Manage windows defender firewall through Azure Arc?

Question

Manage windows defender firewall through Azure Arc?

Samynathan, Jayavishnu 10

Is it possible to use Azure Arc to manage windows defender firewall enablement and inbound/outbound rules using Azure Arc? This is only for windows server infra.

Based on the documentation; this is possible using 'Guest Assignments' within Arc. However, there is no documentation available that extensively talks about the configuration aspect.

0 comments

1 answer

Your answer

Answer 1

Alex Burlachenko 25,030 MVP Volunteer Moderator

Samynathan, Jayavishnu hi & thx for sharing urs issue here at Q&A portal,

Yes, but not in the same way as Group Policy or Intune. Azure Arc itself doesn't provide a dedicated UI for managing Windows Defender Firewall rules. The supported approach is to use Azure Policy Guest Configuration (Guest Assignments) or machine configuration to audit/enforce the desired state on Arc-enabled servers. For more complex firewall management, people typically use one of these approaches Azure Policy + Guest Configuration (for compliance/drift detection) & PowerShell DSC through Azure Machine Configuration & Azure Automation / Update Manager with PowerShell scripts & Group Policy if the servers are domain-joined https://learn.microsoft.com/azure/governance/machine-configuration/overview + https://learn.microsoft.com/azure/azure-arc/servers/overview

If your goal is to centrally manage inbound/outbound firewall rules across Windows Servers, I'd lean toward Azure Machine Configuration + DSC rather than Guest Assignments alone. Guest Assignments are great for checking and enforcing compliance, but they're not intended to be a full firewall management experience. I'd be interested to hear from the Arc product team whether they have a built-in Guest Configuration package for Windows Defender Firewall, or whether the expected approach is to author a custom Machine Configuration policy.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

and at my blog https://ctrlaltdel.blog/

Samynathan, Jayavishnu 10

@Alex Burlachenko
Thank you for your detailed response.

---- Detailed requirement and info below ---- Please review and provide your suggestion.

Requirement: Exploring Azure Arc for Windows Defender Firewall Management for On-Prem servers that are currently being managed through GPO.

>>> Current State

• Windows Defender Firewall is not enabled on servers.

• Server configurations are primarily managed through Group Policy Objects (GPOs).

• Windows Defender Firewall is enabled on user workstations and managed through Intune via Tenant Attach.

Customer Intent

• Customer does not want to use Intune for server management.

• All servers are currently onboarded to Azure Arc; so they want to manage Windows Defender Firewall settings for their server infrastructure through Azure Arc.

Options and Challenges

• Intune Tenant Attach: Managing and enabling Windows Defender Firewall settings on servers through Intune (Tenant Attach) is not a feasible option, as it requires either Co-Management or full Intune enrollment. 

• Azure Arc: Feasibility being explored. 

• GPO: Least preferred option.

Planned Approach

Customer would like to evaluate whether Azure Arc can be used to manage Windows Defender Firewall settings for servers. If Azure Arc does not provide the required capability, the customer will continue managing firewall settings through existing GPO-based configurations.

Samynathan, Jayavishnu 10

@Alex Burlachenko

Thank you for your detailed response.

Elaborating the context of our requirement below. This is for on-prem windows servers that are already domain joined and managed through GPO.

All servers are Azure Arc joined as well. This is particularly used for Defender for cloud for 2012 versions.

--- Current State ---

• Windows Defender Firewall is not enabled on servers.

• Server configurations are primarily managed through Group Policy Objects (GPOs).

• Windows Defender Firewall is enabled on user workstations and managed through Intune via Tenant Attach.

--- Customer Intent ---

• Customer does not want to use Intune for server management.

• All servers are currently onboarded to Azure Arc; so they want to manage Windows Defender Firewall settings for their server infrastructure through Azure Arc.

--- Options and Challenges ---

• Intune Tenant Attach: Managing and enabling Windows Defender Firewall settings on servers through Intune (Tenant Attach) is not a feasible option, as it requires either Co-Management or full Intune enrollment. 

• Azure Arc: Feasibility being explored. 

• GPO: Least preferred option.

--- Planned Approach ---

Customer would like to evaluate whether Azure Arc can be used to manage Windows Defender Firewall settings for servers. If Azure Arc does not provide the required capability, the customer will continue managing firewall settings through existing GPO-based configurations.

Alex Burlachenko 25,030 Reputation points MVP Volunteer Moderator

2026-07-10T12:03:16.26+00:00
Dear Samynathan, Jayavishnu, thanks for the additional context. That makes the requirement much clearer.

Based on what u've described, I don't believe Azure Arc currently provides a native replacement for GPO or Intune to centrally manage Windows Defender Firewall policies (enablement, inbound/outbound rules) across domain-joined Windows Servers. Azure Arc Machine Configuration can audit and enforce configuration, and you could build a custom policy/DSC configuration to enable the firewall or enforce specific rules. But that isn't the same management experience as GPO, and there isn't a built-in firewall management solution in Arc today. So if the goal is centralized day-to-day firewall policy management without using Intune, GPO is still the supported and most practical option for domain-joined servers.

If anyone from the Azure Arc product team can confirm that there's now a native Arc-based firewall management capability beyond custom Machine Configuration/DSC, I'd be interested to hear about it.

rgds, Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

and at my blog https://ctrlaltdel.blog/