Why start with Arc
Many estates can't move everything at once. Arc gives you a single view and control plane in Azure now, while migrations run wave by wave — and it covers the servers that will stay on-premises.
| Capability | What you get |
|---|---|
| Inventory | Every instance and database as Azure resources (Resource Graph queries) |
| Best practices assessment | Regular configuration checks (needs Log Analytics) |
| Microsoft Defender for SQL | Vulnerability assessment and threat detection |
| Licensing | Report licence type; pay-as-you-go SQL licensing billed through Azure |
| ESUs | Extended Security Updates for SQL Server 2012/2014 billed monthly via Arc |
| Entra ID authentication | For SQL Server 2022 |
| Migration assessment | Readiness and target recommendations for Azure SQL |
| Automated patching / backups (preview/GA by feature) | Managed from Azure |
1. Connect servers
Install the Azure Connected Machine agent (onboarding script from the portal, or at scale with a service principal / Configuration Manager / Group Policy). The SQL Server extension is deployed automatically to servers with SQL Server (if auto-onboarding is on) and creates SQL Server - Azure Arc resources.
azcmagent connect --service-principal-id $appId --service-principal-secret $secret `
--tenant-id $tenant --subscription-id $sub --resource-group rg-arc-sql --location centralindia
azcmagent show
Network: outbound HTTPS to Azure Arc endpoints (directly, through a proxy, or via Private Link scope).
2. Set licence type per instance
| Licence type | Meaning |
|---|---|
Paid | Licences with Software Assurance or subscription |
PAYG | Pay-as-you-go via Azure |
LicenseOnly | Licence without SA (limits some features) |
Correct licence type matters: features like ESU subscription and some management capabilities depend on it.
3. Query the estate
resources
| where type == "microsoft.azurearcdata/sqlserverinstances"
| project name, resourceGroup, version = properties.version, edition = properties.edition,
licenseType = properties.licenseType, status = properties.status
| order by tostring(version) asc
4. ESUs for old versions
Enable the ESU subscription on the Arc-enabled SQL Server instance (the instance needs a Paid or PAYG licence type). Patches are then delivered through Windows Update / your patching tool. Plan an upgrade or migration anyway: ESU cost grows each year.
5. Migration assessment
Open the instance → Database migration to see readiness for Azure SQL MI / DB / VM and recommended SKUs. Use it alongside the assessment post's T-SQL inventory.
6. Governance
- Azure Policy and tags apply to Arc resources like any Azure resource.
- Azure RBAC controls who can view and manage SQL instances in the portal.
- Defender alerts flow to the same SOC as Azure-native workloads.
Tip
Onboard all SQL Servers to Arc in the first month of the programme. A complete, live inventory in Resource Graph is more valuable than any spreadsheet, and it never goes out of date.