We are making Azure Arc extensible and increasing the flexibility of the tooling you can use to operate your machines using Azure’s control plane. We are excited to announce new modules in Ansible Galaxy that make it easier to manage Azure Arc machine extensions at scale. With the latest updates to the azure.azcollection on Ansible Galaxy, you no longer need to switch between existing tools. You can now deploy and manage Azure Arc extensions using familiar, declarative Ansible workflows.
These new modules include:
Together, they enable infrastructure and platform teams to automate extension lifecycle management across their hybrid estate—bringing consistency, security, and efficiency to Azure Arc-enabled servers.
Why this matters
Azure Arc machine extensions power critical scenarios such as security, monitoring, update management, configuration and compliance. Until now, managing these Azure Arc extensions across hybrid estates often required Azure CLI scripts, ARM templates, or manual operations. With these new Ansible modules, you can:
- Integrate Azure Arc extension management into existing Ansible playbooks
- Enforce consistent configuration across hybrid servers
- Reduce operational overhead through declarative automation
- Align extension deployment with broader configuration management workflows
What’s included
azure_rm_arcmachineextensions
This module allows you to manage the full lifecycle of Azure Arc machine extensions, including:
- Creating and deploying extensions
- Updating extension settings
- Removing extensions when no longer needed
You can define extension state declaratively, ensuring consistent enforcement across your Azure Arc-enabled servers.
azure_rm_arcmachineextensions_info
This module provides visibility into extension state by retrieving:
- Installed extensions on Azure Arc-enabled machines
- Provisioning status and configuration details
- Extension metadata for reporting and validation
This is useful for compliance validation, auditing, and conditional automation in playbooks.
Scenario: Enforcing identity-based SSH access across a hybrid fleet
Consider a regulated enterprise that must ensure all Linux servers—whether on-premises or in a multicloud environment—use Microsoft Entra ID for SSH access. The organization wants to:
- Eliminate local SSH credentials
- Enforce centralized identity and access controls
- Audit access consistently across all environments
By combining Azure Arc with Ansible, the organization can deploy the Microsoft Entra SSH for Linux extension across all Azure Arc-enabled servers as part of a standardized playbook, ensuring compliance and reducing operational overhead.
Example: Deploy Microsoft Entra SSH for Linux extension
Below is an example of using Ansible to deploy the Microsoft Entra SSH extension to an Azure Arc-enabled server:
- name: Deploy Entra SSH extension to Arc server
hosts: localhost
connection: local
tasks:
- name: Install Entra SSH extension for Linux
azure_rm_arcmachineextensions:
resource_group: myResourceGroup
machine_name: myArcServer
name: AADSSHLoginForLinux
publisher: Microsoft.Azure.ActiveDirectory
type: AADSSHLoginForLinux
type_handler_version: "1.0"
settings: {}
state: present
Example: Retrieve extension information
Below is an example of using Ansible to retrieve details about your Azure Arc extensions:
- name: Get Arc machine extension details
hosts: localhost
connection: local
tasks:
- name: Fetch extensions
azure_rm_arcmachineextensions_info:
resource_group: myResourceGroup
machine_name: myArcServer
Integrating with existing Ansible workflows
If you’re already using Ansible for:
- OS configuration
- Patch and update management
- Application deployment
You can now extend those workflows to include Azure Arc extension management—without introducing new tools or processes. This allows you to manage on-premises servers, Edge infrastructure and multicloud environments through a unified automation approach powered by Azure Arc and Ansible.
Read more at Enable VM Extensions Using Red Hat Ansible - Azure Arc | Microsoft Learn
What’s next
These modules are part of our continued investment in making Azure Arc a first-class platform for managing Windows and Linux machines in hybrid and multicloud infrastructure.
By bringing extension lifecycle management into Ansible, we’re enabling teams to enforce security, compliance, and operational consistency at scale—using the tools they already trust.
Stay connected
Join the Azure Arc Monthly Forum here: aka.ms/ArcServerForumSignup
Let us know what you’d like to see next in the comments!
Microsoft