Azure Local extends Azure services to customer-controlled locations so mission workloads can run where they are needed—at the tactical edge, or at a forward site. This capability is especially critical in Denied, Disrupted, Intermittent, and Limited (DDIL) environments. It enables hybrid and fully disconnected operations while maintaining consistent security, policy, and lifecycle control.

This post provides a reference architecture that uses Azure Local for mission solutions at the tactical edge.  This article is designed to provide a reference for those developing Mission Tactical Solutions, designed to run at the edge and how to enable a platform using Microsoft technologies. 

Why is the Edge so important to Mission?

In modern defense operations, decision advantage depends on bringing compute and analytics closer to the point of collection often in environments where reach-back to centralized cloud services are intermittent, degraded, or denied.  The ability to run cloud-architected solutions when connectivity to the cloud is limited is a critical requirement for these scenarios.  When evaluating the broader defense landscape, several contributing factors shape this requirement and influence how solutions must operate today and evolve over time. 

1. High Data Volume - Military forces and mission partners field more sensors designed to support the warfighter and drive decision advantage.  As data volume grows, isolating signal from noise becomes even more important within strict security boundaries and constrained communications. 
2. Increased Pressure to Deliver Value Faster - Edge capabilities are expected to deliver outcomes faster than ever before.  Meeting this demand requires solutions that evolve over time while maintaining compliance and security both now and in the future. 
3. Modern Tools and AI Model Access at the Edge - Edge deployments increasingly require AI workloads that isolate signal from noise and sustain decision advantage, even under denied or degraded connectivity. 

To address these needs, Microsoft has developed adaptive cloud capabilities that extend Azure patterns to the tactical edge, and this is accomplished with the Adaptive Cloud.  Adaptive Cloud and the portfolio of services provide an operating model across hybrid, edge, and IoT environments to enable an operations platform through a single consistent framework. 

With the Adaptive Cloud portfolio, the goal is to provide solution teams with the option deploy and operate mission applications closer to the point of need while maintaining governance and lifecycle control. 

Azure Local (including disconnected operations), and Azure Arc form a common operational layer for edge environments.  Together they help standardize infrastructure, deploy modern applications (VMs and containers), and enforce governance—even when connectivity is limited—so mission systems can be operated, patched, and updated without relying on continuous reach-back. 

What is Azure Local?

Azure Local is Microsoft’s on-premises, Azure-consistent platform that extends Azure infrastructure and services to customer-controlled locations so critical workloads can run where they are needed—on the edge—without sacrificing cloud-native agility or security governance. It supports modern VM and Kubernetes workloads locally while maintaining a common operational model with Azure for policy, security controls, and lifecycle management.

In tactical environments, Azure Local helps standardize and harden infrastructure across enclaves and sites, while enabling a platform that can evolve and change over time to meet mission needs. 

The result is a more resilient foundation for mission applications in contested or bandwidth-constrained conditions—while reducing operational friction and accelerating fielding.

Recent Announcements:

Recent announcements describe updates to Azure Local for edge and sovereign scenarios, including:

• Azure Local disconnected operations (ALDO) is generally available, extending Azure governance and policy to sites with no cloud connectivity.
• Foundry Local adds support for large AI models in fully disconnected, sovereign environments.

Over the past year, several customer and partner announcements have expanded validated hardware and deployment options for Azure Local in mission environments.

• Curtiss-Wright has announced Azure Local validation for PacStar Tactical Edge Servers: Azure Local validation for PacStar Tactical Edge Servers. 
• Microsoft has highlighted a partnership with Armada to deploy Azure Local on Armadas Galleon Modular Data Centers (MDC): Azure Local on Galleon Modular Data Centers.

Taken together, these announcements indicate that Azure Local is being validated and deployed for mission workloads at the tactical edge where connectivity, policy, and operational constraints drive the architecture.

Azure Local disconnected operations (ALDO):

Azure Local disconnected operations (ALDO) is designed for missions that cannot support connectivity back to the Azure Cloud. It enables platforms and workloads (VMs, Kubernetes, and other extended services) to run fully disconnected at remote or forward sites, while keeping local control of compute, storage, and networking—and preserving governance intent for policy and configuration when connectivity returns.

Mission Reference Architecture:

As many edge systems modernize, teams move toward container-based solutions and use orchestration platforms such as Kubernetes to run and manage those workloads.  Containerization is only part of the broader solution: workloads must also be deployed to edge hardware and sustained over time, including updates, patching, and feature delivery for end users. 

With Azure Kubernetes Service enabled by Arc (AKS on Arc) available on Azure Local, teams can deploy and operate containerized applications using Azure-consistent patterns while remaining resilient in disconnected or contested scenarios.  Depending on how the Azure Local environment is configured can determine the length of time it can support disconnected durations.  Azure Local also supports a cloud-like development experience through infrastructure as code and platform services that accelerate delivery. 

Key Components of the Architecture:

• Azure Local – Software-defined platform for Azure-consistent operations on approved edge hardware.
• Azure Kubernetes Service enabled by Arc (AKS on Arc) – Managed Kubernetes for running containerized workloads with Azure-consistent deployment and operations.
• Azure Container Registry (ACR) – Image repository for packaging and deploying container images to the edge.
• Azure Arc – Extends Azure management, policy, and security to edge resources when connectivity is available—without making mission operations dependent on constant connectivity.

Cloud Connected Resilient Architecture:

This architecture can be deployed in two configurations to support scenarios where cloud connectivity every 30 days is possible or not.  The connected configuration below enables the ability to extend the cloud to the tactical edge, while connectivity is available, but maintains system operations when it is not.  Which is the critical element of supporting mission and tactical solutions. 

How does Data Flow through this solution?

1. Collect data at the edge (UAV, TOC, ship, platform systems) to support time-sensitive decisions in operations. The battlefield of the future has an ever-growing array of new sensors and systems that are constantly capturing relevant information to support the warfighter. 
2. Ingest mission data into a local processing environment (AKS enabled by Arc on Azure Local) so analytics can run close to the source, even when reach-back is limited.
3. Run AI models in Kubernetes pods on the AKS enabled by Arc cluster using validated on-premises edge hardware (including GPU-enabled nodes where required).
4. Enforce network segmentation to isolate workloads and enclaves, supporting least-privilege access and separation of mission functions.
5. Replicate container images to the edge using Azure Arc connected registry so updates can be staged when connected and consumed when disconnected.
6. Synchronize selected data products and model outputs to the enterprise when communications permit, using the preferred transport available in theater and taking advantage of existing or new backhaul investments. 
7. Enable connectivity through deployed tactical network to support connectivity to additional assets and Forward Deployed C2 Systems.
8. SCP enables secure connectivity between classified tactical edge locations and the Microsoft classified cloud via Microsoft’s global network, which spans more than 175,000 miles of terrestrial and subsea fiber.  This connection is used when policy and network conditions allow. 
9. Apply role-based access control (RBAC) and Azure Policy to enforce configuration and compliance with intent from Azure Government to the local environment.
10. Forward logs, health, and security telemetry to the Microsoft security toolchain when connected to support visibility, triage, and continuous hardening.

What are some of the key architectural considerations?

When architecting this solution, Azure Local offers features that improve adaptability and support future evolution of the platform. 

1. Azure Local and Infrastructure-as-code – Infrastructure-as-code at the edge strengthens security control through policy enforcement while preserving flexibility as new services become available. 
2. Enable Remote Monitoring and Management Plane – Through Azure Arc, Azure Local is able to be remotely managed and monitored when connectivity is available, including pushing updates without needing on-site system administration support. 
3. Cloud Development Mirrored on the Edge Device – Platform-as-a-Service offerings on Azure Local let developers build in the cloud using the same approach used at the edge, improving scale and test coverage during development. 
4. Azure Local Provides Scalable Solutions for the Edge – With the right partner hardware, Azure Local can be sized for mission environmental needs, making it possible to scale deployments across configurations and sites. 
5. Enabling GitOps and Registry Mirroring for Application Deployment – Azure Arc combined with Azure Local helps standardize containerized application delivery through GitOps workflows and registry replication, so updates can be staged when connected and consumed when disconnected. 

What are the advantages of this architecture?

• Power AI at the tactical edge – Run GPU-enabled, containerized models locally with consistent platform services.
• Extend cloud operations patterns to the edge – Use AKS and infrastructure-as-code to deliver repeatable deployments, lower-touch sustainment, and faster updates across sites.
• Platform that evolves with mission needs - Abstracting the underlying hardware helps teams adapt and extend solutions over time. 

What are the key integrations?

• AKS management (onsite or remote from cloud) – Use Azure Arc-enabled Kubernetes for centralized management when connected and resilience when disconnected.
• Registry replication – Use Azure Arc Connected Registry to replicate images from cloud registries to the tactical edge.
• Policy enforcement – Apply Azure Policy locally to drive compliance and configuration consistency, even while disconnected.
• Logging + security integration – Integrate with Azure Arc and Microsoft Defender to support monitoring and security posture across dispersed edge deployments.

Fully Cloud Disconnected Architecture:

This architecture can be deployed in scenarios where there is no ability to connect back to the cloud to support management and operations.  The disconnected configuration below enables the ability to leverage cloud deployment patterns at the tactical edge, and enables an enhanced platform and technologies despite never connecting to the cloud. 

The primary difference between the architectures being that the solution can be configured to support never being connected to the cloud. In which case, the solution would only connect to the tactical network.  In this scenario, by design there is no option  for remote management via arc, but the capabilities of Policy Enforcement, Infrastructure-as-code, and hardware platform abstraction are all still available. 

Adaptive Cloud and Innovation at the Edge:

Azure Local and Microsoft technologies bring cloud capabilities to the tactical edge while maintaining resiliency amid uncertain connectivity and changing mission needs.   

For additional background on Microsoft’s Defense and mission offerings, see the Defense and Intelligence Solutions site:  Defense and Intelligence Solutions | Microsoft AI

For questions about this architecture or edge deployment scenarios, you can contact the mission team at mission@microsoft.com.