Ansible + Azure Arc: Use Ansible modules to deploy and manage Azure Arc machine extensions at scale

We are making Azure Arc extensible and increasing the flexibility of the tooling you can use to operate your machines using Azure’s control plane. We are excited to announce new modules in Ansible Galaxy that make it easier to manage Azure Arc machine extensions at scale. With the latest updates to the azure.azcollection on Ansible Galaxy, you no longer need to switch between existing tools. You can now deploy and manage Azure Arc extensions using familiar, declarative Ansible workflows. 

These new modules include:

• Azure Arc machine extensions module
• Azure Arc extensions info module

Together, they enable infrastructure and platform teams to automate extension lifecycle management across their hybrid estate—bringing consistency, security, and efficiency to Azure Arc-enabled servers.

Why this matters

Azure Arc machine extensions power critical scenarios such as security, monitoring, update management, configuration and compliance. Until now, managing these Azure Arc extensions across hybrid estates often required Azure CLI scripts, ARM templates, or manual operations. With these new Ansible modules, you can:

• Integrate Azure Arc extension management into existing Ansible playbooks
• Enforce consistent configuration across hybrid servers
• Reduce operational overhead through declarative automation
• Align extension deployment with broader configuration management workflows
  
  

What’s included

azure_rm_arcmachineextensions

This module allows you to manage the full lifecycle of Azure Arc machine extensions, including:

• Creating and deploying extensions
• Updating extension settings
• Removing extensions when no longer needed

You can define extension state declaratively, ensuring consistent enforcement across your Azure Arc-enabled servers.

azure_rm_arcmachineextensions_info

This module provides visibility into extension state by retrieving:

• Installed extensions on Azure Arc-enabled machines
• Provisioning status and configuration details
• Extension metadata for reporting and validation

This is useful for compliance validation, auditing, and conditional automation in playbooks.

Scenario: Enforcing identity-based SSH access across a hybrid fleet

Consider a regulated enterprise that must ensure all Linux servers—whether on-premises or in a multicloud environment—use Microsoft Entra ID for SSH access. The organization wants to:

• Eliminate local SSH credentials
• Enforce centralized identity and access controls
• Audit access consistently across all environments

By combining Azure Arc with Ansible, the organization can deploy the Microsoft Entra SSH for Linux extension across all Azure Arc-enabled servers as part of a standardized playbook, ensuring compliance and reducing operational overhead.

 

Example: Deploy Microsoft Entra SSH for Linux extension

Below is an example of using Ansible to deploy the Microsoft Entra SSH extension to an Azure Arc-enabled server:

- name: Deploy Entra SSH extension to Arc server hosts: localhost connection: local tasks: - name: Install Entra SSH extension for Linux azure_rm_arcmachineextensions: resource_group: myResourceGroup machine_name: myArcServer name: AADSSHLoginForLinux publisher: Microsoft.Azure.ActiveDirectory type: AADSSHLoginForLinux type_handler_version: "1.0" settings: {} state: present

 

Example: Retrieve extension information

Below is an example of using Ansible to retrieve details about your Azure Arc extensions:

- name: Get Arc machine extension details hosts: localhost connection: local tasks: - name: Fetch extensions azure_rm_arcmachineextensions_info: resource_group: myResourceGroup machine_name: myArcServer

 

Integrating with existing Ansible workflows

If you’re already using Ansible for:

• OS configuration
• Patch and update management
• Application deployment

You can now extend those workflows to include Azure Arc extension management—without introducing new tools or processes. This allows you to manage on-premises servers, Edge infrastructure and multicloud environments through a unified automation approach powered by Azure Arc and Ansible.

Read more at Enable VM Extensions Using Red Hat Ansible - Azure Arc | Microsoft Learn

What’s next

These modules are part of our continued investment in making Azure Arc a first-class platform for managing Windows and Linux machines in hybrid and multicloud infrastructure.

By bringing extension lifecycle management into Ansible, we’re enabling teams to enforce security, compliance, and operational consistency at scale—using the tools they already trust.

Stay connected

Join the Azure Arc Monthly Forum here: aka.ms/ArcServerForumSignup

Let us know what you’d like to see next in the comments!