Azure Arc Skill

This skill provides expert guidance for Azure Arc. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

• Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
• Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

Category	Lines	Description
Troubleshooting	L37-L75	Diagnosing and fixing Azure Arc issues: Kubernetes, data services, container storage, resource bridge, site manager, VMware, SSH/networking, extensions, multicloud connectors, and ESU delivery.
Best Practices	L76-L86	Best practices for Agentic Retrieval (document prep, evaluation, metrics) and Azure Arc storage/volumes (filesystem quirks, out-of-space handling, static retain, namespace validators).
Decision Making	L87-L109	Guides for choosing Azure Arc services, licensing, connectivity, sizing, platforms, and migration paths for servers, data services, Kubernetes, and agent/secret store orchestration.
Architecture & Design Patterns	L110-L117	Patterns for Arc data/compute design: container storage data flow, Arc Edge Volumes, HA/DR for Arc SQL MI and failover groups, and advanced Edge RAG data parsing.
Limits & Quotas	L118-L127	Limits, billing rules, prerequisites, and offline behavior for Azure Arc agents and services (Agentic Retrieval, Arc storage, Kubernetes, ESU, PAYG, Connected Machine).
Security	L128-L187	Securing Azure Arc: identity, RBAC, AD/Kerberos, key/cert rotation, network/Private Link, policy/compliance, and protecting data, workloads, and Kubernetes/servers/VMware/SCVMM resources.
Configuration	L188-L296	Configuring Azure Arc environments: networking, security, storage, monitoring, data services, Kubernetes/VM extensions, and Agentic Retrieval setup, data sources, and observability.
Integrations & Coding Patterns	L297-L327	REST/CLI/Ansible/PowerShell patterns for Arc: agentic retrieval APIs, MCP/RAG tools, VM extensions, onboarding servers at scale, Resource Graph, Sentinel, Event Grid, Terraform, and licensing.
Deployment	L328-L359	Deploying, upgrading, and removing Azure Arc components and extensions (agents, data controllers, resource bridge, SCVMM/vSphere, Agentic Retrieval, monitoring, storage) across environments.

Troubleshooting

Topic	URL
Reference and troubleshoot NFS with Kerberos for Agentic Retrieval	https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/connect-file-share-kerberos-reference
Reference and troubleshoot SharePoint S2S auth for Agentic Retrieval	https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/connect-sharepoint-reference
Fix blob upload and mirroring issues with managed identity	https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/blobs-not-uploaded
Resolve common issues for Azure Container Storage enabled by Arc	https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/faq
Troubleshoot Azure Arc container storage deployments	https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/troubleshooting
Resolve common issues for Azure Arc-enabled data services	https://learn.microsoft.com/en-us/azure/azure-arc/data/faq
Troubleshoot failover group connection issues in Arc SQL	https://learn.microsoft.com/en-us/azure/azure-arc/data/troubleshoot-managed-instance
Troubleshoot configuration files for Arc SQL Managed Instance	https://learn.microsoft.com/en-us/azure/azure-arc/data/troubleshoot-managed-instance-configuration
Collect Azure Arc data controller logs for troubleshooting	https://learn.microsoft.com/en-us/azure/azure-arc/data/troubleshooting-get-logs
Monitor and troubleshoot Arc Certificate Management extension	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/cert-manager-monitor-troubleshoot
Diagnose Azure Arc-enabled Kubernetes connection problems	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/diagnose-connection-issues
Troubleshoot Arc-enabled Kubernetes extension failures	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/extensions-troubleshooting
Resolve common issues for Arc-enabled Kubernetes and GitOps	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/faq
Troubleshoot Azure Key Vault Secret Store extension issues	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/secret-store-extension-troubleshooting
Troubleshoot Azure Arc-enabled Kubernetes platform and GitOps issues	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/troubleshooting
Troubleshoot Azure Arc multicloud connector issues	https://learn.microsoft.com/en-us/azure/azure-arc/multicloud-connector/troubleshoot-multicloud-connector
Diagnose and fix Azure Arc resource bridge deployment issues	https://learn.microsoft.com/en-us/azure/azure-arc/resource-bridge/troubleshoot-resource-bridge
Diagnose and fix Essential Machine Management enrollment issues	https://learn.microsoft.com/en-us/azure/azure-arc/servers/essential-machine-management/troubleshoot
Evaluate Arc on Azure VMs and handle errors	https://learn.microsoft.com/en-us/azure/azure-arc/servers/plan-evaluate-on-azure-virtual-machine
Troubleshoot SSH connectivity to Arc-enabled servers	https://learn.microsoft.com/en-us/azure/azure-arc/servers/ssh-arc-troubleshoot
Diagnose Azure Arc Connected Machine agent onboarding issues	https://learn.microsoft.com/en-us/azure/azure-arc/servers/troubleshoot-agent-onboard
Handle disconnected scenarios for Azure Arc-enabled servers	https://learn.microsoft.com/en-us/azure/azure-arc/servers/troubleshoot-connectivity
Troubleshoot Azure Arc Extended Security Updates delivery	https://learn.microsoft.com/en-us/azure/azure-arc/servers/troubleshoot-extended-security-updates
Troubleshoot networking problems for Azure Arc-enabled servers	https://learn.microsoft.com/en-us/azure/azure-arc/servers/troubleshoot-networking
Diagnose and fix Azure Arc server VM extension failures	https://learn.microsoft.com/en-us/azure/azure-arc/servers/troubleshoot-vm-extensions
Clarify Azure Arc vs VMware vSphere usage	https://learn.microsoft.com/en-us/azure/azure-arc/servers/vmware-faq
Azure Arc site manager FAQ and behavioral clarifications	https://learn.microsoft.com/en-us/azure/azure-arc/site-manager/faq
Known issues and workarounds for Azure Arc site manager	https://learn.microsoft.com/en-us/azure/azure-arc/site-manager/known-issues
Troubleshoot common Azure Arc site manager problems	https://learn.microsoft.com/en-us/azure/azure-arc/site-manager/troubleshooting
Recover Azure Arc resource bridge VM after deletion	https://learn.microsoft.com/en-us/azure/azure-arc/system-center-virtual-machine-manager/disaster-recovery
Troubleshoot SCVMM-specific Azure Arc resource bridge deployment errors	https://learn.microsoft.com/en-us/azure/azure-arc/system-center-virtual-machine-manager/troubleshoot-scvmm
Troubleshoot guest management issues for Arc-enabled VMware	https://learn.microsoft.com/en-us/azure/azure-arc/vmware-vsphere/troubleshoot-guest-management-issues
Diagnose Azure Arc workload orchestration logs and errors	https://learn.microsoft.com/en-us/azure/azure-arc/workload-orchestration/diagnose-problems
Resolve known Azure Arc workload orchestration issues	https://learn.microsoft.com/en-us/azure/azure-arc/workload-orchestration/known-issues
Diagnose and fix Azure Arc workload orchestration issues	https://learn.microsoft.com/en-us/azure/azure-arc/workload-orchestration/troubleshooting

Best Practices

Topic	URL
Optimize documents for advanced data parsing in Agentic Retrieval	https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/advanced-data-parsing
Evaluate Agentic Retrieval system, models, and datasets	https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/evaluate-solution
Use evaluation metrics for Agentic Retrieval system performance	https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/evaluation-metrics
Handle Azure Arc container storage filesystem behaviors	https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/reference-filesystem-behavior
Design for out-of-space conditions in Azure Arc storage	https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/reference-filesystem-out-of-space
Use static retain workflows for Azure Arc Edge Volumes	https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/static-retain
Implement namespace-scoped external validator for Arc solutions	https://learn.microsoft.com/en-us/azure/azure-arc/workload-orchestration/external-validation-namespace

Decision Making

Topic	URL
Choose an appropriate language model for Agentic Retrieval	https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/prepare-language-model
Choose search types for Agentic Retrieval deployments	https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/search-types
Select the appropriate Azure Arc service for servers	https://learn.microsoft.com/en-us/azure/azure-arc/choose-service
Choose connectivity modes for Arc data services	https://learn.microsoft.com/en-us/azure/azure-arc/data/connectivity
Plan Azure Arc-enabled data services deployments	https://learn.microsoft.com/en-us/azure/azure-arc/data/plan-azure-arc-data-services
Plan and purchase Azure Arc SQL reserved capacity	https://learn.microsoft.com/en-us/azure/azure-arc/data/reserved-capacity-overview
Choose SQL Managed Instance Azure Arc service tiers	https://learn.microsoft.com/en-us/azure/azure-arc/data/service-tiers
Size Azure Arc-enabled data services deployments	https://learn.microsoft.com/en-us/azure/azure-arc/data/sizing-guidance
Select validated Kubernetes platforms for Azure Arc data	https://learn.microsoft.com/en-us/azure/azure-arc/data/validation-program
Plan and execute migration to Secret Store extension	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/secret-store-extension-migration
Use validated Kubernetes distributions for Arc-enabled Kubernetes	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/validation-program
Choose cloud-native licensing options for Azure Arc servers	https://learn.microsoft.com/en-us/azure/azure-arc/servers/cloud-native/licensing-cost-management
Plan and provision Azure Arc ESU licenses for Windows Server	https://learn.microsoft.com/en-us/azure/azure-arc/servers/license-extended-security-updates
Migrate legacy Log Analytics agents via Azure Arc	https://learn.microsoft.com/en-us/azure/azure-arc/servers/migrate-legacy-agents
Modernize server management from Config Manager to Arc	https://learn.microsoft.com/en-us/azure/azure-arc/servers/modernize-server-management
Plan large-scale Azure Arc server deployments	https://learn.microsoft.com/en-us/azure/azure-arc/servers/plan-at-scale-deployment
Plan migration of Arc-managed servers to Azure	https://learn.microsoft.com/en-us/azure/azure-arc/servers/scenario-migrate-to-azure
Understand Azure Arc-enabled services validation program	https://learn.microsoft.com/en-us/azure/azure-arc/validation-program/overview
Migrate workload orchestration targets to new clusters	https://learn.microsoft.com/en-us/azure/azure-arc/workload-orchestration/migrate-cluster

Architecture & Design Patterns

Topic	URL
Control cloud data flow in Azure Container Storage	https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/howto-ingest-data-flow
Design data flows using Azure Arc Edge Volumes options	https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/storage-options
Plan disaster recovery with failover groups for Arc SQL	https://learn.microsoft.com/en-us/azure/azure-arc/data/managed-instance-disaster-recovery
Design high availability for Arc SQL Managed Instance	https://learn.microsoft.com/en-us/azure/azure-arc/data/managed-instance-high-availability

Limits & Quotas

Topic	URL
Review known issues and limitations for Agentic Retrieval	https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/known-issues
Disconnected operation behavior for Arc container storage	https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/disconnected-operations
Review system requirements and constraints for Arc-enabled Kubernetes	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/system-requirements
Maintain Azure Arc resource bridge health and uptime	https://learn.microsoft.com/en-us/azure/azure-arc/resource-bridge/maintenance
Understand Azure Arc ESU billing rules and timing	https://learn.microsoft.com/en-us/azure/azure-arc/servers/billing-extended-security-updates
Billing behavior for Windows Server pay-as-you-go via Arc	https://learn.microsoft.com/en-us/azure/azure-arc/servers/billing-windows-server-pay-go

Security

Topic	URL
Configure BYOM endpoint API-key authentication for Agentic Retrieval	https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/configure-endpoint-authentication
Configure NFS with Kerberos authentication for Agentic Retrieval	https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/connect-file-share-kerberos-overview
Set up SharePoint S2S authentication for Agentic Retrieval	https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/connect-sharepoint-overview
Configure Entra authentication and roles for Agentic Retrieval	https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/prepare-authentication
Verify Azure Contributor role for Agentic Retrieval deployment	https://learn.microsoft.com/en-us/azure/azure-arc/agents-tools-foundry-local/prepare-contributor-permission
Configure OneLake identity for Azure Arc cloud subvolumes	https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/howto-configure-onelake-identity
Configure workload identity for Arc container subvolumes	https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/howto-configure-workload-identity
Configure localhost token endpoint for Arc container storage	https://learn.microsoft.com/en-us/azure/azure-arc/container-storage/howto-enable-local-identity-access
Understand AD authentication modes for Azure Arc data services	https://learn.microsoft.com/en-us/azure/azure-arc/data/active-directory-introduction
Prepare Active Directory for Azure Arc data services	https://learn.microsoft.com/en-us/azure/azure-arc/data/active-directory-prerequisites
Manually configure TDE for Arc SQL Managed Instance	https://learn.microsoft.com/en-us/azure/azure-arc/data/configure-transparent-data-encryption-manually
Enable or disable TDE on Arc SQL Managed Instance	https://learn.microsoft.com/en-us/azure/azure-arc/data/configure-transparent-data-encryption-sql-managed-instance
Connect to AD-authenticated Arc SQL Managed Instance	https://learn.microsoft.com/en-us/azure/azure-arc/data/connect-active-directory-sql-managed-instance
Deploy Active Directory connector for Arc SQL using CLI	https://learn.microsoft.com/en-us/azure/azure-arc/data/deploy-active-directory-connector-cli
Manage Active Directory connector for Arc SQL via Azure portal	https://learn.microsoft.com/en-us/azure/azure-arc/data/deploy-active-directory-connector-portal
Deploy AD-integrated SQL Managed Instance on Azure Arc	https://learn.microsoft.com/en-us/azure/azure-arc/data/deploy-active-directory-sql-managed-instance
Deploy AD-integrated Arc SQL Managed Instance using CLI	https://learn.microsoft.com/en-us/azure/azure-arc/data/deploy-active-directory-sql-managed-instance-cli
Deploy customer-managed keytab AD connector for Arc SQL	https://learn.microsoft.com/en-us/azure/azure-arc/data/deploy-customer-managed-keytab-active-directory-connector
Deploy system-managed keytab AD connector for Arc SQL	https://learn.microsoft.com/en-us/azure/azure-arc/data/deploy-system-managed-keytab-active-directory-connector
Apply least-privilege access for Arc data services	https://learn.microsoft.com/en-us/azure/azure-arc/data/least-privilege
Rotate customer-managed keytabs for Arc SQL Managed Instance	https://learn.microsoft.com/en-us/azure/azure-arc/data/rotate-customer-managed-keytab
Rotate service-managed credentials for Arc SQL Managed Instance	https://learn.microsoft.com/en-us/azure/azure-arc/data/rotate-sql-managed-instance-credentials
Rotate user TLS certificates for Arc SQL Managed Instance	https://learn.microsoft.com/en-us/azure/azure-arc/data/rotate-user-tls-certificate
Configure Azure RBAC for Arc-enabled Kubernetes authorization	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/azure-rbac
Securely connect to Azure Arc-enabled Kubernetes clusters	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/cluster-connect
Apply Azure RBAC authorization to Arc-enabled Kubernetes clusters	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/conceptual-azure-rbac
Protect data and secrets in Arc-enabled Kubernetes	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/conceptual-secure-your-data
Implement network security for Arc-enabled Kubernetes clusters	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/conceptual-secure-your-network
Secure operations and access for Arc-enabled Kubernetes	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/conceptual-secure-your-operations
Harden the platform for Arc-enabled Kubernetes clusters	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/conceptual-secure-your-platform
Comprehensive security guidance for Arc-enabled Kubernetes	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/conceptual-security-book
Implement workload identity federation for Arc-enabled Kubernetes	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/conceptual-workload-identity
Configure identity and access options for Arc-enabled Kubernetes	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/identity-access-overview
Use built-in Azure Policy definitions for Arc-enabled Kubernetes	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/policy-reference
Configure Private Link connectivity for Arc-enabled Kubernetes clusters	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/private-link
Configure workload identity federation on Arc-enabled Kubernetes	https://learn.microsoft.com/en-us/azure/azure-arc/kubernetes/workload-identity
Evaluate security configuration for Azure Arc resource bridge	https://learn.microsoft.com/en-us/azure/azure-arc/resource-bridge/security-overview
Enforce governance and guest configuration with Azure Arc Policy	https://learn.microsoft.com/en-us/azure/azure-arc/servers/cloud-native/governance-policy
Implement identity and access management for Arc-enabled servers	https://learn.microsoft.com/en-us/azure/azure-arc/servers/cloud-native/identity-access
Use managed identity on Arc-enabled servers	https://learn.microsoft.com/en-us/azure/azure-arc/servers/managed-identity-authentication
Use service principals for Arc at-scale onboarding	https://learn.microsoft.com/en-us/azure/azure-arc/servers/onboard-service-principal
Use built-in Azure Policy definitions for Arc-enabled servers	https://learn.microsoft.com/en-us/azure/azure-arc/servers/policy-reference
Secure Azure Arc servers with Private Link endpoints	https://learn.microsoft.com/en-us/azure/azure-arc/servers/private-link-security
Apply regulatory compliance policies to Azure Arc-enabled servers	https://learn.microsoft.com/en-us/azure/azure-arc/servers/security-controls-policy
Understand data collection and privacy for Azure Arc servers	https://learn.microsoft.com/en-us/azure/azure-arc/servers/security-data-privacy
Secure and customize VM extensions on Azure Arc-enabled servers	https://learn.microsoft.com/en-us/azure/azure-arc/servers/security-extensions
Configure identity and authorization for Azure Arc-enabled servers	https://learn.microsoft.com/en-us/azure/azure-arc/servers/security-identity-authorization
Configure network security for Azure Arc-enabled servers	https://learn.microsoft.com/en-us/azure/azure-arc/servers/security-networking
Check Azure Arc site security baseline compliance status	https://learn.microsoft.com/en-us/azure/azure-arc/site-manager/view-security-compliance-status
Azure RBAC built-in roles for Arc-enabled SCVMM	https://learn.microsoft.com/en-us/azure/azure-arc/system-center-virtual-machine-manager/built-in-roles
Define custom RBAC roles for Arc-enabled SCVMM	https://learn.microsoft.com/en-us/azure/azure-arc/system-center-virtual-machine-manager/create-custom-roles
Configure self-service RBAC access to SCVMM via Arc	https://learn.microsoft.com/en-us/azure/azure-arc/system-center-virtual-machine-manager/set-up-and-manage-self-service-access-scvmm
Use built-in RBAC roles for Arc-enabled VMware vSphere	https://learn.microsoft.com/en-us/azure/azure-arc/vmware-vsphere/built-in-roles
Create custom RBAC roles for Arc-enabled VMware vSphere	https://learn.microsoft.com/en-us/azure/azure-arc/vmware-vsphere/create-custom-roles
Configure self-service RBAC for VMware resources via Arc	https://learn.microsoft.com/en-us/azure/azure-arc/vmware-vsphere/setup-and-manage-self-service-access
Set up RBAC for Arc workload orchestration resources	https://learn.microsoft.com/en-us/azure/azure-arc/workload-orchestration/rbac-guide