Hybrid management · Windows Server · SQL Server · Evidence-driven validation

On-premises Windows and SQL Server resources connected to Azure Arc.

Onboarded HVHOST01 and VMM01 from a personal Proxmox/QEMU lab into a bounded Azure resource group, validated the Connected Machine agent, completed SQL Server discovery on VMM01, and verified the SQL extension, licensing choice, telemetry state, and current limitations with fresh evidence.

Review the verified state Inspect screenshots Return to the Home Lab

Project 06 · COMPLETE · Validated in personal labARC

Executive summary

The project extends an existing on-premises Windows management path into Azure without moving the workloads out of the lab. Proxmox remains the hypervisor, Windows Admin Center remains the local browser-based management point, and Azure Arc adds Azure resource representation, agent health, extension management, and SQL inventory for systems that continue to run on premises.

Azure ArcAzure portalWindows Server 2022SQL Server 2022 DeveloperWindows Admin CenterProxmox VEPowerShell remotingConnected Machine agent

Arc machines: HVHOST01 and VMM01.
SQL resource: VMM01, SQL Server 2022 Developer, connected mode.
Azure scope: rg-hybrid-lab-centralus-01 in Central US under the Azure for Students subscription.
Observed state: Freshly collected on 2026-08-31; see the manifest for integrity records.
Boundary: Personal nonproduction lab; no production, enterprise-scale, availability, or business-impact claim.

Problem, objective, and architecture

Add cloud-based inventory and extension management while keeping the lab on premises.

The objective was to represent two Windows Server systems and the VMM01 SQL instance in Azure, preserve the existing local management design, and make every public claim traceable to current evidence.

Proxmox/QEMUHVHOST01 + VMM01Windows Admin Center + PowerShellAzure Connected Machine agentAzure Arc resource groupArc-enabled SQL Server

Role of Proxmox

Proxmox supplies the QEMU virtualization layer. Both Arc-enabled Windows servers remain running as personal-lab virtual machines; Azure Arc does not replace or directly manage the hypervisor.

Role of Windows Admin Center

Windows Admin Center provides the local connection inventory and Azure integration surface. Its connection list shows both HVHOST01 and VMM01 with Azure Arc status Connected.

Identity separation

The Windows Admin Center gateway uses an on-premises Windows identity, while Azure integration uses a separate Azure identity. Public screenshots redact both account names and the email address while preserving the visible signed-in states.

Resource-group and RBAC boundary

The collected resources are grouped under rg-hybrid-lab-centralus-01. The current evidence does not enumerate role assignments, so it supports resource-group scope but makes no claim about a specific Owner, Contributor, or custom Azure RBAC role.

Onboarding and troubleshooting

Validate the missing agent, use the generated script, and verify the resulting Azure resource.

1. Connectivity before installation

The Windows Admin Center workflow initially appeared to stall while installing the Arc agent. Direct validation found that the Connected Machine agent executable was absent, while outbound TCP 443 connectivity to gbl.his.arc.azure.com succeeded.

2. Manual onboarding script

The Azure-generated onboarding script was transferred to VMM01 and executed through the authorized PowerShell remoting path. The agent installed, authenticated, created the Azure resource, and reported Connected.

3. Agent and service validation

Fresh direct validation on HVHOST01 confirmed agent version 1.67.03504.3207, Connected status, enabled agent auto-upgrade, successful TCP 443 reachability, and the himds, ExtensionService, and GCArcService services running with Automatic startup.

4. Current access limitation

VMM01 answered WinRM but rejected the current Windows credential for a fresh remote session. Its local Arc and SQL services were not re-read directly during this collection; Azure portal and Windows Admin Center supplied the current connected, extension, SQL inventory, licensing, and telemetry evidence.

SQL Server discovery and extension

Move from a pending extension to a connected SQL inventory record.

Initial extension state

The SQL extension initially remained in Creating/ENABLING while the SqlServerExtension service was StartPending. Onboarding logs showed least-privilege configuration and local-group membership work still in progress.

Observed resolution

The service later reached Running, the WindowsAgent.SqlServer extension reached Succeeded, SQL inventory appeared, and DPS upload status reached OK. The current portal evidence shows extension version 1.1.3518.465 with automatic upgrade enabled.

Licensing decision

The Arc-enabled SQL resource reports SQL Server 2022 Developer edition. License only is selected instead of pay-as-you-go; Developer edition is not presented as production licensed.

Services not inferred

Azure Monitor, Azure Backup, Update Manager, Defender, Site Recovery, automated SQL updates, and automatic SQL backups are not described as enabled. The SQL overview explicitly showed automated updates and automatic backups Disabled.

Verified final state

Current results are separated from historical troubleshooting.

Connected

HVHOST01 Arc machine

Azure portal and direct agent output both report Connected in Central US; the three Arc services were running and TCP 443 validation succeeded.

Connected

VMM01 Arc machine

Azure portal and Windows Admin Center report Connected. The portal shows Windows Server 2022 Standard Evaluation and agent version 1.67.03504.3207.

Succeeded

WindowsAgent.SqlServer

Version 1.1.3518.465 reports Succeeded, no update available, and automatic upgrade Enabled.

Connected · telemetry OK

VMM01 SQL Server instance

SQL Server 2022 Developer is inventoried in connected mode with License only, DPS OK, metrics OK, and Connected Machine agent status Connected.

Open the sanitized validation output Review the public-safe PowerShell commands Inspect hashes and provenance

Security and privacy controls

Publish the evidence, not the identities or control-plane identifiers.

Private originals

Fresh raw captures were retained outside the public repository. Published PNG files are cropped derivatives with tenant IDs, subscription IDs, account names, email addresses, private IP addresses, and unnecessary interface data removed or redacted.

No authentication material

No passwords, MFA codes, device-login codes, tokens, cookies, private keys, connection strings, or raw authentication logs are published.

Integrity records

The evidence manifest records SHA-256 hashes, byte sizes, dimensions, source context, transformation notes, and the specific claim supported by every public screenshot.

Least-claim posture

Connected and Succeeded states are reported only where current evidence shows them. Unavailable direct VMM01 service validation remains a named limitation.

Screenshot evidence

Fresh views from PowerShell, Proxmox, Windows Admin Center, and Azure.

Each image is a cropped and redacted derivative of a newly captured authenticated view. Captions state exactly what the visible fields support.

Sanitized PowerShell console showing HVHOST01 Azure Connected Machine agent version and Connected status plus three Arc services running with Automatic startup — **Direct HVHOST01 agent and service validation**Shows agent version 1.67.03504.3207, Connected status, enabled auto-upgrade, and ExtensionService, GCArcService, and himds running with Automatic startup.

Sanitized Proxmox VMM01 summary showing the virtual machine running with CPU, memory, disk, and utilization history — **VMM01 running on Proxmox**Confirms the on-premises QEMU workload remained running; private guest addresses are redacted.

Sanitized Proxmox HVHOST01 summary showing the virtual machine running with CPU, memory, disk, and utilization history — **HVHOST01 running on Proxmox**Confirms the second on-premises QEMU workload remained running; private guest addresses are redacted.

Sanitized Windows Admin Center connection list showing HVHOST01 and VMM01 with Azure Arc status Connected — **Windows Admin Center Arc status**HVHOST01 and VMM01 both show Connected; the local managing identity is redacted.

Sanitized Windows Admin Center account settings showing separate Windows and Azure signed-in sections — **Separate local and Azure identities**Shows the two signed-in contexts while redacting both account names and the Azure email address.

Sanitized Azure resource group view listing HVHOST01 and VMM01 Arc machines and the VMM01 SQL Server instance in Central US — **Hybrid lab resource group**Shows two Machine - Azure Arc resources and one SQL Server instance in Central US; the subscription ID is redacted.

Sanitized Azure Arc HVHOST01 overview showing Connected status, Central US, agent version, Windows Server 2022 Evaluation, and QEMU — **HVHOST01 Azure Arc overview**Confirms Connected status, agent version 1.67.03504.3207, Windows Server 2022 Evaluation, and QEMU.

Sanitized Azure Arc VMM01 overview showing Connected status, Central US, agent version, Windows Server 2022 Evaluation, and QEMU — **VMM01 Azure Arc overview**Confirms Connected status, agent version 1.67.03504.3207, Windows Server 2022 Evaluation, and SQL extension deployment enabled.

Azure Arc extensions view showing WindowsAgent.SqlServer version 1.1.3518.465 with Succeeded status and automatic upgrade enabled — **SQL extension succeeded**Shows the installed extension version, Succeeded status, no update available, and automatic upgrade Enabled.

Sanitized Arc-enabled VMM01 SQL Server instance overview showing connected mode, SQL Server 2022 Developer edition, License only, and extension provisioning succeeded — **Arc-enabled SQL Server inventory**Shows SQL Server 2022 Developer, connected mode, License only, extension version 1.1.3518.465, and Succeeded provisioning.

Azure Arc SQL properties showing License only, extension provisioning Succeeded, automatic upgrade true, DPS status OK, metrics status OK, and agent Connected — **SQL telemetry and agent state**Shows DPS OK, metrics OK, automatic extension upgrade true, Connected Machine agent Connected, and automatic backups Disabled.

Skills demonstrated

Hybrid onboarding with operational boundaries and evidence integrity.

Azure Arc onboardingAzure resource groupsConnected Machine agent validationWindows service validationPowerShell remotingOutbound connectivity testingWindows Admin Center integrationSQL Server discoveryAzure extension troubleshootingLog interpretationLicense-scope documentationScreenshot sanitizationEvidence manifests

Limitations and next steps

A verified hybrid-management lab, not a production Azure operations claim.

The evidence supports two Arc-connected Windows Server lab machines, one Arc-enabled SQL Server 2022 Developer instance, current extension and telemetry states, and direct HVHOST01 agent/service validation. It does not prove production administration, enterprise scale, broad Azure RBAC ownership, high availability, disaster recovery, SLA performance, security assurance, or enabled Azure services beyond the fields shown. VMM01 local service state was not freshly read because the current Windows credential was rejected.

Practical next steps are to restore an approved VMM01 remoting path, repeat the local service and SQL checks, document the exact Azure RBAC assignment through a public-safe export, and evaluate optional Azure services separately before making any enablement claim.