To onboard a large number of on-premises servers to Azure Arc using a script, a non-interactive authentication method is required. Creating a Microsoft Entra service principal is the standard and recommended first step for this at-scale scenario. The service principal acts as an identity for the script, allowing it to authenticate with Azure Resource Manager and register the servers without manual intervention. This approach adheres to the principle of least privilege by assigning the service principal only the specific permissions needed for onboarding (the "Azure Connected Machine Onboarding" role), and it minimizes administrative effort by automating the connection for all 500 servers.

A. Create a group managed service account (gMSA).

A gMSA is an Active Directory identity for services running on-premises. It is not used for authenticating to Azure to onboard servers to Azure Arc.

B. Download the Log Analytics workspace ID.

The workspace ID is required to configure the Azure Monitor Agent after the server is connected to Azure Arc. It is not the first step for the Arc onboarding process itself.

C. Generate a Log Analytics key.

The Log Analytics key is used with the workspace ID to authenticate the monitoring agent. This is a subsequent step after the server is successfully onboarded to Azure Arc.

1. Microsoft Learn

"Connect hybrid machines to Azure at scale." Under the "Prerequisites" section

it explicitly states: "To connect machines non-interactively using a service principal

you need to create a service principal to use to connect the machines to Azure." It then details the steps to create one and assign the required "Azure Connected Machine Onboarding" role. This confirms creating a service principal is the prerequisite for at-scale scripted onboarding.

2. Microsoft Learn

"Prerequisites for Azure Arc-enabled servers." In the "Service principal" section

it details the requirement: "If you're using a service principal to connect the machine

you must assign it the Azure Connected Machine Onboarding role." This reinforces that the service principal is the identity used for this task.

3. Microsoft Learn

"Enable VM insights overview." The "Prerequisites" section lists a Log Analytics workspace and the installation of the Azure Monitor Agent. This shows that configuring the connection to the workspace (which requires the ID and key) is part of enabling VM insights

a process that occurs on machines that are already managed

such as through Azure Arc.