DTOSS-12687: Deploy Windows Admin Center to Arc-enabled servers - #97
Merged
josielsouzanordcloud merged 1 commit intoApr 22, 2026
Merged
Conversation
josielsouzanordcloud
had a problem deploying
to
review
April 20, 2026 14:52 — with 
GitHub Actions
Error
GitHub Actions
Error
josielsouzanordcloud
force-pushed
the
DTOSS-12687-windows-admin-center-arc-policy
branch
from
April 20, 2026 14:52
d59a60b to
7a5dbab
Compare
josielsouzanordcloud
had a problem deploying
to
review
April 20, 2026 14:54 — with
GitHub Actions
Failure
GitHub Actions
Failure
josielsouzanordcloud
temporarily deployed
to
review
April 20, 2026 15:19 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
josielsouzanordcloud
had a problem deploying
to
review
April 20, 2026 15:24 — with
GitHub Actions
Failure
GitHub Actions
Failure
josielsouzanordcloud
had a problem deploying
to
review
April 21, 2026 14:11 — with
GitHub Actions
Failure
GitHub Actions
Failure
josielsouzanordcloud
had a problem deploying
to
review
April 21, 2026 14:19 — with
GitHub Actions
Failure
GitHub Actions
Failure
josielsouzanordcloud
temporarily deployed
to
review
April 21, 2026 14:39 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
josielsouzanordcloud
temporarily deployed
to
review
April 21, 2026 14:41 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
The built-in policy "Configure Windows Arc-enabled machines to enable Windows Admin Center Extension" (0e4b8929) is not available in this tenant, so a custom policy definition is created instead, replicating the same rule. Changes: - Add custom policy definition and assignment scoped to the arc-enabled servers resource group, deploying the AdminCenter extension to all Windows Arc-enabled machines - Add policy rule in policies/deploy-wac-extension-arc-windows.json - Add remediation task so existing non-compliant machines get the extension deployed on the next terraform apply - Reuse arc_monitor_policy_identity managed identity which already holds Azure Connected Machine Resource Administrator - Add Windows Admin Center Administrator Login RBAC assignment for the screening_mbsgw_<env> Entra ID group on the arc-enabled servers resource group, allowing the group to connect via WAC - Extend the RBAC Administrator ABAC condition in core.bicep to include Windows Admin Center Administrator Login, allowing Terraform to manage this role assignment
josielsouzanordcloud
changed the title
josielsouzanordcloud
force-pushed
the
DTOSS-12687-windows-admin-center-arc-policy
branch
from
April 21, 2026 15:36
b1da053 to
beda2a9
Compare
josielsouzanordcloud
temporarily deployed
to
review
April 21, 2026 15:38 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
josielsouzanordcloud
temporarily deployed
to
review
April 21, 2026 15:40 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
arc_monitor_policy_identitymanaged identity (already holdsAzure Connected Machine Resource Administrator)Windows Admin Center Administrator Loginto thescreening_mbsgw_<env>Entra ID group on the arc-enabled servers RG, allowing the group to connect via WACcore.bicepto includeWindows Admin Center Administrator Loginso Terraform can manage the role assignmentTest plan
core.bicepdeploylabel to trigger deployment to thereviewenvironmentwac-arc-reviewis visible under Policies onrg-mbsgw-review-uks-arc-enabled-serversAdminCenterextension is in a Succeeded state on thembsgw-reviewArc machineWindows Admin Center Administrator Loginrole assignment exists forscreening_mbsgw_reviewon the arc-enabled servers RGmbsgw-reviewmachineJira link
DTOSS-12687