Intune managed and Azure Arc server for Entra ID only authentication

Yep - you can deploy a standalone, non-domain-joined Windows Server 2025 as a dedicated management server, but you should not plan to Entra ID join it or manage it through Intune in the same way as a Windows 10/11 client. Windows Server does not support general-purpose Intune MDM enrollment and management.

A standalone Windows Server 2025 is suitable for your requirement. It can remain outside the company.com AD domain, while its Windows Firewall can be configured so that administrative access to the management server is tightly restricted. You can make this server the controlled origin for administrative connections, PowerShell remoting, scripts, AD administration, and access to the backup infrastructure.

The Azure Arc agent is appropriate for this scenario. You can onboard the standalone Server 2025 into Azure Arc without joining it to company.com. Arc gives you an Azure representation of the server and allows capabilities such as Azure Policy, Run Command, update management, monitoring, and other Azure management functions. Arc therefore provides the cloud management plane without requiring the server to become an AD member.

Intune would not be part of the architecture as the management mechanism for Server 2025. Intune MDM is designed primarily for supported Windows client operating systems such as Windows 10/11. There are some Microsoft security-management scenarios involving Defender for Endpoint and Arc-enabled servers, where security policies such as Defender Antivirus and Firewall settings can flow through Microsoft security management, but that is not equivalent to full Intune MDM management of Windows Server.

You can still use the standalone server to manage the company.com AD environment. Install the appropriate AD management tools/RSAT and PowerShell modules, provide network connectivity to the domain controllers, and use appropriately delegated AD credentials. The server itself does not need to have a computer account in company.com to administer AD objects. Operations against AD can be performed using alternate credentials, with the exact authentication mechanism depending on the operation and management protocol.

The same principle applies to your servers, workstations, and backup infrastructure. The management server can be outside the production AD domain while having tightly controlled network access to the systems it manages. You can configure firewall rules so that management protocols such as PowerShell remoting, WinRM, RDP, SMB, LDAP/LDAPS, or other required protocols are accepted only from the management server or its dedicated management network.

For your stated objective, I would therefore use an architecture along these lines:

Standalone Windows Server 2025 → Azure Arc → Azure management/security services

and separately:

Management Server → restricted network connections → company.com domain controllers, servers, workstations, and backup infrastructure

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin