You plan to onboard 25 on-premises Windows Server and Linux machines to Azure Arc for a pilot this week, and then hundreds more next quarter with no interactive sign-ins. You also want governance to ensure any new servers brought online in the future are automatically onboarded. What should you do?

The pilot phase with 25 servers allows for interactive onboarding using the Azure portal's generated script and device code flow, which is straightforward for a small number of machines. For hundreds of machines and future automatic onboarding, a non-interactive method is essential. Creating an Azure AD app registration and using its service principal with azcmagent connect in a script (distributed via GPO, SCCM, or Ansible) enables scalable, automated deployment without interactive sign-ins. Assigning the built-in Azure Arc initiative at the management group or subscription scope ensures new servers are automatically onboarded through policy. Azure Automation State Configuration can push agents but doesn't inherently handle the Azure Arc connection without credentials or scripts. Using a private endpoint enhances security but doesn't replace the need for an onboarding method, and Windows Admin Center still requires appropriate authentication.