Deploy a VMware Windows VM and connect it to Azure Arc using Terraform

The following Jumpstart scenario will guide you on how to use the provided Terraform plan to deploy a Windows Server, VMware vSphere virtual machine and connect it as an Azure Arc-enabled server resource.


  • Clone the Azure Arc Jumpstart repository

    git clone
  • Install or update Azure CLI to version 2.36.0 and above. Use the below command to check your current installed version.

    az --version
  • Install Terraform >=0.12

  • A VMware vCenter Server user with permissions to deploy a Virtual Machine from a Template in the vSphere Web Client.

  • Make sure the VMware virtual machines you are about to onboard as Azure Arc-enabled servers are installed with the latest VMware Tools available.

  • Create Azure service principal (SP)

    To connect the VMware vSphere virtual machine to Azure Arc, an Azure service principal assigned with the “Contributor” role is required. To create it, login to your Azure account run the below command (this can also be done in Azure Cloud Shell).

    az login
    subscriptionId=$(az account show --query id --output tsv)
    az ad sp create-for-rbac -n "<Unique SP Name>" --role "Contributor" --scopes /subscriptions/$subscriptionId

    For example:

    az login
    subscriptionId=$(az account show --query id --output tsv)
    az ad sp create-for-rbac -n "JumpstartArc" --role "Contributor" --scopes /subscriptions/$subscriptionId

    Output should look like this:

    "displayName": "JumpstartArc",

    NOTE: If you create multiple subsequent role assignments on the same service principal, your client secret (password) will be destroyed and recreated each time. Therefore, make sure you grab the correct password.

    NOTE: The Jumpstart scenarios are designed with as much ease of use in-mind and adhering to security-related best practices whenever possible. It is optional but highly recommended to scope the service principal to a specific Azure subscription and resource group as well considering using a less privileged service principal account

  • Azure Arc-enabled servers depends on the following Azure resource providers in your subscription in order to use this service. Registration is an asynchronous process, and registration may take approximately 10 minutes.

    • Microsoft.HybridCompute

    • Microsoft.GuestConfiguration

    • Microsoft.HybridConnectivity

      az provider register --namespace 'Microsoft.HybridCompute'
      az provider register --namespace 'Microsoft.GuestConfiguration'
      az provider register --namespace 'Microsoft.HybridConnectivity'

      You can monitor the registration process with the following commands:

      az provider show --namespace 'Microsoft.HybridCompute'
      az provider show --namespace 'Microsoft.GuestConfiguration'
      az provider show --namespace 'Microsoft.HybridConnectivity'

Preparing a Window Server VMware vSphere VM Template

Before using the below guide to deploy a Windows Server VM and connect it to Azure Arc, a VMware vSphere Template is required. The following README will instruct you how to easily create such a template using VMware vSphere 6.5 and above.

The Terraform plan leveraged the remote-exec provisioner which uses the WinRM protocol to copy and execute the required Azure Arc script. To allow WinRM connectivity to the VM, run the allow_winrm PowerShell script on your VM before converting it to template.

NOTE: If you already have a Windows Server VM template it is still recommended to use the guide as a reference.


Before executing the Terraform plan, you must set the environment variables which will be used by the plan. These variables are based on the Azure service principal you’ve just created, your Azure subscription and tenant, and your VMware vSphere credentials.

  • Retrieve your Azure subscription ID and tenant ID using the az account list command.

  • The Terraform plan creates resources in both Microsoft Azure and VMware vSphere. It then executes a script on the virtual machine to install the Azure Arc agent and all necessary artifacts. This script requires certain information about your VMware vSphere and Azure environments. Edit scripts/ and update each of the variables with the appropriate values.

    • TF_VAR_subscription_id=Your Azure subscription ID
    • TF_VAR_client_id=Your Azure service principal name
    • TF_VAR_client_secret=Your Azure service principal password
    • TF_VAR_tenant_id=Your Azure tenant ID
    • TF_VAR_resourceGroup=Azure resource group name
    • TF_VAR_location=Azure Region
    • TF_VAR_vsphere_user=vCenter Admin Username
    • TF_VAR_vsphere_password=vCenter Admin Password
    • TF_VAR_vsphere_server=vCenter server FQDN/IP
    • TF_VAR_admin_user=OS Admin Username
    • TF_VAR_admin_password=OS Admin Password
  • From CLI, navigate to the azure_arc_servers_jumpstart/vmware/winsrv/terraform directory of the cloned repo.

  • Export the environment variables you edited by running scripts/ with the source command as shown below. Terraform requires these to be set for the plan to execute properly. Note that this script will also be automatically executed remotely on the virtual machine as part of the Terraform deployment.

    source ./scripts/
  • In addition to the TF_VAR environment variables you’ve just exported, edit the Terraform variables in the terraform.tfvars to match your VMware vSphere environment.

    TF_VAR environment variables

  • Run the terraform init command which will download the Terraform AzureRM, Local and vSphere providers.

    terraform init

  • Run the terraform apply --auto-approve command and wait for the plan to finish.Once the Terraform deployment is completed, a new Windows Server VM will be up & running and will be projected as an Azure Arc server resource in a newly created Azure resource group.

    terraform apply completed

    New VMware vSphere Windows Server VM

    Azure Arc-enabled server in an Azure resource group

    Azure Arc-enabled server in an Azure resource group

Delete the deployment

  • The most straightforward way is to delete the Azure Arc resource via the Azure Portal, just select the resource and delete it. In addition, delete the VMware vSphere VM.

    Delete Azure Arc-enabled server

  • If you delete the instance manually, then you should also delete install_arc_agent.ps1 which is created by the Terraform plan.

  • If you want to nuke the entire environment use the terraform destroy --auto-approve command as shown below.

    terraform destroy