Azure Arc
A Microsoft cloud service that enables deployment of Azure services across hybrid and multicloud environments.
Hello Bezerra,
Before the extension itself: check the OS requirement for your end goal
Your machine runs Windows 11 Enterprise. The managed identity documentation for SQL Server enabled by Azure Arc states:
"The managed identity setup for Microsoft Entra authentication is only supported with Azure Arc-enabled SQL Server 2025, running on Windows Server."
So even after the extension provisions, Use a primary managed identity isn't a supported configuration on a Windows 11 client. For that goal, you need SQL Server 2025 on Windows Server (Arc-enabled). The troubleshooting below still applies for getting the extension to Succeeded.
Why the extension stays in Creating
The key clue in your post: there's no local folder, log entry or GuestConfig trace for 1.1.3579.481 at all. That means the request never reached the machine's extension manager, or the manager refused it before downloading. The SQL extension itself never ran, so the SQL-side logs (unifiedagent.log) won't show anything for it. Look at the Arc agent layer instead, in this order.
1. Check whether the agent is allowed to install it
Run in an elevated prompt on the machine:
azcmagent version
azcmagent config list
Check:
-
config.modemust be full. In monitor mode, only monitoring/security extensions can be installed, and others are refused. -
extensions.enabledmust be true. -
extensions.allowlist/extensions.blocklistmust not excludeMicrosoft.AzureData/WindowsAgent.SqlServer.
An extension that was installed before an allow/block list or monitor mode was set stays installed. New installs and upgrades are refused, though. That matches what you see: 1.1.3453.436 kept running, but 1.1.3579.481 never arrived. Also update the Connected Machine agent if it isn't current. Newer extension versions can depend on a newer agent.
2. Read the extension manager log, not the SQL log
C:\ProgramData\GuestConfig\ext_mgr_logs\gc_ext.log. Search for WindowsAgent.SqlServer around the time of the latest attempt. Look for blocked / not allowed, download, signature or timeout entries. If the manager received the request, the reason it stopped will be here.
With agent 1.41 or later you can also test the SQL extension's additional endpoints. azcmagent check without parameters only covers the core Arc endpoints:
azcmagent check --extensions sql --location australiaeast
3. Clean reset on both sides, then a pinned-version test
# Azure side: remove the stuck resource (as you did), then on the machine:
azcmagent extension list
azcmagent extension remove --name WindowsAgent.SqlServer # removes leftover local state if listed
Restart-Service ExtensionService, GCArcService
Then reinstall with the previously working version, with auto-upgrade off:
az connectedmachine extension create \
--machine-name <machine> --resource-group <rg> --location australiaeast \
--name WindowsAgent.SqlServer --publisher Microsoft.AzureData --type WindowsAgent.SqlServer \
--type-handler-version 1.1.3453.436 --enable-auto-upgrade false
- The old version provisions: the problem is specific to delivering 1.1.3579.481 to this machine. Include that result in a support case, because it narrows things down a lot.
- The old version also hangs in Creating: the problem is in the agent / extension manager (step 1 or 2), not the SQL extension.
4. Then the managed identity setting
Once the extension shows Succeeded, the portal warning ("currently processing a request") clears and the setting becomes editable. As noted at the top, though, the managed identity setup is supported only on Windows Server. The managed identity docs also require the latest Azure Extension for SQL Server, so pinning the old version is a diagnostic step only.
Note: the post includes the machine and resource group names. You may want to edit them out.
References: Extension security on Azure Arc-enabled servers (allowlist, monitor mode) · Troubleshoot Azure extension for SQL Server deployment · Managed identity for SQL Server enabled by Azure Arc