What Azure Arc Is and Why Licensing Matters
Azure Arc is Microsoft's hybrid and multi-cloud management platform. It extends Azure management capabilities — Azure Resource Manager, Azure Policy, Microsoft Defender for Cloud, Azure Monitor, and Azure automation — to resources running outside of Azure: on-premises servers, edge environments, AWS EC2 instances, and Google Cloud VMs.
The Arc architecture has two distinct layers. The first is the Arc agent (Connected Machine Agent) — a lightweight agent installed on servers that registers them with Azure and enables management through Azure Resource Manager. This layer is genuinely free. There is no charge for connecting servers, Kubernetes clusters, or SQL Server instances to Arc, and there is no charge for using Azure Policy, Azure Resource Graph, or Azure Monitor to view and manage those resources.
The second layer is Arc-enabled services — Azure PaaS services and security products that run on Arc-connected infrastructure. These services carry standard Azure consumption pricing. This is where the costs materialise, and where organisations that deployed Arc broadly based on "it's free" messaging encounter budget surprises at the monthly Azure bill.
The commercial framing error: Microsoft's sales and marketing consistently positions Azure Arc as a free investment. It is free in the same way that Azure itself is free — the platform has no flat fee, but every service you run on it has a consumption cost. The correct question is not "does Arc cost money?" but "which Arc-enabled services will we deploy, at what scale, and what will those services cost per month?"
Free vs Paid: The Complete Arc Capability Map
| Capability | Cost | Notes |
|---|---|---|
| Arc Connected Machine Agent (servers) | Free | Onboard any Windows/Linux server; Azure Resource Manager registration at no cost |
| Azure Resource Graph | Free | Query and inventory Arc resources; first 1M records free then £0.0007/record |
| Azure Policy (guest configuration) | Free up to 5 policies/server/month | First 5 policy assignments free; beyond: ~£0.40/server/month per assignment above 5 |
| Azure Arc-enabled Kubernetes | Free for connectivity | GitOps configuration and Azure Policy for Kubernetes add consumption charges |
| Azure Monitor (basic metrics) | Free (basic telemetry) | Log Analytics ingestion and custom metrics carry standard Monitor pricing |
| Microsoft Defender for Cloud (free tier) | Free | Basic CSPM recommendations for Arc-connected resources; Defender Plans (P1/P2) carry per-server fees |
| Arc-enabled SQL Server (inventory + ESU) | Free for inventory; ESU charges apply | Connecting SQL Server instances is free; Extended Security Updates via Arc have per-core fees |
| Azure Arc-enabled SQL Managed Instance | Paid — per vCore/hour | General Purpose: ~£0.046/vCore/hr; Business Critical: ~£0.165/vCore/hr |
| Azure Arc-enabled Data Services (PostgreSQL) | Paid — per vCore/hour | Hyperscale (Citus) pricing; varies by deployment model |
| Azure Arc-enabled App Services | Paid — standard App Service pricing | Runs standard App Service SKUs on Arc infrastructure; Azure infrastructure costs apply |
| Defender for Servers Plan 1 (via Arc) | ~£0.007/server/hour | ~£5.04/server/month; endpoint protection (MDE integration) + vulnerability assessment |
| Defender for Servers Plan 2 (via Arc) | ~£0.013/server/hour | ~£9.36/server/month; includes 500 MB/day free Log Analytics, JIT, adaptive controls |
Azure Arc Extended Security Updates (ESU)
This is the Arc cost driver that catches most enterprises off-guard. Microsoft's Extended Security Updates programme allows organisations to receive security patches for end-of-support products — primarily Windows Server 2012/2012 R2 and SQL Server 2012 — beyond their official support end dates. Without Arc, ESU requires per-server annual licences purchased through volume licensing at significant cost. Through Arc, ESU is delivered as an Azure consumption service.
ESU Pricing Through Arc
Arc-delivered ESU pricing is per core per month, using the same core-based licensing model as the traditional ESU programme:
- Windows Server 2012/2012 R2 ESU (Year 3 — through October 2026): Approximately £0.067/core/hour or the equivalent annual rate based on core count. For a 16-core server, this is approximately £940/month or £11,280/year — 75% of a new Windows Server Standard licence annually, for a system that may be approaching decommission.
- SQL Server 2012 ESU (through July 2025 — now expired): ESU for SQL Server 2012 ended in July 2025. Any SQL Server 2012 instances still running without migration are now outside security support entirely.
- Windows Server 2012 ESU (through October 2026): Year 3 pricing applies from October 2025. ESU ends in October 2026 — after which there is no patch delivery mechanism available regardless of Arc connectivity.
ESU hard stop: Arc-delivered ESU extends support only as long as Microsoft offers the ESU programme for that product. Windows Server 2012 ESU ends in October 2026 with no further extension options. Organisations using Arc ESU as a migration deferral strategy need a credible migration plan in place before October 2025 to complete migrations before the ESU hard stop. ESU is a bridge, not a destination.
ESU vs Migration: The Cost Decision
The correct analysis for Windows Server 2012 workloads running on Arc ESU:
| Option | Annual Cost (16-core server) | Duration Available | Risk |
|---|---|---|---|
| Continue ESU via Arc (Year 3) | ~£11,280/year | Until October 2026 only | Hard stop October 2026; no further extension |
| Migrate to Azure VM (Windows Server 2022) | ~£3,600–8,400/year (D4s v3 typical) | Supported until 2031+ | Migration project cost; timing dependency |
| Upgrade on-premises (WS2022) | ~£4,200/year (SA) or £6,900 perpetual | Supported until 2031+ | Hardware refresh required if old hardware; on-premises capex |
| Decommission workload | £0 | Immediate | Application dependency analysis required |
Have Windows Server 2012 or SQL Server workloads still on ESU? We have modelled migration vs ESU cost decisions for 50+ enterprise estates. Get an independent analysis before October 2026.
Get an ESU Migration Review →Arc-Enabled SQL Managed Instance: The PaaS Cost Model
Azure Arc-enabled SQL Managed Instance is a full managed SQL Server experience that runs on your own infrastructure — on-premises, edge, or another cloud — while being managed through Azure. It is the most significant new cost category in Arc for data-heavy enterprises.
Pricing Structure
Arc SQL MI pricing is per vCore per hour. Two service tiers:
- General Purpose: ~£0.046/vCore/hour (standard storage, SLA applicable)
- Business Critical: ~£0.165/vCore/hour (Always On availability groups, higher SLA)
For a General Purpose instance with 8 vCores running continuously, the monthly cost is approximately £266/month, or £3,192/year. This is the vCore cost only — your on-premises infrastructure (servers, storage, networking) is not included in this charge.
Azure Hybrid Benefit for Arc SQL MI
This is one of the most commercially significant cost offsets for Arc SQL MI deployments. If you have existing SQL Server licences with active Software Assurance, you can apply Azure Hybrid Benefit to Arc SQL MI — covering the Azure licence component of the Arc MI cost. In practice, this means organisations with large SQL Server SA estates can run Arc SQL Managed Instance at a material discount versus organisations purchasing Arc MI without existing SA coverage.
The AHUB discount for Arc SQL MI varies by vCore count and SA status, but can reduce the effective Arc MI cost by 55–75% for fully SA-covered estates. Before any Arc SQL MI deployment discussion, audit your SQL Server licence estate and SA status. See our SQL Server Azure Hybrid Benefit guide for the full AHUB methodology.
Defender for Cloud and Arc: The Security Cost Model
Microsoft Defender for Cloud integrates deeply with Azure Arc — Arc connectivity enables Defender for Cloud coverage of on-premises and multi-cloud servers through the same portal and policy framework as Azure VMs. The cost model mirrors Defender for Servers pricing:
Defender for Cloud Free Tier (Foundational CSPM)
The free CSPM (Cloud Security Posture Management) tier is available for all Arc-connected resources at no cost. This includes security recommendations, secure score calculation, regulatory compliance views, and asset inventory. For organisations whose primary Arc use case is visibility and governance rather than active threat protection, the free tier may be sufficient.
Defender for Servers Plan 1 vs Plan 2 on Arc
The cost difference between Plan 1 (~£5/server/month) and Plan 2 (~£9.36/server/month) is driven primarily by the Log Analytics ingestion inclusion in Plan 2 (500 MB/day free Sentinel ingestion per server) and the JIT (Just-In-Time) VM access, adaptive application controls, and file integrity monitoring in Plan 2.
For organisations running Microsoft Sentinel, the Plan 2 500 MB/day free Log Analytics ingestion is often the determining factor — if the server generates more than 250–300 MB/day of security log data, Plan 2 is cheaper than Plan 1 plus the incremental Log Analytics cost. See our Microsoft Sentinel licensing guide for the full ingestion cost analysis.
Azure Arc and MACC: Does It Count?
This is a frequently misunderstood point in Arc commercial planning. Azure Arc-enabled services that run as Azure consumption charges — SQL MI vCore hours, Defender for Servers fees, Log Analytics ingestion, App Service instances — all count toward your Azure MACC (Monetary Azure Consumption Commitment). The Arc connectivity itself generates no consumption and therefore no MACC draw-down.
The commercial implication: organisations with large Azure MACCs should include projected Arc-enabled service consumption in their MACC sizing. An organisation deploying Arc SQL MI across 100 database instances at £3,192/year each adds £319,200/year of Azure consumption that draws down the MACC. This is relevant for MACC sizing negotiations — either as additional volume that helps you hit your MACC commitment, or as unexpected consumption that may help you avoid MACC penalties if you have been running underspent.
For more on MACC mechanics and negotiation see our Azure MACC negotiating leverage guide.
Building an Arc Business Case or Cost Model?
Arc deployments that start free often cross material cost thresholds within 6–12 months as Arc-enabled services are progressively adopted. We build independent Arc cost models that include full lifecycle costs — ESU, SQL MI, Defender, and Log Analytics — before the first server is onboarded.
Request an Arc Cost Review → Download the Azure Cost GuideEA Negotiation Strategy for Azure Arc
1. Arc as Azure MACC Volume
Arc-enabled service consumption is Azure consumption. Use planned Arc deployments (SQL MI, Defender for Servers, ESU) as part of the justification for an Azure MACC commitment at renewal — and negotiate the MACC rate to include projected Arc consumption. This is a two-way lever: it increases your MACC commitment (which Microsoft wants) while securing better per-unit rates on the Arc services you will consume.
2. SQL Server SA and AHUB Leverage
If your organisation has a significant SQL Server SA estate and is considering Arc SQL Managed Instance, the AHUB discount creates a direct commercial link between your Software Assurance renewal and your Arc SQL deployment costs. Negotiate SA renewal timing and pricing with Arc SQL AHUB benefits in the model. Organisations that drop SA without understanding the AHUB impact on planned Arc SQL MI deployments create an avoidable cost increase.
3. Defender for Cloud Negotiation
Defender for Servers (Plan 1 and Plan 2) pricing is negotiable within an EA context, particularly when combined with broader E5 Security or Microsoft Defender XDR commitments. Use the total Defender deployment — Azure VMs, Arc servers, on-premises servers — as a unified negotiating position rather than treating Arc server protection as a separate line item. Volume discounts of 15–25% below published rates are achievable for deployments above 500 servers.
4. ESU Migration Timing
If your organisation is using Arc ESU as a bridge, ensure your EA renewal negotiation includes provisions for the migration that will follow ESU expiry. Specifically: negotiate Azure Hybrid Benefit rights for the VMs that will replace your Windows Server 2012 workloads, and negotiate any migration assistance or Azure credits that can be applied during the transition period. The October 2026 ESU deadline creates a defined commercial event that Microsoft's account team will use — use it yourself as leverage for favourable migration terms.
Common Arc Licensing Mistakes
- Treating Arc connectivity as a cost proxy: Free connectivity does not mean free operations. Always model the Arc-enabled service costs (Defender, SQL MI, ESU, Log Analytics) before approving broad Arc deployment.
- Missing the AHUB opportunity on Arc SQL MI: Organisations with SQL Server SA frequently deploy Arc SQL MI at full vCore pricing without applying AHUB. This can represent 55–75% overpayment on a significant line item.
- Relying on ESU without a migration roadmap: ESU ends in October 2026 for Windows Server 2012 — with no extension. Treating ESU as a permanent solution creates a compliance and security exposure in 2026 with no available remedy.
- Not counting Arc consumption toward MACC: Arc service consumption counts toward Azure MACC. If your MACC is underspending, Arc deployments may be the most efficient way to utilise committed Azure spend before the commitment period ends.
- Enabling Defender for Servers broadly without assessing Log Analytics needs: Plan 2 is cheaper than Plan 1 + Log Analytics only when the server generates sufficient log volume. Run the numbers for each server category rather than applying blanket Plan 2.
Related Azure and Hybrid Licensing Guides
- Azure Hybrid Benefit Guide — AHUB for Windows Server, SQL Server, and Red Hat across Azure and Arc
- SQL Server AHUB Strategy — maximising hybrid benefit for SQL Server deployments
- SQL Server: Azure vs On-Premises — when to migrate and when to stay on-premises
- Azure Cost Optimisation Complete Guide — the master Azure cost reduction framework
- Microsoft Sentinel Licensing Guide — Sentinel and Defender integration with Arc
- Azure MACC Negotiating Leverage — how Arc consumption integrates with MACC strategy
Planning an Arc Deployment or ESU Migration?
We have provided independent Arc cost modelling and ESU migration commercial advice to enterprise clients across financial services, manufacturing, and government. Most Arc cost surprises are avoidable with upfront modelling — let us build yours before deployment begins.
Get an Independent Arc Review → View Client Results