Once a month the Azure Arc team will release an episode covering a variety of topics. To request a topic or view additional episodes please visit: aka.ms/the-azure-arc-check-in Episode 1: Onboarding Azure Arc at Scale

Scenario: Imagine your organization has 1,000 Windows and Linux servers spread across multiple locations. You want them all in Azure Arc, but first you need to deploy the Azure Connected Machine agent at scale. Try now in Azure aka.ms/aaci-episode1

Why onboarding strategy matters

Interactive sign-in works well for testing and proof-of-concepts, but it quickly becomes impractical when you’re onboarding large server estates.

At scale, organizations need a deployment model that can:

• Automate onboarding across many machines
• Align with existing management tooling
• Apply consistent configuration and governance from day one
• Minimize manual effort and human error

This episode focuses on using non-interactive authentication and automation to onboard large server fleets efficiently. One of the key recommendations is to use a dedicated authentication mechanism designed for scale rather than relying on interactive administrator sign-ins.

Onboard a Linux fleet with Ansible

The Ansible deployment begins with an Ansible node that is already connected to Azure Arc.

The deployment uses the credential on the Ansible node to deploy the Azure Connected Machine agent to the Linux fleet. To enable this, the managed identity of the Ansible node has the Azure Connected Machine Onboarding role in Azure assigned.

Below are the steps for role assignment in the Azure portal:

• Open the resource group where the servers will be deployed.
• In Access control, add a role assignment.
• Select the Azure Connected Machine Onboarding role.
• Choose managed identities, select Machine - Azure Arc, and find the Ansible node.
• Review and assign the role.

Configure the Ansible playbook

With the permissions in place, the deployment uses three files:

• inventory.ini: Represents the machines configured by the playbook.
• arc-vars.yml: Contains non-secret configuration, including the resource group name, subscription and tenant IDs, location, and tags.
• arc-onboard.yml: References arc-vars.yml and configures the playbook to use managed identity, or MSI, for authentication.

After the playbook runs, Ansible deploys the Azure Connected Machine agent to the Linux fleet. You can return to the resource group, refresh the view, and verify that your Linux machines appear as Azure Arc connected servers.

Onboard Windows machines with Group Policy

For Windows Server environments joined to Active Directory, Group Policy remains one of the simplest and most scalable deployment mechanisms.

The process includes:

• Creating the required onboarding identity
• Preparing a shared location for deployment assets
• Downloading the Azure Arc GPO deployment package
• Generating a Group Policy Object with the required settings
• Linking that GPO to the appropriate organizational unit (OU)
• Allowing targeted servers to automatically onboard during policy refresh cycles

For organizations that already manage Windows Server through Active Directory, this approach enables onboarding at scale without introducing additional management infrastructure.

FAQs

1. What is the best way to onboard servers to Azure Arc at scale?

For large Windows and Linux server environments, use automated deployment with non-interactive authentication rather than signing in interactively on each machine. This approach lets you deploy the Azure Connected Machine agent consistently across many servers while reducing manual effort and human error. Azure Connected Machine Agent Deployment Options - Azure Arc

2. Can I use Ansible to onboard Linux servers to Azure Arc?

Yes. You can use an Azure Arc-enabled Ansible node to deploy the Azure Connected Machine agent across a Linux server fleet. In the approach demonstrated here, the Ansible node uses its managed identity, which is assigned the Azure Connected Machine Onboarding role, to authenticate the deployment. Connect machines to Azure Arc at scale using Ansible - Azure Arc

3. Can I use Group Policy to onboard Windows servers to Azure Arc?

Yes. Group Policy can automate Azure Arc onboarding for Windows Server machines that are joined to Active Directory. The process uses a Group Policy Object linked to the appropriate organizational unit, allowing targeted servers to onboard automatically during Group Policy refresh cycles. Connect machines at scale using Group Policy with a PowerShell script - Azure Arc

4. What files are needed to onboard Linux servers to Azure Arc with Ansible?

The Ansible deployment shown in this episode uses three files: inventory.ini to identify the target machines, arc-vars.yml to store non-secret configuration such as subscription, tenant, resource group, location, and tags, and arc-onboard.yml to run the onboarding playbook using managed identity authentication.

5. Should I use Ansible or Group Policy for Azure Arc onboarding?

Use Ansible when onboarding Linux servers in an environment that already uses Ansible playbooks and automation. Use Group Policy when onboarding domain-joined Windows servers managed through Active Directory. Both approaches help organizations automate Azure Connected Machine agent deployment by using tools already present in their server-management environment. Additional options are available for onboarding servers at scale. See Azure Connected Machine Agent deployment options.