Windows Server 2025 Hotpatch Requires Azure Arc for On-Prem Servers

Windows Server 2025 Hotpatch outside Azure depends on Azure Arc​

Microsoft's Hotpatch overview limits the feature to three environments: Azure, Azure Local and Azure Arc-connected machines. It describes Hotpatch for Windows Server as using "the Windows Server support and management model on Azure, Azure Local, and Azure Arc-connected machines." Traditional hardware in your own datacenter only fits the third category. According to Microsoft, Azure Arc-connected Windows Server 2025 machines can receive Hotpatches if you enable the feature on Azure Arc Portal.

The May 2026 announcement on Microsoft's Azure Arc blog says the same thing. It states that to use hotpatch for Windows Servers running on-premises or in multicloud environments, "you must be using Windows Server 2025 Standard or Datacenter, and your server must be connected to Azure Arc." Microsoft's enablement guide lists Arc connection as a prerequisite next to the edition, build and firmware requirements. The procedure starts with connecting the machine to Arc and ends with a switch in the Azure portal.

Running on-premises is fine. Microsoft's Windows Server Management documentation lists supported Arc environments as Hyper-V, VMware, SCVMM, Stack HCI, AVS and bare metal, as long as the servers are connected to Azure Arc. A physical Datacenter server qualifies. It just needs a live link to Azure.

"Connected" means a live Arc link, but not necessarily a direct internet path​

The poster's key question was whether the server has to stay connected permanently. Microsoft's documentation doesn't use the word "permanent," but it comes close. Its Windows Server Management overview says an Arc-enabled server must be in Connected status to enroll, that disconnected and expired servers aren't eligible, and that using the included benefits requires connectivity. That page is about the Software Assurance management benefits. Microsoft notes that Hotpatch isn't subject to that page's licensing and billing rules, though it is also delivered through Arc.

For planning, treat Hotpatch as a feature that needs ongoing Arc connectivity, not a one-time activation. Microsoft doesn't publish how long a server can be offline before it loses Hotpatch eligibility. That gap matters for sites with intermittent links. The safe assumption is that the Connected Machine agent must be able to reach Azure routinely.

A connection doesn't have to mean opening servers to the internet. The Azure Connected Machine agent only makes outbound connections over TCP 443. Microsoft lists four supported connection methods: public endpoint, proxy, Azure Arc Gateway and private endpoint. A tightly firewalled datacenter can use these to route Arc traffic through a controlled path. A truly air-gapped network, with no route to Azure at all, is not a supported Hotpatch environment for Standard or Datacenter.

WSUS and Configuration Manager can manage patching, but they don't replace Arc​

The WSUS part of the question needs more care. Microsoft calls Hotpatch an extension of Windows Update and normal management processes. For Arc-connected machines, it lists four ways to install and manage Hotpatch updates: Azure Update Manager, Group Policy configuring Windows Update client settings, SConfig on Server Core, and non-Microsoft patch-management tools. WSUS and Configuration Manager are not named for enrolling a machine. The enablement guide simply says that when a Hotpatch is available from Windows Update, the server should prompt to install it.

So the documented model has two layers. Arc enrollment decides whether a server is eligible for Hotpatch at all. Your update tooling decides when and how updates get installed. Microsoft documents no path where WSUS or Configuration Manager enables Hotpatch on a server that isn't enrolled in Arc. Microsoft also doesn't say WSUS can never deliver a Hotpatch package to a server that is enrolled. The documentation simply doesn't cover that configuration, so test it before you rely on it.

WSUS and Configuration Manager do have documented jobs in an Arc rollout. The Connected Machine agent doesn't update itself, and on Windows its updates come through Microsoft Update. Microsoft says organizations that cache and approve updates with WSUS must have their WSUS admin synchronize and approve the "Azure Connected Machine agent" product. That covers servicing the agent, not the operating system's Hotpatch channel, so don't treat one as proof of the other. Microsoft's Arc security guidance also names Configuration Manager, along with Ansible and Group Policy, as common tools for running the onboarding script across many servers. It recommends protecting the onboarding credential in the script and deleting any configuration file that holds secrets once onboarding finishes.

Datacenter: Azure Edition skips Arc, but it doesn't run on a physical server​

One edition is exempt from the Arc requirement. Microsoft's enablement guide says Windows Server 2025 Datacenter: Azure Edition doesn't need to be Arc-enabled because Hotpatch is on by default, though the other technical prerequisites still apply. Microsoft's Windows Server blog notes that on Azure IaaS or Azure Local, Hotpatch is part of Windows Server Datacenter: Azure Edition, included with both the 2022 and 2025 releases.

This doesn't help the poster. Schneider IT Management describes Azure Edition as "a separate, virtual-only edition that runs as an Azure Infrastructure as a Service (IaaS) virtual machine or on Azure Local." Microsoft's Hotpatch overview lists only specific Azure Marketplace image combinations as supported, and says container base images, custom images, or any other combination of publisher, offer, and SKU aren't supported. A standard Datacenter licence on a rack server in your own building is not Azure Edition, and switching to Azure Edition means running on Azure or Azure Local.

Microsoft dropped the Hotpatch fee in May 2026, but not the requirements​

Many admins remember Hotpatch as a paid add-on. Microsoft made Hotpatching for Windows Server 2025 on Arc-connected machines generally available on July 16, 2025, and moved it to a paid subscription at the same time. After a free public preview, the price was $1.50 USD per CPU core per month.

That fee is gone. Microsoft's Azure Update Manager documentation says that as of May 19, 2026, Hotpatch on Arc-enabled machines running Windows Server 2025 Standard or Datacenter costs nothing extra, with "no per-core meter, no hourly charge, and no separate Hotpatch line item on your invoice." Billing stopped for every server already enrolled. No action is needed, and those machines stay enrolled and keep getting hotpatches. New enrollments are free on any underlying platform, including VMware, Hyper-V, AWS, GCP and other on-premises or multicloud setups, on both Standard and Datacenter. One third-party write-up, from Schneider IT Management, gives May 15, 2026 as the date. Microsoft's own documentation and blog say May 19.

Schneider sums up the change: "The change is commercial, not functional. The hotpatching service and its update mechanism stay the same." The free price only applies to Arc-enabled servers. It does nothing for an isolated network. It does remove the old per-core cost argument against Arc for servers that can reach Azure.

The technical prerequisites from Microsoft's enablement guide also still apply:

Insider builds aren't supported because Microsoft doesn't produce hotpatches for prerelease operating systems. Keep that in mind, since the question was posted in the Insiders forum.

Hotpatch reduces Windows Server 2025 reboots, but doesn't eliminate them​

The poster's goal was to avoid monthly reboots on production servers. Hotpatch helps, but not every month. It works by patching the in-memory code of running processes, so those processes don't need to restart. The schedule is built around baselines. A baseline is a normal cumulative update that needs a restart, released roughly every three months. Hotpatch releases fill the two months after it. Microsoft says a typical year could have four planned baselines and eight Hotpatch months.

Two things break that pattern. Microsoft issues an unplanned baseline when an urgent fix, such as a zero-day patch, can't be shipped as a hotpatch. That month's hotpatch is replaced with a restart-required cumulative update, and Microsoft says these can't be predicted. Some updates are also outside Hotpatch entirely: non-security Windows updates, .NET updates, and non-Windows updates such as drivers and firmware. If you install those during a Hotpatch month, the server still needs a restart.

When this was written, Microsoft's Windows Server release calendar for 2026 showed how often unplanned baselines interrupt the pattern. Hotpatch months were February, March, May and August. January and April were baselines, and June, July, September and October were also listed as baselines. November and December are planned Hotpatch months. Budget for fewer no-reboot months than the four-plus-eight ideal suggests.

October 2025 also showed that Hotpatch eligibility can break. Microsoft's enablement guide records that some October 2025 updates, including out-of-band update KB5070881 (OS Build 26100.6905), left machines unable to take the next hotpatches. Those servers fell back to monthly reboot-required updates until the January 2026 baseline. In the same month, a feature-licensing bug could leave new Hotpatch enablements stuck "In Progress" and let existing Hotpatch licences expire. Microsoft published a workaround that itself needed a reboot. The guide now says all past issues are mitigated.

Rollback also works differently. Hotpatch updates don't roll back automatically. If a hotpatch causes a problem, Microsoft's fix is to uninstall the latest update and reinstall the last working baseline, which means a restart.

Enabling Hotpatch on an on-premises Windows Server 2025 Datacenter server​

Microsoft documents this procedure for Arc-enabled Standard and Datacenter servers. It assumes the server can reach Azure through one of the supported connection methods.

Confirm Virtual Secure Mode is running​

1. In an elevated PowerShell session, run Get-CimInstance -Namespace 'root/Microsoft/Windows/DeviceGuard' -ClassName 'win32_deviceGuard' | Select-Object -ExpandProperty 'VirtualizationBasedSecurityStatus'.
2. An output of 2 means VSM is configured and running, so skip to enrollment. VSM may already be on if you use Credential Guard, HVCI (Hypervisor-protected code integrity) or Secured-core server, because each of those features turns it on.
3. If the output isn't 2, set the EnableVirtualizationBasedSecurity DWORD to 1 under HKLM:\System\CurrentControlSet\Control\DeviceGuard, then restart. Plan a maintenance window for this reboot.
4. Run the check again after the reboot. If it still doesn't return 2, Microsoft says the most likely cause is hardware or virtualization-platform requirements that aren't met, such as missing UEFI Secure Boot or a Generation 1 Hyper-V VM.

The Azure portal checks VSM when you enable Hotpatch and fails the enablement if VSM isn't running. Checking first saves a failed attempt.

Connect to Arc and enable Hotpatch​

1. Install the Azure Connected Machine agent and connect the server to Azure Arc if it isn't connected already. Tools like Configuration Manager or Group Policy can run the onboarding script across many servers.
2. In the Azure portal, go to Azure Arc, then Machines, and select the server.
3. Select Hotpatch, then Confirm.
4. Wait about 10 minutes. If the status stays at Pending, Microsoft's next step is troubleshooting the Arc agent.

After that, the server prompts to install hotpatches as Windows Update offers them. You can use Azure Update Manager to assess machines, schedule or run installations, filter updates by classification or KB number, and see reboot status and update history. The Group Policy, SConfig and third-party options from the orchestration list are also available.

What this means for you​

If you want Hotpatch on physical or on-premises Standard or Datacenter servers, first decide whether those servers can keep a supported, ongoing connection to Azure Arc. If they can, the fee is gone and the rest is technical prerequisites. If they can't, keep planning around standard cumulative updates and regular reboot windows. Microsoft documents no offline or WSUS-only Hotpatch route for those editions.

• On-premises Windows Server 2025 Standard and Datacenter can only get Hotpatch through Azure Arc enrollment, and the server must show as Connected to enroll.
• Arc traffic runs outbound over TCP 443 and can go through a proxy, Azure Arc Gateway or private endpoint, which suits firewalled networks but not fully air-gapped ones.
• WSUS can service the Azure Connected Machine agent once an admin approves that product, and Configuration Manager can deploy the onboarding script, but Microsoft documents neither as a replacement for Arc enrollment.
• Datacenter: Azure Edition includes Hotpatch without Arc, but it's a virtual-only edition for Azure IaaS and Azure Local, not a fix for physical servers.
• Check for build 26100.1742 or later, UEFI with Secure Boot, and a VBS status of 2 before enrolling, and plan a reboot if VSM has to be turned on.
• Plan for restart-required baselines at least quarterly, plus unplanned baselines and restarts for .NET, driver, firmware and non-security updates. In 2026, only February, March, May and August have been Hotpatch months so far.

Microsoft's free pricing since May 2026 has removed the cost objection to Hotpatch on on-premises Windows Server 2025. The connectivity requirement remains, and that is the deciding factor for the forum poster. If Arc can reach the production servers through a proxy, gateway or private endpoint, Hotpatch can cut routine security reboots on physical hardware. If the network has to stay isolated, WSUS and Configuration Manager will keep doing the patching the traditional way. November and December 2026 are the next planned Hotpatch months on Microsoft's calendar, so servers enrolled before then will be ready for the next no-reboot cycle.