Memory hook: Connect safely; delegate narrowly; manage centrally.
Must remember
- Windows Admin Center provides a management gateway for supported Windows Server tasks. Secure the gateway and delegated access rather than exposing unrestricted management endpoints.
- PowerShell remoting uses authenticated remote sessions; the double-hop problem occurs when a remote session must authenticate to another resource. Choose a supported constrained delegation/credential approach rather than broadly forwarding administrator credentials.
- Just Enough Administration (JEA) limits available administrative commands and capabilities. SSH and RDP provide different remote access paths; secure both identity and network reachability.
- Azure Arc registers non-Azure servers for supported Azure management capabilities. It does not move the server into Azure or make all network access private automatically.
- Arc extensions and machine configuration support inventory/configuration tasks; Azure Update Manager schedules assessment and updates. Automation runbooks execute controlled workflows with appropriate identities.
- Check agent/extension health, outbound connectivity, permissions and resource scope. Infrastructure registration without healthy agents does not prove policy or update actions reached the guest.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| Help desk needs only a few administrative commands | A JEA endpoint with scoped access. |
| Manage on-premises servers through Azure services | Azure Arc with supported agents, extensions and network paths. |
Traps
- Arc onboarding does not migrate the workload.
- Solving double-hop by giving every operator unrestricted credentials creates unnecessary exposure.
Active recall
1. What is the double-hop problem?
A remote session cannot automatically reuse credentials to authenticate to another remote resource.
2. Why use JEA?
To delegate only the required administrative operations.
3. What does Update Manager require?
Supported machine connectivity/agent prerequisites, permissions and an assigned update configuration.
4. How diagnose a failed extension?
Inspect extension status/logs, connectivity, identity and dependency prerequisites.
5. Why secure the Admin Center gateway?
It can become a powerful entry point to many managed servers.