Question

Contoso runs a hybrid environment with 200 Windows and Linux servers hosted in an on-premises datacenter and a co-location facility. Compliance requires that the same Azure Policy definitions used to enforce security baselines and required configuration on Azure VMs also apply to these on-premises servers, with results visible in Azure and remediable at scale. Which solution should you recommend?

Accepted Answer

Onboard the on-premises servers to Azure Arc-enabled servers and assign the Azure Policy initiatives at a management group or subscription scope.

Answer

Deploy the Azure Monitor Agent to each server and use Log Analytics query alerts to detect configuration drift.

Answer

Migrate all 200 servers to Azure IaaS VMs so that Azure Policy can natively evaluate them.

Answer

Configure Azure Automation State Configuration (DSC) pull server and apply DSC configurations to each server without using Azure Policy.