Modern hybrid monitoring uses the Azure Monitor Agent (AMA). This requires a Log Analytics workspace as the destination and a Data Collection Rule (DCR) to define exactly what data should be gathered and where it should go.

AUM is the successor to the old Automation-based update management. It requires Azure Arc for the management plane and relies on the ‘Periodic Assessment’ feature to check for missing updates without requiring the old Log Analytics agent.

The ‘Start-StorageSyncCloudTiering’ cmdlet (often used with the -Force parameter) triggers the tiering engine to immediately evaluate the files and move them to the cloud based on the current policy, bypassing the usual background schedule.

PHS is the most resilient because the passwords are stored in the cloud. PTA is also resilient *if* you install multiple agents on different servers; if one goes down, others can still handle the authentication requests.

When using Private Link, Azure DNS uses a special zone called ‘privatelink.blob.core.windows.net’. You must configure your on-premises DNS to forward requests for this specific sub-zone to the Azure DNS Private Resolver.

The WAC extension in the Azure portal provides a direct management interface for Azure VMs. Azure Bastion is often used as the connectivity provider to ensure the WAC traffic can reach the VM’s management ports securely.

PIM allows for time-bound, approval-based administrative roles in Azure. JIT VM Access (part of Microsoft Defender for Cloud) limits the time and IP range for which management ports (like RDP/SSH) are open.

The DC agent captures password change requests on the domain controllers, while the Proxy service communicates with Azure AD to download the global banned password list.

To allow users to sign in with a different suffix, you must first add that suffix to the ‘Active Directory Domains and Trusts’ on-premises. Then, update the user accounts to use this suffix so it can be synchronized to and verified by Entra ID.

For modern Azure Stack HCI deployments, the ‘Azure Resource Bridge’ (a VM that runs on the cluster) acts as the control plane for ASR and other hybrid services, replacing older agent-based methods.

If the portal cannot see the VMs, it usually means the ‘Discovery’ service on the appliance is stopped or cannot communicate with the vCenter/Hyper-V host to refresh the inventory.

The Cluster Dashboard in Windows Admin Center provides integrated monitoring of physical health, including real-time power consumption and temperature, provided the hardware supports the necessary IPMI/Redfish standards.

RoCE (RDMA over Converged Ethernet) requires a ‘lossless’ network. PFC is the industry-standard mechanism used to provide flow control and prevent packet loss for storage traffic.

To run Azure Automation Runbooks directly on a hybrid machine, the machine must be configured as a Hybrid Runbook Worker. This allows the Automation service to ‘push’ jobs to the local agent for execution.

For application-aware workloads like SQL, the Mobility Service handles data capture, and ‘App-consistent snapshots’ ensure that VSS is used to quiesce the database so it is in a recoverable state upon failover.

For agentless VMware migration, you must deploy the Azure Migrate appliance as a VM in your environment and ensure it has connectivity to the vCenter Server to orchestrate the discovery and replication.

The ‘setspn’ utility is the primary tool for managing SPNs. ‘-L’ lists SPNs for a specific account, and ‘-Q’ queries the entire forest to see if a specific SPN is already registered elsewhere (preventing duplicates).

ASR allows you to pre-define the Azure VNet, Subnet, and specific Private IP address for the VM in the ‘Compute and Network’ properties. When the failover occurs, Azure will attempt to assign that specific IP to the new VM.

To move a server endpoint, the safest method is to use Robocopy (to preserve metadata/tiering tags), delete the existing server endpoint in the portal, and then create a new one pointing to the new disk path.

Group Writeback requires a Premium license and, crucially, the local Active Directory must have the Exchange schema (even if no Exchange server is present) to support the specific attributes used for group management.

MABS (or DPM) is generally more efficient for volumes with massive amounts of small files compared to the MARS agent, as it handles the data blocks differently and can use optimized ‘modern backup storage’ techniques.

Azure Automanage includes a ‘Microsoft Antimalware’ configuration as part of its best practices profile. This extension ensures the native antimalware service is configured and reporting to Azure.

The DSC extension for Azure Arc allows you to upload and apply PowerShell DSC configurations to hybrid machines, similar to how it works for native Azure VMs.

While Dependency Mapping helps identify which VMs belong together, the most efficient way to group a large number of pre-identified servers into assessments is by using the CSV import feature within the Azure Migrate project.

The Private Endpoint provides the internal IP. To ensure on-premises servers use that IP instead of the public one, you must forward DNS queries from your local DNS server to an Azure DNS Private Resolver (or similar proxy) that can see the Private DNS Zone.

In a three-way mirror, data is written to three separate disks. To maintain this resiliency level while expanding, you should ideally add disks in multiples of three (one for each copy of the data).

The DC Agent communicates with the Password Protection Proxy using RPC. Since RPC uses dynamic ports, you must ensure that the RPC endpoint mapper and the dynamic range are available between the DCs and the Proxy server.

If you add a new attribute to your local AD schema after Azure AD Connect is already installed, you must run the wizard and select ‘Refresh Directory Schema’ so the sync engine becomes aware of the new attribute for mapping.

If a user’s UPN suffix is not a verified domain in the tenant, Azure AD Connect will automatically replace the suffix with the default ‘[tenant].onmicrosoft.com’ address to ensure the user can be created.

Switch Embedded Teaming (SET) is the recommended and standard teaming solution for Azure Stack HCI. Traditional LBFO (Load Balancing and Failover) is generally deprecated for HCI workloads, especially those involving storage and RDMA.

Network ATC only manages the physical adapters that you explicitly include in a ‘NetIntent’. Any adapter not mentioned in an intent remains under manual control and is ignored by ATC’s automated configuration engine.

Data Deduplication is designed to find and remove duplication within data without compromising its fidelity or integrity.

Change Tracking and Inventory (part of Azure Automation) allows you to track changes to software, files, and registry keys across your hybrid fleet.

Microsoft Sentinel ingests logs from your domain controllers via the Azure Monitor Agent to perform security analytics and threat detection.

The Custom Script Extension allows you to download and execute scripts on Azure VMs and Arc-enabled servers.

Azure Update Manager provides a unified dashboard to see the update status of both Azure and Arc-enabled servers.

Conditional Access allows you to exclude specific IP ranges (your office public IPs) from MFA requirements.

Cloud Sync is designed to be lightweight, with the sync logic processing happening in the Azure cloud rather than on an on-premises server.

If churn exceeds bandwidth the replication cannot keep up leading to a lag in the recovery point and potential health warnings in the ASR dashboard.

Mirror-accelerated parity combines a mirror tier for fast writes and a parity tier for space efficiency on the same volume.

Password Hash Sync (PHS) stores a hash of the password in Azure AD, allowing authentication to occur entirely in the cloud if the on-premises DC is offline. Seamless SSO enhances the experience but PHS is the key to availability.

JIT VM Access is a feature of Microsoft Defender for Cloud (specifically the Defender for Servers plan). When applied to Arc-enabled servers, it allows you to request temporary access to management ports that are otherwise blocked.

SQL Insights (using the AMA) provides deep-dive telemetry for SQL Server on-premises or in Azure, including detailed wait stats, memory usage, and blocking queries, visualized through Azure Monitor Workbooks.

The ‘ArcHCI’ module (specifically the ‘Deploy-AzStackHCI’ workflow in newer versions) or the standalone ‘Az.ResourceBridge’ module is used to orchestrate the deployment of the management appliance on the cluster.

Soft Delete retains deleted backup data for 14 days. Multi-User Authorization (Resource Guard) adds a layer of protection by requiring a separate authorized user to approve high-risk operations like deleting backups.

SMB over QUIC requires a valid Server Authentication certificate (issued by a trusted CA) to secure the tunnel.

Group Writeback allows groups managed in the cloud (including those with PIM-assigned eligible members) to be written back to the on-premises Active Directory as security groups.

Storage Replica requires that the destination volume be at least the same size as the source and use GPT partition style. While ReFS is recommended for performance, it is not a strict requirement for the log file itself.

While the Arc agent is the base, the ‘Machine Configuration’ (Guest Configuration) extension is what specifically allows Azure Policy to look inside the OS and remediate (enforce) settings like registry keys or environment variables.

Logs are stored locally on the DCs in a specific provider log. If you have the Azure Monitor Agent (AMA) or MMA installed, you can also forward these events to Log Analytics for centralized reporting and alerting.

The Proxy service can be installed on any domain-joined member server. Only the DC Agent must be installed directly on the Domain Controllers to intercept password change requests.

Azure Relay Hybrid Connections and Azure AD Application Proxy both use outbound connections from the on-premises environment to Azure, allowing traffic to flow to on-premises resources without inbound port changes.

Azure File Sync uses HTTPS for data in transit (which leverages SMB 3.x encryption protocols) and Azure Storage Service Encryption (SSE) automatically encrypts all data at rest within the Azure File share.

AD FS has traditionally been the go-to for Smart Card/Certificate auth. However, Azure AD now natively supports Certificate-Based Authentication (CBA), allowing users to authenticate directly against Azure AD using their smart cards.

The DC agent on each domain controller sends requests to the Azure AD Password Protection Proxy service. The Proxy service then communicates with Azure to retrieve the latest banned password lists.

The Automanage service requires the ‘Contributor’ or a similar high-level role on the subscription or resource group to apply policies, deploy extensions, and modify the configuration of the Arc-enabled servers to maintain the baseline.

High availability for the Proxy service is achieved by simply installing the proxy software on multiple servers and registering them to the same tenant. The DC agents will automatically discover and load-balance across available proxies.

A File Share Witness is the best choice for environments with limited internet connectivity. A Cloud Witness requires an Azure Storage account and constant internet access, while a Disk Witness requires shared storage accessible to all nodes.

The ‘IdFix’ tool is specifically designed by Microsoft to scan local Active Directory environments for attributes (like UPNs or ProxyAddresses) that will cause errors or duplicates when synchronized to the cloud.

The Azure Connected Machine agent allows you to define ‘extension-allowlist’ or ‘extension-blocklist’ within the local agentconfig.json file. This provides a hardware-level restriction that overrides even Azure-side portal requests.