🟠 High   ⏱ 5–30 min  Last verified: 30 May 2026
Affected versions: Windows Server 2022

📖 ~1 min read

Table of contents
  1. Symptom & Impact
  2. Environment & Reproduction
  3. Root Cause Analysis
  4. Quick Triage
  5. Step-by-Step Diagnosis
  6. Solution — Primary Fix
  7. Solution — Alternative Approaches
  8. Verification & Acceptance Criteria
  9. Rollback Plan
  10. Prevention & Hardening
  11. Related Errors & Cross-Refs
  12. References & Further Reading

Symptom & Impact

Arc agent enrollment fails and governance policies do not apply to target hosts.

Environment & Reproduction

Common in enterprise egress environments with SSL inspection and strict proxy auth.

azcmagent connect --resource-group RG --tenant-id  --subscription-id

Root Cause Analysis

Agent cannot validate endpoint certificates or reach required Arc service URLs.

Quick Triage

Test endpoint access and system trust store chain.

Test-NetConnection gbl.his.arc.azure.com -Port 443
Get-ChildItem Cert:LocalMachineRoot

Step-by-Step Diagnosis

Inspect azcmagent logs and proxy settings.

azcmagent show
Get-Content 'C:ProgramDataAzureConnectedMachineAgentLoghimds.log' -Tail 200
Illustrative mockup for windows-server-2022 — terminal_or_powershell
Azure Arc onboarding diagnostics — Illustrative mockup — Progressive Robot

Solution — Primary Fix

Import proxy CA certs, configure proxy exclusions, and retry onboarding.

Still having issues? Our IT Solutions & Services team can diagnose and resolve this for you. Get in touch for a free consultation.

azcmagent config set proxy.url https://proxy.contoso:8443
certutil -addstore -f root C:Tempproxy-root.cer
Illustrative mockup for windows-server-2022 — event_or_log_viewer
Azure Arc onboarding remediation — Illustrative mockup — Progressive Robot

Solution — Alternative Approaches

Use outbound allowlist bypass for Arc endpoints.

# Configure firewall policy allowlist for Arc FQDNs

Verification & Acceptance Criteria

Arc status is Connected and heartbeat appears in Azure portal.

azcmagent show

Rollback Plan

Disconnect Arc agent and restore prior proxy/cert settings.

azcmagent disconnect

Prevention & Hardening

Track endpoint allowlist drift and rotate proxy certificates safely.

azcmagent check

Related: AAD token acquisition failures and local clock skew authentication issues.

Related tutorial: View the step-by-step tutorial for Windows Server 2022.

View all Windows Server 2022 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Azure Arc networking and proxy requirements for Windows Server.

Need Expert Help?

If you cannot resolve this yourself, our team offers hands-on Server Management, Managed IT Services, and flexible Support Plans. Contact us today — we respond within one business day.