Stay ahead of Azure Arc agent health with Azure Advisor

Azure Advisor helps you stay ahead of potential connectivity issues by analyzing your Azure Arc-enabled servers and providing reliability recommendations when servers have been disconnected for an extended period. These recommendations give you visibility into potential issues and help you act before they affect your ability to manage your hybrid environment through Azure Arc.

Understand your Azure Arc-enabled server health

A reliable connection to Azure is an important part of keeping your Azure Arc-enabled servers healthy and manageable. The Azure Connected Machine agent sends regular heartbeats to Azure to confirm that connection and help identify when a server needs attention.

If Azure does not receive a heartbeat for more than 15 minutes, the server is marked Disconnected. While disconnected, Azure-based management is limited, although existing extensions can continue running locally.

If the server remains disconnected for an extended period, the agent’s managed identity certificate can eventually expire. The certificate is valid for 90 days, and the agent attempts to renew it when 45 or fewer days remain. Once the certificate expires, simply restoring connectivity is not enough. You’ll need to re-onboard the server to Azure Arc to restore management.

For more information about how connectivity affects Arc-enabled servers, see Troubleshoot Azure Arc-enabled servers in disconnected scenarios.

A look into the Azure Advisor recommendations

Azure Advisor provides recommendations based on how long an Arc-enabled server has been disconnected:

• Restore connectivity for a server disconnected for 30–44 days. This provides an early opportunity to investigate the server and restore its connection to Azure.
• Reconnect a server that has been disconnected for at least 45 days. At this stage, the server's managed identity certificate is still valid, but connectivity should be restored so the agent can renew its credential before it expires.
• Re-onboard an expired server. If the server's managed identity certificate has expired, Azure Arc management capabilities remain unavailable until the server is reconnected using onboarding credentials.

Azure Advisor helps surface connectivity conditions earlier, giving you an opportunity to identify disconnected servers and restore connectivity before they reach an expired state. 

How to view recommendations

Azure Portal

You can start in Azure Advisor to review recommendations across your environment or open an individual Azure Arc-enabled server and focus on that singular machine.

From Azure Advisor blade

1. In the Azure portal, search for and select Advisor.
2. Select Operational Excellence.
3. Use the subscription and resource type filters to narrow the results, but for only Azure Arc-enabled servers ensure the Type filter only has Machines - Azure Arc selected.
4. If applicable to your machine, the health recommendation will be shown.

From an Azure Arc-enabled server

1. In the Azure portal, search for and select Azure Arc
2. Select Machines.
3. Select the server you want to review to open its resource page.
4. Open the server’s Recommendations from the Overview page.
5. If applicable to your machine, the health recommendation will be shown.

Azure Resource Graph

You can also use Azure Resource Graph to view Azure Advisor recommendations for Azure Arc-enabled servers across your selected subscriptions.

In the Azure Resource Graph Explorer input the following query:

advisorresources
| where type =~ "microsoft.advisor/recommendations"
| where properties.recommendationStatus == "New"
| extend recommendationTypeId = tostring(properties.recommendationTypeId)
| where recommendationTypeId in~ (
    "18700d61-0b5a-4807-86a1-b7d669475335",   // Restore connectivity (30-44 days)
    "5a6e1150-2d8a-4865-b423-df234577d29b",   // Reconnect before cert expires (45+ days)
    "157eb7ac-9b3d-4a0c-9bfb-dd2ffa37d1ae"    // Re-onboard expired server
  )
| extend id = tostring(properties.resourceMetadata.resourceId)
| extend machineName = tostring(split(id, "/")[8])
| extend recommendation = case(
    recommendationTypeId =~ "18700d61-0b5a-4807-86a1-b7d669475335", "Restore connectivity (disconnected 30-44 days)",
    recommendationTypeId =~ "5a6e1150-2d8a-4865-b423-df234577d29b", "Reconnect before certificate expires (disconnected 45+ days)",
    recommendationTypeId =~ "157eb7ac-9b3d-4a0c-9bfb-dd2ffa37d1ae", "Re-onboard expired server",
    "Unknown")
| distinct recommendation, machineName, id
| order by recommendation asc, machineName asc

Keep your Arc environment healthy

As your Azure Arc environment grows, regularly reviewing Azure Advisor recommendations can help you identify servers that need attention and address connectivity issues before they become more disruptive.

If you see an Azure Arc-related recommendation in Azure Advisor, review the affected server, investigate its agent and network connectivity, and take the recommended action to return it to a Connected state.

Learn more: Resolve Azure Advisor recommendations for Azure Arc-enabled servers