Cloud

Azure Arc in the Philippines: Managing On-Premises Servers from Azure Portal

August 29, 2026 · 7min read · Technica Solutions Inc.

Moving everything to the cloud is not always the right answer for Philippine businesses. Data residency requirements, application dependencies, latency constraints, and the cost of re-architecting legacy workloads all argue for keeping certain servers on-premises or in a Philippine colocation facility. But that decision has traditionally come at a cost: two separate management disciplines, two sets of monitoring tools, and two different patching and compliance workflows.

Azure Arc removes that tradeoff. It extends Azure's management plane to servers that live outside Azure — your on-premises rack, a branch office server room, or a colocation cabinet — without moving any workloads. The servers stay where they are; Azure becomes the single pane of glass through which you manage them.

What Azure Arc Is — and Is Not

Azure Arc is not a migration tool. Connecting a server to Arc does not move it to Azure, change its IP address, or affect its local workloads in any way. It installs a lightweight agent (the Azure Connected Machine agent, azcmagent) that establishes an outbound connection to Azure's management endpoints. From that point, the server appears in your Azure subscription as a resource — just like an Azure VM — and becomes subject to the same governance, monitoring, and security tooling.

Arc-enabled servers support Windows Server 2008 R2 and later, and most major Linux distributions. The agent communicates outbound over HTTPS to management.azure.com and a small set of Azure endpoints — no inbound firewall rules are required.

Key Use Cases for Philippine Businesses

1. Centralised Patch and Update Management

Arc integrates with Azure Update Manager, allowing you to see the patch status of all connected servers — on-premises and cloud — in one dashboard. Schedule maintenance windows, deploy patches, and track compliance across your entire server fleet from Azure Portal. For organisations with servers in multiple Philippine locations (main office, branch, colo), this eliminates the need for a separate WSUS or SCCM deployment.

2. Azure Policy Enforcement On-Premises

Azure Policy can be applied to Arc-enabled servers to enforce security baselines, audit configuration drift, and flag non-compliant settings. Common policies in Philippine enterprise deployments include: require specific Windows security settings, audit that antivirus is installed, and flag servers without disk encryption. The same policies that apply to your Azure VMs now apply to your on-premises hardware — one policy set, no exceptions.

3. Microsoft Defender for Cloud Extended to On-Prem

Defender for Cloud (formerly Azure Security Center) extends to Arc-enabled servers. This means threat detection, vulnerability assessment, and security recommendations for your on-premises servers — without migrating them to Azure. For Philippine businesses that cannot move certain workloads due to data residency or application constraints, this brings enterprise-grade threat detection to on-premises infrastructure at a per-server monthly cost rather than requiring a full SIEM deployment.

Defender for Cloud integration is especially relevant for organisations covered by BSP cybersecurity guidelines or those seeking to align with the DICT's responsible AI and cybersecurity framework — both of which expect continuous monitoring of server infrastructure.

4. Azure Monitor and Log Analytics

Arc connects on-premises servers to Azure Monitor, enabling log collection, metric graphing, and alert rules alongside your Azure resources. During typhoon season, when on-premises connectivity to branch offices may be intermittent, Arc's cloud-side monitoring means you retain visibility into server health through Azure Portal even when direct network access to the branch is disrupted — a meaningful resilience benefit in the Philippine context.

5. Arc-Enabled SQL Server

If your on-premises servers run SQL Server, Arc enables automatic SQL Server instance discovery and adds licence tracking, Defender for SQL, and Microsoft Entra authentication capabilities. This is relevant for organisations transitioning from SQL Server Standard to Azure SQL or managing hybrid SQL environments.

Setting Up Azure Arc: An Overview

Prerequisites:

An active Azure subscription
Outbound internet access from the server to Azure management endpoints (add management.azure.com, *.his.arc.azure.com, *.guestconfiguration.azure.com to firewall allowlists — relevant for offices running FortiGate or Palo Alto with strict egress policies)
A user account with the Azure Connected Machine Onboarding or Contributor role in the target resource group

Onboarding steps:

In Azure Portal → Azure Arc → Servers → Add
Choose "Add a single server" for manual onboarding or "Add multiple servers" for scripted deployment
Download the generated onboarding script (PowerShell for Windows, shell for Linux)
Run the script on the server — it installs azcmagent and registers the server with your subscription
Assign a resource group, region (Southeast Asia for Philippine deployments), and tags

For bulk onboarding across a Philippine branch network, Arc supports scripted onboarding via service principals, making it practical to onboard 10–50 servers without visiting each machine individually.

Ongoing cost: The Arc agent itself and all management features (Azure Policy, Update Manager, Azure Monitor) are included at no additional charge for Arc-enabled servers. Microsoft Defender for Cloud adds a per-server/per-month charge if enabled. Arc-enabled SQL Server licensing features are also free; Defender for SQL is a separate add-on.

Who Should Use Azure Arc

Azure Arc is the right fit for Philippine businesses that:

Have 5 or more on-premises servers they are not ready to migrate to Azure
Want the governance and monitoring capabilities of Azure applied uniformly across cloud and on-premises
Need to meet BSP or NPC requirements for server configuration compliance and audit logging
Are pursuing a zero trust implementation and want policy enforcement extended to on-premises infrastructure

Arc is not necessary for organisations that have already moved all workloads to Azure VMs or that have fewer than 3–4 on-premises servers managed by a single administrator.

For Philippine businesses still building their cloud foundation, Arc provides a practical bridge: start the cloud governance journey without the full migration risk, and migrate workloads incrementally as readiness allows. Technica Solutions Inc. deploys and configures Azure Arc as part of cloud foundation engagements for Philippine businesses across all sectors.

Related reading

Talk to our Cloud & I.T. team