Deploy various agents on AzureArc managed Windows server

Question

Deploy various agents on AzureArc managed Windows server

HAL9000 26

Hi all,

Is anyone else managing a number of Windows Azure Arc-enabled server VMs that require installation various third-party agents, such as ServiceNow, CrowdStrike, and similar tools?

We do not have SCCM in our environment, so I’m interested in understanding what options others are using for this type of application deployment and ongoing management.

I’d really appreciate your thoughts, recommendations, or any lessons learned.

Thanks in advance.

Bharath Y P 10,355 Reputation points Microsoft External Staff Moderator

2026-07-04T23:13:57.8866667+00:00

Hello HAL900, Just checking if the information shared was helpful. If so, please consider accepting the answer and giving it an upvote.

If you have any further questions or need additional clarification, feel free to reach out. Thanks!
Bharath Y P 10,355 Reputation points Microsoft External Staff Moderator

2026-07-05T22:50:47.19+00:00

Hello HAL900, Just checking if the information shared was helpful. If so, please consider accepting the answer and giving it an upvote.

If you have any further questions or need additional clarification, feel free to reach out. Thanks!

2 answers

Your answer

Bharath Y P 10,355 Reputation points Microsoft External Staff Moderator

2026-07-04T23:13:57.8866667+00:00

Hello HAL900, Just checking if the information shared was helpful. If so, please consider accepting the answer and giving it an upvote.

If you have any further questions or need additional clarification, feel free to reach out. Thanks!
Bharath Y P 10,355 Reputation points Microsoft External Staff Moderator

2026-07-05T22:50:47.19+00:00

Hello HAL900, Just checking if the information shared was helpful. If so, please consider accepting the answer and giving it an upvote.

If you have any further questions or need additional clarification, feel free to reach out. Thanks!

Answer 1

Hello HAL900, IT looks like you’re looking to push out ServiceNow, CrowdStrike and other third-party agents to your fleet of Arc-enabled Windows servers without SCCM. A few patterns folks use are:

VM Extensions (Custom Script or Partner Extensions)
- Use the Azure Custom Script extension to run your install scripts at scale. You can bake your PowerShell or installer calls into a simple JSON payload and push it with New-AzConnectedMachineExtension.
- If a vendor provides an official VM extension (e.g. Datadog, Dynatrace), you can install that directly instead of Custom Script.
Azure Automation Hybrid Runbook Workers
- Onboard your Arc servers as extension-based Hybrid Workers.
- Author a runbook that downloads and runs each agent’s installer, then target it at your Hyper Worker group on a schedule or ad-hoc.
- You get built-in retry, credential assets, and centralized logging.
Desired State Configuration / Machine Configuration
- Author a DSC or Machine Configuration package that ensures your agents are installed.
- Assign it via Azure Automanage Machine Configuration (the successor to Automation DSC). This continually audits and remediates any drift.
Azure Policy Guest Configuration
- Define a Guest Configuration policy that checks for a registry entry, file, or service, and then deploys a remediation script if it’s missing.
- Scope it to your Arc machines so it runs automatically whenever a server joins.
GitOps or Custom Automation
- If you’re already using GitOps (Flux, Argo), you can store your install scripts in a repo and let your preferred operator push them down.
- Or use Azure CLI / ARM templates to loop through your Arc VMs and deploy extensions in a one-time push.

Hope this helps! Thanks

References:

https://learn.microsoft.com/azure/azure-arc/servers/manage-vm-extensions

https://learn.microsoft.com/azure/automation/automation-hybrid-runbook-worker

https://learn.microsoft.com/azure/automation/extension-based-hybrid-runbook-worker-install

https://learn.microsoft.com/azure/governance/machine-configuration/overview

https://learn.microsoft.com/azure/azure-arc/servers/azure-monitor-agent-deployment

Answer 2

I tend to leverage Azure Policy for consistent enforcement and Custom Script Extensions for remote installation and automation. Azure Policy combined with Machine Configuration tends to work fairly well.

Another approach involves tools such as Ansible or Chef, especially outside of the traditional Microsoft endpoint management ecosystem. Ansible playbooks can be used to push software packages, enforce desired configurations, and manage ongoing updates for Arc-enabled servers.

For traditional Active Directory-joined Windows environments, you can rely on Group Policy.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin