The idea
An agent, not a migration
Two small agents connect your SQL Server to Azure. The database never leaves the machine.
The Azure Connected Machine agent registers the host. The Azure extension for SQL Server reports the instances. Both talk outbound on 443; nothing dials in.
- Anywhere. Data centre, edge site, another cloud, VMware, Azure VMware Solution.
- Metadata only. Version, edition, cores, patch level and databases. No customer rows.
- Small. Two cores and 512 MB of RAM is the recommended floor.
SQL Server 2025 also needs this Arc connection for Fabric Mirroring, so one agent serves both the control plane and the analytics copy.
Day one
Inventory is the free part
Connect, and the instance appears in the Azure portal as a resource of its own.
- Resource Graph. Ask “how many 2014 instances do I have, and which run on Linux?” in KQL.
- Detailed inventory. Every database, with size, backup history and encryption state.
- Run Command. Push one T-SQL script to every instance and collect the output centrally.
- Migration readiness. Which Azure SQL target fits, free for any licence.
Connecting is free. Most of what you do next is licensed.
The gate
Your licence decides what you get
| Capability | Licence only | With SA or subscription | Pay-as-you-go |
|---|---|---|---|
| Inventory and migration readiness | Yes | Yes | Yes |
| Microsoft Entra sign-in | Yes | Yes | Yes |
| Defender for Cloud and Purview | Yes | Yes | Yes |
| Best practices assessment | No | Yes | Yes |
| Automatic updates and patching | No | Yes | Yes |
| Automated backups and point-in-time restore | No | Yes | Yes |
| Performance monitoring | No | Yes | Yes |
| Extended Security Updates | No | Yes | Yes |
Plain licence-only gets you the map, not the automation. The switches live in the extension, and most are off by default.
The switches
What the features actually do
Identity
Security it brings with it
- Defender for Cloud. Vulnerability assessment on every database, plus alerts on unusual activity. Needs the Azure Monitoring agent and a Log Analytics workspace.
- Entra ID authentication. SQL Server 2022 and 2025 only: MFA, single sign-on, and no passwords in connection strings.
- Purview. Register and scan the instance for classification, lineage and data governance.
- A managed identity. SQL Server 2025 can use it for backups to Azure blob, linked servers and extensible key management.
Defender and best practices assessment need the Azure Monitoring agent as well. The Arc agent alone does not turn them on.
The bill
Pay-as-you-go and ESU
Two ways Arc saves money, both metered by the hour.
- Pay-as-you-go. Licence by core, minimum four per operating system, billed only in hours the instance runs and the machine is online.
- Passive replicas are free. A failover partner that serves no reads is not billed on Windows.
- ESU. Up to three years of security updates after support ends. SQL Server 2014 stays patched this way.
- Cancel anytime. Upgrading, or moving to Azure SQL, ends the charge. Installed updates stay.
- Linux caveat. Passive detection does not run on Linux, so every instance there bills as active.
The fine print
What it will not do
- Not a migration. Nothing moves but metadata; the move to Azure SQL is a separate, guided step.
- Not your backup plan. The built-in backups are preview and local. Keep your own regime.
- Not high availability. It discovers and reports on availability groups and cluster instances. It does not fail them over.
- Not every host. SQL Server 2014 or later, 64-bit: Windows 10 and 11, Windows Server 2016, Ubuntu 20.04, RHEL 8, SLES 15.
- Not forever. Only extension versions from the last year are supported. Leave auto-upgrade on.