Use Azure Policy to manage Extensions Allow- and Blocklist on Azure Arc Connected Machines

Question

Is there a way to manage Extensions Allow- and Blocklist for Azure Arc Connected Machines?
As mentioned in this KB-Article, it should be possible. But it is not precisely stated, if this works only for Azure VMs, or if this also applies for Arc Connected Machines / VMs hosted On-Premises.
It seems, that you can only manage these Extensions for Azure VMs, not for On-Premises VMs.

I found the following Built-In Policy, but this Policy can't be applied to Arc Connected Machines:
https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fc0e996f8-39cf-4af9-9f45-83fbde810432

Answer 1

Hi Lukas Berger

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Currently, Azure Policy does not fully support managing extensions for Azure Arc-connected machines in the same way it does for Azure VMs. The built-in policies intended for Azure VMs do not apply to Arc-connected machines, which means that even if you apply these policies, they won't reflect any compliance status for the Arc machines.

It's crucial to ensure that the policy is applied to the correct scope where your Arc machines reside (management group, subscription, or resource group). The correct target resource type for Azure Arc servers is "Microsoft.HybridCompute/machines.

You can use these tools to manage extensions on your Arc-connected machines effectively. The Azure Connected Machine Agent allows you to control extensions directly, even if the Azure Policy does not apply.

If necessary, you can create custom policies tailored specifically for your Arc-connected machines. This approach allows you to define specific controls that align with your organization's security requirements.

https://learn.microsoft.com/en-us/azure/azure-arc/servers/manage-vm-extensions
https://learn.microsoft.com/en-us/azure/azure-arc/servers/security-overview?WT.mc_id=modinfra-100794-socuff
https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/extensions-rmpolicy-howto-ps#create-the-policy

let us know if any help, we will always help as you needed.!

Please do not forget to "Accept the answer” and upvote it wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.

Answer 2

Yes, you are correct. The policy you found is only applicable to Azure VMs and cannot be applied to Azure Arc Connected Machines or VMs hosted on-premises. Currently, there is no built-in policy available to manage extensions allow- and blocklist for Azure Arc Connected Machines. However, you can use Azure Arc to onboard your on-premises machines to Azure and then apply the built-in policy to manage extensions allow- and blocklist for those machines. Alternatively, you can create a custom policy to manage extensions allow- and blocklist for Azure Arc Connected Machines. Let me know if you need any further assistance.