Windows Admin Center for Azure Arc Is Free at GA: Setup, RBAC and Deployment Risks

For systems administrators and enterprise IT architects, this milestone is as much a licensing story as it is a technical one. While the capability previously required specific enrollment under the Windows Server Management enabled by Azure Arc benefit program, Microsoft's GA announcement states that usage restrictions have been lifted and the tool is now included at no additional cost with a standard Windows Server license.

From Cloud VMs to the Hybrid Edge: What Changed at GA​

When Microsoft first introduced Windows Admin Center inside the Azure portal for native Azure Virtual Machines, the goal was straightforward: give administrators deep, granular operating-system control without forcing them to expose RDP ports or maintain dedicated management gateways. In June 2022, Microsoft extended that vision into public preview for Azure Arc-enabled infrastructure, bringing the same browser-based toolset to on-premises and multicloud servers.

However, the path from preview to broad enterprise adoption hit a bureaucratic speed bump. Previously, accessing Windows Admin Center for Azure Arc-enabled servers was tied to the "Windows Server Management enabled by Azure Arc" benefit bundle. According to Microsoft Learn documentation for that program, unlocking those benefits required active Windows Server Software Assurance (SA), active subscription licenses, or enrollment in Windows Server pay-as-you-go billing, along with explicit license attestation in the Azure portal. For administrators running perpetual Windows Server licenses without Software Assurance, that gatekeeping meant one of Microsoft's most practical hybrid management tools remained out of reach.

With the October 2026 general availability announcement on the Windows Admin Center blog, Microsoft has removed those usage barriers. The company confirms that Windows Admin Center for Azure Arc-enabled servers is now available at no extra cost with a Windows Server license, matching the free-to-use model of Windows Admin Center for Azure Virtual Machines and the standalone on-premises Windows Admin Center deployment.

It is important to draw a clear line around what this licensing change covers. Lifting the restriction applies specifically to Windows Admin Center for Arc-enabled servers. Other services bundled under the broader Windows Server Management enabled by Azure Arc program—such as Azure Update Manager, Azure Change Tracking and Inventory, Azure Machine Configuration, Best Practices Assessment, and Remote Support—remain governed by their own licensing, attestation, or Log Analytics data ingestion rules as detailed in Microsoft Learn's program documentation.

Under the Hood: Reverse Proxies, Outbound Traffic, and Entra ID​

Why should a seasoned Windows administrator care about running Windows Admin Center inside an Azure browser tab when RDP and PowerShell remoting have existed for decades? The answer comes down to attack surface reduction and identity governance.

Traditional remote server management requires line-of-sight network access. Whether through a site-to-site VPN, ExpressRoute, or a bastion host, an administrator's workstation ultimately needs a path to reach inbound management ports (such as TCP 3389 for RDP or 5985/5986 for WinRM) on the target server.

Windows Admin Center in Azure flips that model on its head. According to Microsoft Learn's technical documentation for managing Arc-enabled hybrid machines, the service requires zero inbound firewall ports, no public IP addresses, and no VPN connectivity. Instead, it piggybacks on the Azure Connected Machine agent (azcmagent) already running on the Arc-enabled server. Here is how the architecture works behind the scenes when you initiate a session:

1. Resource Provider Registration: During initial setup, Azure registers the Microsoft.HybridConnectivity resource provider on the subscription (a one-time action per subscription requiring */register/action permissions, which are included in the Owner and Contributor roles).
2. Logical Endpoint and Agent Deployment: Installing the feature deploys the AdminCenter VM extension onto the hybrid server along with a valid TLS certificate managed by an external Microsoft certificate service, and creates a logical endpoint resource in Azure.
3. Layer 4 SNI Reverse Proxy: When an administrator clicks Connect in the Azure portal, the portal requests access through Microsoft.HybridConnectivity. That provider communicates with a Layer 4 Server Name Indication (SNI) proxy to establish a short-lived, session-specific reverse proxy tunnel over the outbound connection maintained by the Arc agent.
4. End-to-End Encryption: The portal generates a unique, short-lived URL for the session. Traffic is encrypted end-to-end using Transport Layer Security (TLS), with SSL termination occurring directly on the on-premises or hybrid server itself.

"No Inbound Ports" Does Not Mean "No Network Rules"​

While marketing materials love the phrase "no extra configuration required," veteran firewall engineers know that outbound traffic rarely gets a free pass in locked-down enterprise data centers. According to Microsoft Learn, "no inbound ports" still requires explicit outbound HTTPS (port 443) connectivity from the managed hybrid server to specific Microsoft endpoints:

• *service.waconazure.com (or *.wac.azure.com / *.waconazure.com) or the WindowsAdminCenter Azure service tag
• pas.windows.net
• *.servicebus.windows.net

Additionally, the administrator's management workstation running the web browser must have outbound internet access over TCP port 443. If your server sits behind an outbound proxy, Microsoft Learn notes that the extension supports unauthenticated HTTP/HTTPS proxy configurations (for extension versions above 0.0.0.321), though Microsoft's documentation currently carries a warning that extension versions have experienced issues with proxy configurations and that authenticated proxies are not supported.

Identity and RBAC Nuances​

On the authentication front, the portal integration eliminates the bad habit of passing around local administrator passwords. Authentication is handled entirely through Microsoft Entra ID (formerly Azure Active Directory) and governed by Azure Role-Based Access Control (RBAC).

However, administrators setting up access controls need to pay attention to a subtle permission split documented in Microsoft Learn:

• To deploy/install the extension: Your account must hold the Owner, Contributor, or Windows Admin Center Administrator Login role.
• To connect and manage the server: A user must be assigned both the Reader role and the Windows Admin Center Administrator Login role on the Arc-enabled server resource.
• Scope limitation: Because the Windows Admin Center Administrator Login role relies on Azure dataActions, it cannot be assigned at the Management Group scope. Administrators must assign it at the Subscription, Resource Group, or individual Resource level.

Section Summary: Windows Admin Center for Arc-enabled servers eliminates inbound firewall holes by using an outbound Layer 4 SNI reverse proxy tunnel with local TLS termination and Microsoft Entra ID authentication. However, administrators must still allow specific outbound HTTPS endpoints and assign the Windows Admin Center Administrator Login RBAC role at the subscription level or below.

The Day-to-Day Toolkit and the Extension Catch​

Once connected inside the Azure portal, the interface mirrors the familiar standalone Windows Admin Center console, consolidating tools normally scattered across Server Manager, Device Manager, Task Manager, Hyper-V Manager, and various Microsoft Management Console (MMC) snap-ins.

Wait—an in-browser RDP session inside a tool designed to replace RDP? Yes, and for good reason. While 90 percent of routine maintenance (checking event logs, tweaking registry keys, resizing volumes, or running PowerShell scripts) can be done faster through the native web blades, some legacy line-of-business installers still demand a full graphical desktop. Embedding an HTML5 RDP client directly inside the reverse-proxy session means you can still get full GUI access when cornered, without opening port 3389 on your perimeter firewall.

Marketing Ambition vs. Documentation Reality on Extensions​

In its GA announcement, Microsoft highlights Windows Admin Center as an "extendable platform," noting that on-premises extensions can reach below the operating system to handle hardware inventory, firmware, and driver updates, and stating that Microsoft is "beginning to bring that ecosystem to the portal".

Administrators should read that phrasing carefully: beginning to bring is a roadmap statement, not a guarantee that your favorite OEM hardware extension works in the cloud today. In fact, Microsoft Learn's technical documentation for Windows Admin Center in Azure explicitly notes that third-party or additional Windows Admin Center extensions are not currently supported in the Azure portal, apart from dynamically loading the Virtual Machine and Virtual Switch tools once the Hyper-V role is installed. Furthermore, while the blog marks the feature as generally available as of October 2026, parts of Microsoft Learn's technical reference have lagged behind, still displaying legacy "preview" notices. If your team relies heavily on vendor-specific hardware extensions (such as Dell OpenManage, HPE, or Lenovo integrations), verify their portal compatibility before decommissioning your local management tools.

Critical Deployment Warnings and Step-by-Step Setup​

Before you rush into the Azure portal and start clicking Install across your production server fleet, there is one massive operational landmine buried in Microsoft Learn's documentation that every sysadmin needs to know.

Critical Warning for Existing WAC Users: If you have already manually installed a standalone instance of Windows Admin Center on a hybrid server to act as a local management gateway for multiple on-premises machines, enabling Windows Admin Center in Azure on that host will overwrite and replace your existing installation. Worse, it converts the installation into a single-machine agent, stripping away its ability to manage other servers and cutting off access to your previous deployment. Never enable the Azure portal extension on a machine that serves as your on-premises multi-server Windows Admin Center gateway.

Click to expand...

Prerequisites Checklist​

According to Microsoft Learn, target hybrid servers must meet the following baseline requirements before deployment:

• Operating System: Windows Server 2016 or later (Azure Local is also supported).
• Memory: Minimum of 3 GB of RAM.
• Azure Arc Agent: Connected Machine Agent version 1.13.21320.014 or higher. Crucial caveat: Agent versions 1.35 and 1.36 contain a known bug that breaks connectivity to Windows Admin Center with a 404 endpoint not found error. Ensure your servers are running agent version 1.37 or later (note that if you use the broader Windows Server Management benefits program, Microsoft recommends version 1.47 or higher).
• Cloud & Regional Support: Supported across major public Azure regions (including East US, East US 2, Central US, West US/2/3, North/West Europe, UK South/West, Australia East, Japan East, and others), but not supported in Azure Government, Azure China 21Vianet, or other sovereign/non-public clouds.

How to Deploy and Connect​

1. Verify Resource Provider: In the Azure portal, navigate to Subscriptions > (Your Subscription) > Resource providers. Search for Microsoft.HybridConnectivity and ensure its status is Registered.
2. Navigate to the Server: Open the Azure Arc blade, select Servers, and click on your target Windows Server resource.
3. Install the Extension: Locate Windows Admin Center in the server's navigation menu (listed under the Windows management or Settings group depending on your portal view). Specify the local port for Windows Admin Center (default is typically 6516 or 443) and click Install.
4. Assign Access Roles: Go to Access control (IAM) on the server resource, click Add role assignment, and grant both Reader and Windows Admin Center Administrator Login to the appropriate Microsoft Entra users or security groups.
5. Connect: Return to the Windows Admin Center blade on the Arc-enabled server and select Connect. (Note: Avoid using Google Chrome in Incognito mode or the standalone Azure portal desktop app, as Microsoft lists both as unsupported known issues).

For administrators looking to automate deployment across dozens of machines via PowerShell, Microsoft Learn provides the New-AzConnectedMachineExtension cmdlet targeting the Microsoft.AdminCenter publisher and AdminCenter extension type, paired with Invoke-AzRestMethod calls to configure the Microsoft.HybridConnectivity default endpoint and service configuration for the chosen port.

Quick Troubleshooting Tips​

If a connection fails after installation, Microsoft Learn recommends checking four things directly on the server before opening a support ticket:

• Verify the ServerManagementGateway (Windows Admin Center) service is running in Task Manager or services.msc.
• Restart the Azure Arc Hybrid Instance Metadata Service by running Restart-Service -Name himds in an elevated PowerShell prompt.
• Check that the extension version under the portal's Extensions blade is 0.0.0.169 or higher.
• Run azcmagent config list in PowerShell to confirm your chosen WAC port appears under incomingconnections.ports. If it is missing, register it with azcmagent config set incomingconnections.ports <port>.

Section Summary: Deploying Windows Admin Center via Azure Arc is straightforward, provided your servers have at least 3 GB of RAM, run Windows Server 2016+, and avoid Arc agent versions 1.35 and 1.36. Above all, never deploy the Azure extension onto a server that is already acting as an on-premises multi-system Windows Admin Center gateway, or you will overwrite your existing setup.

The Verdict for Hybrid IT​

By bringing Windows Admin Center for Azure Arc-enabled servers to general availability and untangling it from Software Assurance and pay-as-you-go licensing hurdles, Microsoft has turned a niche cloud perk into a practical default tool for Windows Server administrators. While the extension ecosystem in the portal still has catching up to do and sovereign cloud admins remain left out in the cold, the ability to inspect certificates, run PowerShell, manage Hyper-V guests, and launch emergency RDP sessions over an outbound TLS tunnel—without a VPN or extra licensing fees—is a genuine win for hybrid infrastructure security and convenience.