Direct answer: Azure Arc's control plane (Inventory, Manage, VM Self-service) is free; the bill comes from the Azure management/security services you enable. At public list prices on 11 November 2026 (USD, excluding tax and discounts): Azure Policy Guest Configuration & Change Tracking is $6/server/month, Azure Update Manager is $5/server/month, Microsoft Defender for Servers Plan 1 is $4.91/server/month and Plan 2 is $14.60/server/month. The key is that Plan 2 already includes Guest Configuration and Update Manager at no extra charge: Plan 1 + both add-ons = $15.91/server/month, which is $1.31 more than Plan 2 at $14.60; for 100 servers that is Plan 2 $1,460/month vs the stack $1,590.56/month. Windows Server Pay-as-you-go is $33.58/core/month; Windows Server with Software Assurance/active subscription can use Update Manager, Change Tracking, Machine Configuration and more at no additional cost, but log ingestion/compute/storage still bill.
This guide is for IT operations, cloud platform, security, finance and procurement connecting on-premises/multicloud servers to Azure, evaluating Arc management/security cost, or moving from "Arc is free" to the real bill. It separates official prices, editorial calculations and exclusions, covering the free control plane, per-server Guest Config/Update Manager/Defender pricing, the Plan 1 vs Plan 2 bundle math, Windows Server PAYG and SA benefits, Azure Monitor/Sentinel data costs, hidden costs and a 90-day checklist. Prices come from the Azure Arc pricing page and Microsoft Learn Arc overview (11 November 2026). This is not procurement advice.
(1) A free Arc control plane does not mean Arc is free: Guest Config $6, Update Manager $5, Defender Plan 1 $4.91 and Plan 2 $14.60 all bill per server/month. (2) If you need Guest Config + Update Manager, Plan 2 is cheaper than Plan 1 + both: $14.60 vs $15.91; 100 servers save $131/month. (3) Windows Server PAYG is $33.58/core/month; SA/active subscriptions cover Update Manager/Change Tracking and more, but Azure Monitor/Sentinel logs and storage still bill.
Free control plane: what doesn't bill
Microsoft lists the Arc "core control plane" as free: Inventory (tag resources, resource groups/subscriptions/management groups, query with Azure Resource Graph), Manage (SSH Arc, Run Command, Custom Script Extension), and VM Self-service (create/resize/update/delete and start/stop/restart on VMware vCenter/System Center VMM). These do not bill per server; once you enable Update Manager, Guest Configuration, Azure Monitor, Defender for Cloud or Sentinel, those services bill. An Arc-enabled server's monthly total is the number of management/security services and SKUs enabled per server.
| Control-plane capability | Price | Note |
|---|---|---|
| Inventory/tagging/Resource Graph | Free | Resource groups, subscriptions, management groups, cross-environment queries |
| Manage (SSH Arc/Run Command/script extension) | Free | Remote server administration |
| VM Self-service | Free | VMware vCenter/SCVMM lifecycle and power operations |
| Guest Config/Change Tracking | $6/server/month | Per server, not per policy |
| Update Manager | $5/server/month | Patch compliance/orchestration |
| Defender Plan 1 / Plan 2 | $4.91 / $14.60 | Plan 2 includes Guest Config + Update Manager |
Source: Azure Arc pricing page (11 November 2026). Control plane free; add-on management/security services bill by enabled service and server count; excludes tax and discounts.
Per-server billing: the Plan 2 bundle math
Unit prices are simple, but combinations are easy to get wrong: Guest Config $6 + Update Manager $5 = $11/server/month; Plan 1 $4.91 + both = $15.91; Plan 2 $14.60 already includes both. So whenever you need Guest Config and Update Manager together, Plan 2 is $1.31/server/month cheaper than "Plan 1 + add-ons" and includes fuller Defender features (check Defender docs for the exact scope). If you only need one, buy it separately: Guest Config $6, Update Manager $5, or Plan 1 $4.91.
| Combination | Calculation | Per server/month | 100 servers/month |
|---|---|---|---|
| Guest Config only | 6 | $6.00 | $600 |
| Update Manager only | 5 | $5.00 | $500 |
| Guest Config + Update Manager | 6+5 | $11.00 | $1,100 |
| Plan 1 only | 4.91 | $4.91 | $490.56 |
| Plan 1 + Guest + Update | 4.91+6+5 | $15.91 | $1,590.56 |
| Plan 2 (includes Guest + Update) | 14.60 | $14.60 | $1,460.00 |
| Plan 2 vs Plan1+both | 14.60−15.91 | −$1.31 | −$130.56 |
Editorial calculation: per-server monthly add-ons; Plan 2 officially includes Azure Policy guest configuration and Azure Update Manager at no extra charge; excludes tax, discounts, logs/storage and Sentinel.
100-server TCO: from $490 to $1,591
For 100 Arc-enabled servers on one basis: Plan 1 only = $490.56/month; Update Manager only = $500; Guest Config only = $600; Guest + Update = $1,100; Plan 1 + Guest + Update = $1,590.56; Plan 2 = $1,460. If you also send logs to Azure Monitor/Sentinel, add per GB: at 1 GB/server/month and Log Analytics $2.30/GB, 100 servers add $230/month; at 5 GB/server it adds $1,150/month, easily exceeding the management services. Decide the required management/security capabilities first, then layer data costs.
| 100-server scenario | Per server/month | Total/month | Note |
|---|---|---|---|
| Plan 1 | $4.91 | $490.56 | Base Defender |
| Update Manager | $5.00 | $500.00 | Patch management |
| Guest Config | $6.00 | $600.00 | Policy/change tracking |
| Guest + Update | $11.00 | $1,100.00 | Both separately |
| Plan 1 + Guest + Update | $15.91 | $1,590.56 | Stack |
| Plan 2 | $14.60 | $1,460.00 | Includes Guest + Update |
| + logs 1 GB/server ($2.30/GB) | $2.30 | +$230.00 | Log Analytics separate |
| + logs 5 GB/server | $11.50 | +$1,150.00 | Data can exceed management |
Editorial calculation: servers × unit price; logs at $2.30/GB (eastus) with 1/5 GB per server/month assumptions; excludes Sentinel, SCOM MI, tax and discounts; bills follow actual usage.
Windows Server: PAYG and SA benefits
Windows Server Pay-as-you-go enabled by Azure Arc is $33.58/core/month: 2 cores $67.16, 4 cores $134.32, 8 cores $268.64, 16 cores $537.28. With Windows Server Software Assurance or an active subscription licence, Update Manager, Change Tracking & Inventory, Machine Configuration, Windows Admin Center, Remote Support, Best Practices Assessment, ASR configuration, Advanced Networking and Hotpatch (WS2025) can be used at no additional cost per Microsoft's terms; log ingestion, compute and storage still bill as Azure resources. Windows Server SA/PayGo/ESU and Defender Plan 2 also get Essential Machine Management at no additional charge (per official terms).
| Item | Price/benefit | Note |
|---|---|---|
| Windows Server PAYG (2 cores) | $67.16/month | $33.58/core/month |
| Windows Server PAYG (8 cores) | $268.64/month | Multiply by cores |
| Windows Server PAYG (16 cores) | $537.28/month | Multiply by cores |
| SA/active subscription | Update Manager/Change Tracking/Machine Config etc. free | Logs/compute/storage separate |
| Essential Machine Management | Free with SA/PayGo/ESU/Defender Plan 2 | Other cases may bill |
| SQL Server ESU | Per 2-core pack, page dynamic | Not estimated here |
Source: Azure Arc pricing page (11 November 2026). PAYG per core/month; SA/subscription benefits follow official licensing terms; logs/compute/storage and SQL ESU bill separately.
Selection: which servers to bring to Arc
Good fit for Arc: servers needing unified inventory/tagging/Resource Graph, SSH/Run Command, VMware/SCVMM self-service, cross-on-prem/multicloud patching and policy, or Defender/Sentinel security. Not necessary: fully offline machines with no Azure management need, or one-off script targets; the control plane is free, but onboarding, agents, networking and labour still cost. Choose Plan 2 when you need Guest Config + Update Manager + Defender on the same server; choose Plan 1 + separate add-ons when you need only one or two and don't need Plan 2's other features; with SA/subscription, check free benefits first to avoid double-buying Update Manager/Change Tracking. Start from a per-server service list, then multiply by server count.
| Scenario | First choice | Check first |
|---|---|---|
| Inventory/remote admin only | Free control plane | Don't enable add-ons |
| Patch management only | Update Manager $5 | SA/subscription already covers? |
| Policy/change tracking only | Guest Config $6 | Policy count is not billed |
| Patch + policy + Defender | Plan 2 $14.60 | $1.31 cheaper than Plan1+both |
| Base Defender only | Plan 1 $4.91 | No Guest/Update |
| Windows Server without SA | PAYG $33.58/core | Cores, subscription licence |
| Logs/security analytics | Azure Monitor/Sentinel | Per GB, can exceed management |
Editorial summary, not a vendor recommendation; features/benefits/prices follow official pages and licensing terms.
Hidden costs and 90-day checklist
Eight hidden costs: per-server Guest/Update/Defender multiplication, Plan 1 not including Guest/Update, logs/storage per GB, Sentinel separate, Windows Server PAYG per core, SQL ESU per 2-core pack, SA benefits covering only some services, and onboarding/agents/network/labour. 90 days: weeks 1–2 inventory servers, cores, licences (SA/subscription/PAYG) and existing Azure management services; weeks 2–3 list required Guest/Update/Defender per server; weeks 3–4 price Plan 1/Plan 2/separate add-ons and check SA benefits; weeks 4–6 pilot onboarding, policy and patching; weeks 6–8 test log volume and Sentinel cost; weeks 8–10 remove duplicate services and unused policies; weeks 10–12 reconcile the bill and set server-count/log-volume alerts.
| Cost item | Trigger | Control |
|---|---|---|
| Guest Config $6 | Policy/change tracking enabled | Enable only where needed |
| Update Manager $5 | Patch management enabled | Check SA/subscription benefit |
| Defender $4.91/$14.60 | Defender enabled | Choose Plan 2 when both add-ons needed |
| Logs $2.30/GB | Azure Monitor ingestion | Sampling/retention/filtering |
| Sentinel | Security analytics | Budget separately per GB |
| Windows PAYG $33.58/core | No SA/subscription | Compare cores and licensing |
| SQL ESU | Legacy SQL extended support | Quote per 2-core pack |
| Onboarding/labour | Agents/network/operations | Automate at scale |
Editorial summary: resources outside the price list bill as other Azure services; SQL ESU and SCOM MI prices are not estimated here.
FAQ
Is Azure Arc itself free?
The control plane (Inventory, Manage, VM Self-service) is free; add-on Azure management/security services for Arc-enabled servers (Guest Config, Update Manager, Defender, Azure Monitor, Sentinel, etc.) bill when enabled. The total depends on the services and SKUs per server.
How much are Guest Config and Update Manager?
Guest Configuration & Change Tracking is $6/server/month and Update Manager $5/server/month; both bill per server, not per policy or patch.
Plan 1 or Plan 2?
Plan 1 is $4.91/server/month and does not include Guest Config/Update Manager; Plan 2 is $14.60 and includes both at no extra charge. If you need both, Plan 2 is $1.31/server/month cheaper than Plan1+add-ons ($15.91); if you need only one, buy it separately.
What do 100 servers cost per month?
Plan 1 only $490.56; Update Manager only $500; Guest Config only $600; both separately $1,100; Plan1+both $1,590.56; Plan 2 $1,460. Logs add $2.30/GB.
How is Windows Server PAYG billed?
$33.58/core/month: 2 cores $67.16, 8 cores $268.64, 16 cores $537.28. Windows Server with SA or an active subscription licence can use Update Manager, Change Tracking, Machine Configuration and more at no additional cost, but logs/compute/storage still bill.
What does SA cover?
Windows Server SA/active subscription covers Update Manager, Change Tracking & Inventory, Machine Configuration, Windows Admin Center, Remote Support, Best Practices Assessment, ASR configuration, Advanced Networking and Hotpatch per official terms; Azure Monitor/Sentinel log ingestion, compute and storage still bill.
How much is SQL Server ESU?
Microsoft lists it per 2-core pack (SQL Server 2014/2016, Standard/Enterprise) with dynamic page pricing; this article does not estimate it—check the current page/contract before purchase.
How do I reduce cost?
Five steps: (1) use the free control plane without add-ons where possible; (2) choose Plan 2 when Guest+Update are both needed to avoid overpaying; (3) check SA/subscription benefits before buying duplicate services; (4) control Azure Monitor/Sentinel log volume and retention; (5) compare Windows Server PAYG with bring-your-own licensing by core count.
Research method and limitations
Official facts (Arc pricing page, Learn Arc overview): free control plane; Guest Config $6; Update Manager $5; Defender Plan 1 $4.91; Plan 2 $14.60 including Guest+Update; Windows Server PAYG $33.58/core/month; SA/subscription benefits; Log Analytics $2.30/GB. Editorial calculations: servers × unit price; Plan 1/Plan 2 combinations; 100-server TCO; 1/5 GB per server log assumptions; Windows PAYG multiplied by cores.
Seven limitations: (1) USD list prices only, excluding tax/contract discounts/regional differences; (2) server count, core count and log volume are editorial assumptions; (3) excludes agents/network/labour, SCOM MI, specific Sentinel usage, SQL ESU and third-party tools; (4) no real onboarding/policy/patch benchmark; (5) Defender Plan 2's exact feature scope follows Defender docs; (6) SA/subscription benefits follow licensing terms and may vary by contract; (7) prices/benefits change—recheck official pages and bills before purchase.
Sources and basis
- Microsoft Azure, Azure Arc Pricing: azure.microsoft.com/en-us/pricing/details/azure-arc. Free control plane, Guest Config, Update Manager, Defender Plan 1/2, Windows Server PAYG, SA benefits, Log Analytics. Accessed 11 November 2026.
- Microsoft Learn, Azure Arc overview: azure-arc/overview. On-premises/edge/multicloud positioning and control-plane capabilities. Accessed 11 November 2026.
- Microsoft Azure, Microsoft Defender for Cloud Pricing: azure.microsoft.com/en-us/pricing/details/defender-for-cloud. Defender for Servers Plan 1/Plan 2 features and billing basis. Accessed 11 November 2026.
- Microsoft Learn, Windows Server Pay-as-you-go: windows-server-pay-as-you-go. PAYG enablement, per-core billing and licensing alternative. Accessed 11 November 2026.
Data cut-off 11 November 2026; prices/benefits follow Microsoft official pages, licensing terms and bills; this is not procurement, architecture or legal advice.