---
name: Azure Arc
slug: azure-arc
category: DevOps
description: Azure Arc provides guidance for Azure Arc development, including troubleshooting, best practices, architecture, security, configuration, integrations, and deployment. Use it when working on Arc-enabled Kubernetes, data services, resource bridge, Connected Machine agents, or Agentic Retrieval.
github: "https://github.com/MicrosoftDocs/Agent-Skills/tree/main/skills/azure-arc"
stars: 715
forks: 116
install: "npx degit https://github.com/MicrosoftDocs/Agent-Skills/tree/main/skills/azure-arc ~/.claude/skills/azure-arc"
installs_to: ~/.claude/skills/azure-arc
source_path: skills/azure-arc/SKILL.md
collection_size: 25
category_size: 798
collection_url: "https://dirskills.com/collections/MicrosoftDocs/Agent-Skills"
added: 2026-08-23T05:20:07.899Z
last_synced: 2026-08-23T05:20:07.899Z
canonical_url: "https://dirskills.com/skills/azure-arc"
---

# Azure Arc

Azure Arc provides guidance for Azure Arc development, including troubleshooting, best practices, architecture, security, configuration, integrations, and deployment. Use it when working on Arc-enabled Kubernetes, data services, resource bridge, Connected Machine agents, or Agentic Retrieval.

**Install:**

```bash
npx degit https://github.com/MicrosoftDocs/Agent-Skills/tree/main/skills/azure-arc ~/.claude/skills/azure-arc
```

## README

# Azure Arc Skill

This skill provides expert guidance for Azure Arc. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

## How to Use This Skill

> **IMPORTANT for Agent**: Use the **Category Index** below to locate relevant sections. For categories with line ranges (e.g., `L35-L120`), use `read_file` with the specified lines. For categories with file links (e.g., `[security.md](security.md)`), use `read_file` on the linked reference file

> **IMPORTANT for Agent**: If `metadata.generated_at` is more than 3 months old, suggest the user pull the latest version from the repository. If `mcp_microsoftdocs` tools are not available, suggest the user install it: [Installation Guide](https://github.com/MicrosoftDocs/mcp/blob/main/README.md)

This skill requires **network access** to fetch documentation content:
- **Preferred**: Use `mcp_microsoftdocs:microsoft_docs_fetch` with query string `from=learn-agent-skill`. Returns Markdown.
- **Fallback**: Use `fetch_webpage` with query string `from=learn-agent-skill&accept=text/markdown`. Returns Markdown.

## Category Index

| Category | Lines | Description |
|----------|-------|-------------|
| Troubleshooting | L37-L75 | Diagnosing and fixing Azure Arc issues: connectivity, onboarding, storage, Kubernetes extensions/GitOps, resource bridge, site manager, workload orchestration, and server/VM auth/networking. |
| Best Practices | L76-L86 | Best practices for Agentic Retrieval (document prep, evaluation, metrics) and Azure Arc storage/volumes (filesystem quirks, out-of-space handling, static retain, namespace validators). |
| Decision Making | L87-L109 | Planning and design guidance for Azure Arc: choosing services, tiers, licensing, connectivity, Kubernetes platforms, and migration strategies for servers, data services, and workloads. |
| Architecture & Design Patterns | L110-L117 | Patterns for Arc data/compute design: container storage data flow, Arc Edge Volumes, HA/DR for Arc SQL MI and failover groups, and advanced Edge RAG data parsing. |
| Limits & Quotas | L118-L128 | Limits, billing rules, prerequisites, and offline behavior for Azure Arc agents and services (Agentic Retrieval, Arc storage, Kubernetes, ESU, PAYG, Connected Machine). |
| Security | L129-L189 | Securing Azure Arc: identity, RBAC, AD/Kerberos, key/cert rotation, network/Private Link, policy/compliance, and protecting data, workloads, and Kubernetes/servers/VMware/SCVMM resources. |
| Configuration | L190-L298 | Configuring Azure Arc environments: networking, security, data services, Kubernetes/AKS, Agentic Retrieval, storage, monitoring, GitOps, resource bridge, and Connected Machine agent settings. |
| Integrations & Coding Patterns | L299-L329 | REST/CLI/Ansible/PowerShell patterns for Arc: agentic retrieval APIs, MCP/RAG tools, VM extensions, onboarding servers at scale, Resource Graph, Sentinel, Event Grid, Terraform, and licensing. |
| Deployment | L330-L361 | Deploying and managing Azure Arc components: agents, data controllers, extensions, resource bridge, SCVMM/vSphere onboarding, upgrades, DR/failover, and disconnected/local scenarios. |

### Troubleshooting
| Topic | URL |
|-------|-----|
| Reference and troubleshoot NFS with Kerberos for Agentic Retrieval | https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/connect-file-share-kerberos-reference |
| Reference and troubleshoot SharePoint S2S auth for Agentic Retrieval | https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/connect-sharepoint-reference |
| Fix blob upload and mirroring issues with managed identity | https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/blobs-not-uploaded |
| Resolve common issues for Azure Container Storage enabled by Arc | https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/faq |
| Troubleshoot Azure Arc container storage deployments | https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/troubleshooting |
| Resolve common issues for Azure Arc-enabled data services | https://learn.microsoft.com/en-us/azure/azure-arc/data/faq |
| Troubleshoot failover group connection issues in Arc SQL | https://learn.microsoft.com/en-us/azure/azure-arc/data/troubleshoot-managed-instance |
| Troubleshoot configuration files for Arc SQL Managed Instance | https://learn.microsoft.com/en-us/azure/azure-arc/data/troubleshoot-managed-instance-configuration |
| Collect Azure Arc data controller logs for troubleshooting | https://learn.microsoft.com/en-us/azure/azure-arc/data/troubleshooting-get-logs |
| Monitor and troubleshoot cert-manager for Arc-enabled Kubernetes | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/cert-manager-monitor-troubleshoot |
| Diagnose Azure Arc-enabled Kubernetes connection problems | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/diagnose-connection-issues |
| Troubleshoot Arc-enabled Kubernetes extension failures | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/extensions-troubleshooting |
| Resolve common issues for Arc-enabled Kubernetes and GitOps | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/faq |
| Troubleshoot Azure Key Vault Secret Store extension issues | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/secret-store-extension-troubleshooting |
| Troubleshoot Azure Arc-enabled Kubernetes platform and GitOps issues | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/troubleshooting |
| Troubleshoot Azure Arc multicloud connector issues | https://learn.microsoft.com/en-us/azure/azure-arc/multicloud-connector/troubleshoot-multicloud-connector |
| Troubleshoot Azure Arc resource bridge deployment and connectivity | https://learn.microsoft.com/en-us/azure/azure-arc/resource-bridge/troubleshoot-resource-bridge |
| Diagnose and fix Essential Machine Management enrollment issues | https://learn.microsoft.com/en-us/azure/azure-arc/servers/essential-machine-management/troubleshoot |
| Evaluate Arc on Azure VMs and handle errors | https://learn.microsoft.com/en-us/azure/azure-arc/servers/plan-evaluate-on-azure-virtual-machine |
| Troubleshoot SSH connectivity to Arc-enabled servers | https://learn.microsoft.com/en-us/azure/azure-arc/servers/ssh-arc-troubleshoot |
| Diagnose Azure Arc Connected Machine agent onboarding issues | https://learn.microsoft.com/en-us/azure/azure-arc/servers/troubleshoot-agent-onboard |
| Handle disconnected scenarios for Azure Arc-enabled servers | https://learn.microsoft.com/en-us/azure/azure-arc/servers/troubleshoot-connectivity |
| Troubleshoot Azure Arc Extended Security Updates delivery | https://learn.microsoft.com/en-us/azure/azure-arc/servers/troubleshoot-extended-security-updates |
| Troubleshoot networking problems for Azure Arc-enabled servers | https://learn.microsoft.com/en-us/azure/azure-arc/servers/troubleshoot-networking |
| Diagnose and fix Azure Arc server VM extension failures | https://learn.microsoft.com/en-us/azure/azure-arc/servers/troubleshoot-vm-extensions |
| Clarify Azure Arc vs VMware vSphere usage | https://learn.microsoft.com/en-us/azure/azure-arc/servers/vmware-faq |
| Azure Arc site manager FAQ and behavioral clarifications | https://learn.microsoft.com/en-us/azure/azure-arc/site-manager/faq |
| Known issues and workarounds for Azure Arc site manager | https://learn.microsoft.com/en-us/azure/azure-arc/site-manager/known-issues |
| Troubleshoot common Azure Arc site manager problems | https://learn.microsoft.com/en-us/azure/azure-arc/site-manager/troubleshooting |
| Recover Azure Arc resource bridge VM after deletion | https://learn.microsoft.com/en-us/azure/azure-arc/system-center-virtual-machine-manager/disaster-recovery |
| Troubleshoot SCVMM-specific Azure Arc resource bridge deployment errors | https://learn.microsoft.com/en-us/azure/azure-arc/system-center-virtual-machine-manager/troubleshoot-scvmm |
| Troubleshoot guest management issues for Arc-enabled VMware | https://learn.microsoft.com/en-us/azure/azure-arc/vmware-vsphere/troubleshoot-guest-management-issues |
| Diagnose Azure Arc workload orchestration logs and errors | https://learn.microsoft.com/en-us/azure/azure-arc/workload-orchestration/diagnose-problems |
| Resolve known Azure Arc workload orchestration issues | https://learn.microsoft.com/en-us/azure/azure-arc/workload-orchestration/known-issues |
| Diagnose and fix Azure Arc workload orchestration issues | https://learn.microsoft.com/en-us/azure/azure-arc/workload-orchestration/troubleshooting |

### Best Practices
| Topic | URL |
|-------|-----|
| Optimize documents for advanced data parsing in Agentic Retrieval | https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/advanced-data-parsing |
| Evaluate Agentic Retrieval system, models, and datasets | https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/evaluate-solution |
| Use evaluation metrics for Agentic Retrieval system performance | https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/evaluation-metrics |
| Handle Azure Arc container storage filesystem behaviors | https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/reference-filesystem-behavior |
| Design for out-of-space conditions in Azure Arc storage | https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/reference-filesystem-out-of-space |
| Use static retain workflows for Azure Arc Edge Volumes | https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/static-retain |
| Implement namespace-scoped external validator for Arc solutions | https://learn.microsoft.com/en-us/azure/azure-arc/workload-orchestration/external-validation-namespace |

### Decision Making
| Topic | URL |
|-------|-----|
| Choose an appropriate language model for Agentic Retrieval | https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/prepare-language-model |
| Choose search types for Agentic Retrieval deployments | https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/search-types |
| Select the appropriate Azure Arc service for servers | https://learn.microsoft.com/en-us/azure/azure-arc/choose-service |
| Choose connectivity modes for Arc data services | https://learn.microsoft.com/en-us/azure/azure-arc/data/connectivity |
| Plan Azure Arc-enabled data services deployments | https://learn.microsoft.com/en-us/azure/azure-arc/data/plan-azure-arc-data-services |
| Plan and purchase Azure Arc SQL reserved capacity | https://learn.microsoft.com/en-us/azure/azure-arc/data/reserved-capacity-overview |
| Choose SQL Managed Instance Azure Arc service tiers | https://learn.microsoft.com/en-us/azure/azure-arc/data/service-tiers |
| Size Azure Arc-enabled data services deployments | https://learn.microsoft.com/en-us/azure/azure-arc/data/sizing-guidance |
| Select validated Kubernetes platforms for Azure Arc data | https://learn.microsoft.com/en-us/azure/azure-arc/data/validation-program |
| Plan and execute migration to Secret Store extension | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/secret-store-extension-migration |
| Use validated Kubernetes distributions for Arc-enabled Kubernetes | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/validation-program |
| Choose cloud-native licensing options for Azure Arc servers | https://learn.microsoft.com/en-us/azure/azure-arc/servers/cloud-native/licensing-cost-management |
| Plan and provision Azure Arc ESU licenses for Windows Server | https://learn.microsoft.com/en-us/azure/azure-arc/servers/license-extended-security-updates |
| Migrate legacy Log Analytics agents via Azure Arc | https://learn.microsoft.com/en-us/azure/azure-arc/servers/migrate-legacy-agents |
| Modernize server management from Config Manager to Arc | https://learn.microsoft.com/en-us/azure/azure-arc/servers/modernize-server-management |
| Plan large-scale Azure Arc server deployments | https://learn.microsoft.com/en-us/azure/azure-arc/servers/plan-at-scale-deployment |
| Plan migration of Arc-managed servers to Azure | https://learn.microsoft.com/en-us/azure/azure-arc/servers/scenario-migrate-to-azure |
| Understand Azure Arc-enabled services validation program | https://learn.microsoft.com/en-us/azure/azure-arc/validation-program/overview |
| Migrate workload orchestration targets to new clusters | https://learn.microsoft.com/en-us/azure/azure-arc/workload-orchestration/migrate-cluster |

### Architecture & Design Patterns
| Topic | URL |
|-------|-----|
| Control cloud data flow in Azure Container Storage | https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/howto-ingest-data-flow |
| Design data flows using Azure Arc Edge Volumes options | https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/storage-options |
| Plan disaster recovery with failover groups for Arc SQL | https://learn.microsoft.com/en-us/azure/azure-arc/data/managed-instance-disaster-recovery |
| Design high availability for Arc SQL Managed Instance | https://learn.microsoft.com/en-us/azure/azure-arc/data/managed-instance-high-availability |

### Limits & Quotas
| Topic | URL |
|-------|-----|
| Review known issues and limitations for Agentic Retrieval | https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/known-issues |
| Disconnected operation behavior for Arc container storage | https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/disconnected-operations |
| Review system requirements and constraints for Arc-enabled Kubernetes | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/system-requirements |
| Maintain Azure Arc resource bridge health and uptime | https://learn.microsoft.com/en-us/azure/azure-arc/resource-bridge/maintenance |
| Understand Azure Arc ESU billing rules and timing | https://learn.microsoft.com/en-us/azure/azure-arc/servers/billing-extended-security-updates |
| Billing behavior for Windows Server pay-as-you-go via Arc | https://learn.microsoft.com/en-us/azure/azure-arc/servers/billing-windows-server-pay-go |
| Review prerequisites and supported environments for Connected Machine agent | https://learn.microsoft.com/en-us/azure/azure-arc/servers/prerequisites |

### Security
| Topic | URL |
|-------|-----|
| Configure BYOM endpoint API-key authentication for Agentic Retrieval | https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/configure-endpoint-authentication |
| Configure NFS with Kerberos authentication for Agentic Retrieval | https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/connect-file-share-kerberos-overview |
| Set up SharePoint S2S authentication for Agentic Retrieval | https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/connect-sharepoint-overview |
| Configure Entra authentication and roles for Agentic Retrieval | https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/prepare-authentication |
| Verify Azure Contributor role for Agentic Retrieval deployment | https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/prepare-contributor-permission |
| Configure OneLake identity for Azure Arc cloud subvolumes | https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/howto-configure-onelake-identity |
| Configure workload identity for Arc container subvolumes | https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/howto-configure-workload-identity |
| Configure localhost token endpoint for Arc container storage | https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/howto-enable-local-identity-access |
| Understand AD authentication modes for Azure Arc data services | https://learn.microsoft.com/en-us/azure/azure-arc/data/active-directory-introduction |
| Prepare Active Directory for Azure Arc data services | https://learn.microsoft.com/en-us/azure/azure-arc/data/active-directory-prerequisites |
| Manually configure TDE for Arc SQL Managed Instance | https://learn.microsoft.com/en-us/azure/azure-arc/data/configure-transparent-data-encryption-manually |
| Enable or disable TDE on Arc SQL Managed Instance | https://learn.microsoft.com/en-us/azure/azure-arc/data/configure-transparent-data-encryption-sql-managed-instance |
| Connect to AD-authenticated Arc SQL Managed Instance | https://learn.microsoft.com/en-us/azure/azure-arc/data/connect-active-directory-sql-managed-instance |
| Deploy Active Directory connector for Arc SQL using CLI | https://learn.microsoft.com/en-us/azure/azure-arc/data/deploy-active-directory-connector-cli |
| Manage Active Directory connector for Arc SQL via Azure portal | https://learn.microsoft.com/en-us/azure/azure-arc/data/deploy-active-directory-connector-portal |
| Deploy AD-integrated SQL Managed Instance on Azure Arc | https://learn.microsoft.com/en-us/azure/azure-arc/data/deploy-active-directory-sql-managed-instance |
| Deploy AD-integrated Arc SQL Managed Instance using CLI | https://learn.microsoft.com/en-us/azure/azure-arc/data/deploy-active-directory-sql-managed-instance-cli |
| Deploy customer-managed keytab AD connector for Arc SQL | https://learn.microsoft.com/en-us/azure/azure-arc/data/deploy-customer-managed-keytab-active-directory-connector |
| Deploy system-managed keytab AD connector for Arc SQL | https://learn.microsoft.com/en-us/azure/azure-arc/data/deploy-system-managed-keytab-active-directory-connector |
| Apply least-privilege access for Arc data services | https://learn.microsoft.com/en-us/azure/azure-arc/data/least-privilege |
| Rotate customer-managed keytabs for Arc SQL Managed Instance | https://learn.microsoft.com/en-us/azure/azure-arc/data/rotate-customer-managed-keytab |
| Rotate service-managed credentials for Arc SQL Managed Instance | https://learn.microsoft.com/en-us/azure/azure-arc/data/rotate-sql-managed-instance-credentials |
| Rotate user TLS certificates for Arc SQL Managed Instance | https://learn.microsoft.com/en-us/azure/azure-arc/data/rotate-user-tls-certificate |
| Configure Azure RBAC for Arc-enabled Kubernetes authorization | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/azure-rbac |
| Securely connect to Azure Arc-enabled Kubernetes clusters | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/cluster-connect |
| Apply Azure RBAC authorization to Arc-enabled Kubernetes clusters | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/conceptual-azure-rbac |
| Protect data and secrets in Arc-enabled Kubernetes | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/conceptual-secure-your-data |
| Implement network security for Arc-enabled Kubernetes clusters | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/conceptual-secure-your-network |
| Secure operations and access for Arc-enabled Kubernetes | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/conceptual-secure-your-operations |
| Harden the platform for Arc-enabled Kubernetes clusters | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/conceptual-secure-your-platform |
| Secure workloads and containers on Arc-enabled Kubernetes | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/conceptual-secure-your-workloads |
| Comprehensive security guidance for Arc-enabled Kubernetes | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/conceptual-security-book |
| Implement workload identity federation for Arc-enabled Kubernetes | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/conceptual-workload-identity |
| Configure identity and access options for Arc-enabled Kubernetes | https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/identity-access-overview |
| Use built-in Azure Policy definitions for Arc-enabled Kubernete