resource per month fully loaded across security, monitoring, and configuration management — much less than the per-machine cost of running parallel CSPM, EDR, and SIEM agents from third-party vendors.

How does Azure Arc enable SQL Server license mobility for customers leaving Software Assurance?

Azure Arc-enabled SQL Server supports pay-as-you-go billing for SQL Server Standard and Enterprise — the customer registers existing SQL instances into Arc, picks PAYG as the license model, and Microsoft bills the SQL Server license consumption through Azure based on actual core utilization. This converts the SQL Server line item from upfront license plus annual Software Assurance into Azure OpEx consumption with monthly cost visibility. The customer can stay on existing on-prem or AWS infrastructure, keep the workload in place, and gain the financial flexibility of consumption billing plus the governance benefits of Arc enrollment. Customers with active Software Assurance can use the existing license benefits and not enable PAYG; this is a one-toggle decision per instance.

What is Azure Stack HCI and how does it relate to Azure Arc for edge deployments?

Azure Stack HCI is the Microsoft hyperconverged infrastructure platform — validated hardware running a hardened Windows Server-based hypervisor with software-defined storage and networking, billed as an Azure service. Every Azure Stack HCI cluster is Arc-enabled by design. AKS on Azure Stack HCI delivers Kubernetes inside the HCI cluster, AKS Edge Essentials delivers a lighter-weight Kubernetes for single-server or two-node edge deployments, and Arc-enabled Data Services delivers managed SQL and Postgres on top. The pattern is Microsoft cloud-grade managed services running on customer-owned hardware at retail, manufacturing, defense, and healthcare edge locations — all governed from the same Azure control plane as the cloud-hosted estate.

How does Azure Arc work with Microsoft Defender for Cloud across AWS and GCP?

Microsoft Defender for Cloud has two layers that reach into AWS and GCP. The first is the multi-cloud connector — a CloudFormation stack for AWS and a Cloud Run job for GCP — that grants Defender for Cloud read access to the cloud APIs for Foundational CSPM (free) and Defender CSPM (paid). The second layer is per-resource Defender plans that run on the workloads themselves. To get Defender for Servers Plan 2 on AWS EC2 or GCP Compute Engine the server needs the Arc agent installed, projecting the machine into Azure Resource Manager. Once Arc-enrolled, the EC2 or GCP server gets the same Defender for Endpoint integration, file integrity monitoring, vulnerability assessment, and just-in-time VM access as a native Azure VM. The Arc agent is what makes multi-cloud workload protection real beyond posture-only management.

How do enterprises operate Azure Arc-enabled Kubernetes at scale across EKS, GKE, OpenShift, and AKS?

The operating model centers on Flux v2 GitOps. Every Arc-enabled cluster reconciles its application and platform configuration from a Git source of truth managed by the platform engineering team. Azure Policy for Kubernetes enforces pod security standards, image allow-listing, and network policy uniformly across EKS, GKE, OpenShift, and AKS. Defender for Containers detects runtime threats across all clusters with a single Defender configuration. Azure Monitor Container Insights captures Prometheus telemetry into managed Grafana. Cluster Connect provides RBAC-scoped kubectl access through the Azure portal without opening inbound firewall rules — engineers authenticate through Entra ID and Azure RBAC rather than maintaining separate cloud identity per cluster. EPC Group ships a starter GitOps repo, Policy initiative library, and Cluster Connect onboarding runbook with every Arc Kubernetes engagement.

How does Azure Arc map to HIPAA, FedRAMP, CMMC, and other regulatory frameworks?

Arc resources participate in the Defender for Cloud regulatory compliance dashboard, which exposes control mappings for NIST CSF 2.0, ISO 27001, HIPAA Security Rule, FedRAMP Moderate and High, CMMC 2.0, PCI DSS, and several others. Azure Policy initiatives ship for each framework with auto-remediation where the control is enforceable through configuration. Defender for Servers and Defender for SQL provide the EDR, FIM, and SQL-specific control evidence regulators expect. EPC Group extends the out-of-the-box mappings into a documented control matrix linked to assessment evidence, policy artifacts, and exception workflows that an auditor will accept. The /standards-alignment library exposes the full mapping. For federal customers we anchor on the GCC High and DoD IL5 versions of these services; for healthcare we anchor on the BAA covering Arc and Defender; for defense contractors we anchor on the CMMC 2.0 control overlay applied at management-group scope.

Continue exploring the EPC Group enterprise Microsoft library

Azure Arc is one plane inside a broader Microsoft cloud orchestration story. These hubs and analyses cover adjacent and complementary territory.

Microsoft Cloud Orchestrator

The end-to-end Microsoft cloud orchestration model under which Azure Arc sits as the hybrid and multicloud projection plane.

Microsoft + AWS + GCP multi-cloud orchestration

The broad multicloud strategy hub — Azure as the orchestration plane, AWS and GCP as workload destinations, Arc as the projection layer.

Microsoft Defender XDR enterprise guide

How Defender for Cloud and Defender for Servers ride on top of the Arc plane to deliver multi-cloud workload protection.

Azure consulting services

EPC Group Azure consulting service line — landing zones, migrations, governance, and Arc projection across hybrid estates.

Database vs warehouse vs lake on Microsoft

How Arc-enabled SQL Server fits into the broader Microsoft data architecture across OLTP, warehouse, and lake patterns.

Digital transformation — Microsoft enterprise 2026

The five-stage EPC Group Lifecycle inside which the Azure Arc Accelerator is the hybrid and multicloud governance workstream.

Federal Microsoft consulting — FedRAMP and CMMC

Azure Arc inside GCC High and DoD IL5 boundaries, with FedRAMP and CMMC 2.0 control overlays for defense contractors.

Standards alignment library

NIST CSF 2.0, ISO 27001, HIPAA, FedRAMP, FINRA, CMMC, and GxP control mappings for Microsoft platforms including Arc.

One Azure governance plane across every cloud and every data center

Book an Azure Arc briefing with an EPC Group senior architect. Two-hour working session — hybrid estate inventory, Arc target list, accelerator scoping. Zero obligation, board-ready output.

Book the briefing888-381-9725

AI assistant — not human