AWS Systems Manager just picked up its biggest workflow change since Session Manager launched: a Cloud Connector for Microsoft Azure that onboards Azure virtual machines as managed nodes without installing an agent by hand or opening a single inbound port. AWS shipped it on July 7, 2026, alongside a pricing overhaul that kills the old Advanced Instances Tier and its 1,000-node cap. If you run workloads split across AWS and Azure — and a lot of mid-size engineering teams do, whether by design or by acquisition — this is the first time you can patch, inventory, and remote into both fleets from one console without stitching together two toolchains.
This tutorial walks through the full setup: connecting an AWS account to an Azure subscription, deploying the SSM Agent at scale through the Cloud Connector, running Session Manager against an Azure VM with no SSH key in sight, and building Automation runbooks and patch baselines that apply the same policy across both clouds. By the end you’ll have a working multicloud fleet you can inventory, patch, and audit from a single pane of glass, plus a grip on the new pay-as-you-go pricing model that takes effect September 30, 2026.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Why AWS Systems Manager’s multicloud pivot matters right now
Systems Manager has quietly been AWS’s answer to “how do I manage a thousand EC2 instances without SSH sprawl” for close to a decade. Session Manager gave you browser-based shell access without exposing port 22. Patch Manager and State Manager gave you compliance at scale. But until this summer, that convenience stopped at the AWS account boundary. If half your fleet lived in Azure — a common outcome after a merger, a multi-vendor procurement policy, or simple hedging against a single cloud’s pricing power — you were running two separate management stacks, two sets of runbooks, and two audit trails.
The July 7, 2026 release changes that math. AWS added a Cloud Connector for Microsoft Azure that auto-discovers Azure VMs across connected subscriptions and deploys the SSM Agent to them automatically, including to VMs that get spun up after the connector is live. Once an Azure VM checks in, it shows up in the Systems Manager Fleet Manager console next to your EC2 instances, indistinguishable in the UI from a native AWS resource. You can run Session Manager, Run Command, Automation, State Manager, Patch Manager, and Inventory against it using the exact same workflow you already use for EC2.
The second half of the announcement is arguably the bigger deal for anyone who tried Systems Manager for hybrid or on-prem servers in the past and bounced off the pricing. AWS eliminated the Advanced Instances Tier entirely. That tier used to gate Session Manager and Run Command access on non-EC2 nodes behind a per-instance fee and a hard 1,000-instance ceiling. As of July 1, 2026, that ceiling is gone, and starting September 30, 2026, hybrid and multicloud nodes move to pure pay-as-you-go pricing: you pay for Session Manager sessions and Run Command invocations as you use them, with no upfront tier fee at all.
That combination — automatic onboarding plus usage-based pricing with no node cap — is what makes this worth a from-scratch tutorial instead of a changelog note. It’s a genuinely different cost and operational model than what existed six months ago, and it changes the calculus for teams who dismissed Systems Manager for hybrid use cases in 2024 or 2025.
Prerequisites and versions you’ll need
Before you touch the console, get these in place. Version mismatches are the single most common reason this setup fails halfway through, so don’t skip the version checks.
- An AWS account with administrator access or, at minimum, IAM permissions for
ssm:*,iam:CreateRole, andiam:PassRole - AWS CLI v2 (2.27 or later) installed and configured with
aws configure - An Azure subscription with Owner or Contributor + User Access Administrator role, since the Cloud Connector needs to register an app in Azure Active Directory (Microsoft Entra ID)
- Azure CLI 2.65 or later, authenticated via
az login - At least one running Azure VM (Windows Server 2019+ or a supported Linux distribution — Ubuntu 20.04/22.04/24.04, RHEL 8/9, or Amazon Linux 2023 if you’re testing on Azure with an AWS-flavored image)
- Outbound HTTPS (443) connectivity from the Azure VM to AWS Systems Manager endpoints — no inbound ports required
- A terminal with
jqinstalled for parsing JSON output (optional but saves time throughout this guide) - Roughly 90–100 minutes: 20 minutes for the Cloud Connector setup, 15 minutes waiting for agent deployment to propagate, and the rest for Session Manager, Automation, and patch baseline configuration
One gotcha worth flagging before you start: the Cloud Connector requires you to grant AWS a service principal in your Azure tenant with Reader access at minimum, plus Virtual Machine Contributor if you want AWS to install the agent automatically rather than you doing it via a custom script extension. If your Azure environment is locked down by a central platform team, get that approval before you start step 3, not after.
Step 1: Confirm your AWS account is ready for Systems Manager
Systems Manager is enabled by default in every AWS account, but the multicloud features need a few IAM pieces in place first. Start by checking which region you’ll anchor the setup in — Cloud Connector registrations are region-scoped, so pick the region closest to your Azure resources to minimize latency on Session Manager connections.
aws sts get-caller-identity
aws ssm describe-instance-information \
--region us-east-1 \
--output table
aws iam get-role --role-name AmazonSSMRoleForInstancesQuickSetup 2>/dev/null || \
echo "Default SSM instance role not found — will create one in Step 2"If describe-instance-information returns an empty table, that’s expected if this is your first time using Systems Manager in this account. It just confirms the service is reachable and your credentials work. Note the region you used — every command in this tutorial assumes us-east-1, so swap it out if you’re working elsewhere.
Step 2: Create the IAM role the Cloud Connector will assume
The Cloud Connector needs an IAM role with permission to manage hybrid activations, write to Systems Manager’s managed-instance inventory, and read Secrets Manager (where it stores the Azure service principal credentials it uses to poll for new VMs). Create a dedicated role rather than reusing an existing one — this keeps the blast radius small if the Azure-side credentials are ever compromised.
cat > cloud-connector-trust-policy.json << 'EOF'
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": { "Service": "ssm.amazonaws.com" },
"Action": "sts:AssumeRole"
}
]
}
EOF
aws iam create-role \
--role-name SSM-CloudConnector-Azure \
--assume-role-policy-document file://cloud-connector-trust-policy.json \
--description "Role for AWS Systems Manager Cloud Connector for Azure"
aws iam attach-role-policy \
--role-name SSM-CloudConnector-Azure \
--policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
aws iam attach-role-policy \
--role-name SSM-CloudConnector-Azure \
--policy-arn arn:aws:iam::aws:policy/SecretsManagerReadWriteThe SecretsManagerReadWrite managed policy is broader than ideal for production. Once you've confirmed the connector works, swap it for a scoped inline policy that limits access to the single secret prefix the connector creates (it names secrets with an ssm-cloud-connector/ prefix by default). Don't leave the broad policy attached past your initial test.
Step 3: Register the Azure app and grant AWS a service principal
This is the step that trips up most people, because it happens entirely on the Azure side before you go back to the AWS console. You're registering an application in Microsoft Entra ID that AWS will use to authenticate and enumerate your Azure VMs.
az login
az ad app create --display-name "AWS-SSM-CloudConnector" \
--sign-in-audience AzureADMyOrg
APP_ID=$(az ad app list --display-name "AWS-SSM-CloudConnector" --query "[0].appId" -o tsv)
az ad sp create --id $APP_ID
az role assignment create \
--assignee $APP_ID \
--role "Virtual Machine Contributor" \
--scope "/subscriptions/$(az account show --query id -o tsv)"
az ad app credential reset --id $APP_ID --display-name "ssm-connector-secret" --years 1The last command outputs a client secret — copy it immediately, since Azure won't show it again. You'll need the tenant ID, the app (client) ID, and this secret in Step 4 when you configure the connector inside the Systems Manager console. If you're scoping this to a single resource group rather than the whole subscription, change the --scope argument accordingly and grant Virtual Machine Contributor only on that resource group. Narrower scope means fewer VMs onboard automatically, but it's the safer default for a first rollout.
Step 4: Create the Cloud Connector in Systems Manager
With the Azure app registered, switch to the AWS Systems Manager console, open Fleet Manager, and go to the Cloud Connectors tab. Click "Create Cloud Connector," choose Microsoft Azure as the provider, and paste in the tenant ID, client ID, and client secret from Step 3. AWS validates the connection before saving — if it fails here, it's almost always because the service principal's role assignment hasn't propagated yet (Azure RBAC changes can take a couple of minutes to take effect).
You can also do this through the CLI using the same underlying API the console calls. AWS documents the exact parameter names in its multicloud onboarding guide, and the shape looks like this:
aws ssm create-cloud-connector \
--provider "AZURE" \
--connector-name "azure-prod-eastus" \
--azure-tenant-id "$(az account show --query tenantId -o tsv)" \
--azure-client-id "$APP_ID" \
--azure-client-secret-arn "arn:aws:secretsmanager:us-east-1:123456789012:secret:ssm-cloud-connector/azure-prod" \
--azure-subscription-id "$(az account show --query id -o tsv)" \
--auto-deploy-agent \
--region us-east-1The --auto-deploy-agent flag is what tells the connector to push the SSM Agent to discovered VMs automatically rather than waiting for you to install it manually. Store the client secret in Secrets Manager first (a plain aws secretsmanager create-secret call) and reference its ARN — the API won't accept the raw secret string inline.
Step 5: Watch the agent roll out to your Azure VMs
Agent deployment isn't instant. AWS's discovery loop polls connected Azure subscriptions on an interval, and once it finds a VM without the SSM Agent, it uses the Azure VM extension mechanism to push and start it — the same delivery method Azure itself uses for its own Custom Script Extension, so there's no unusual attack surface introduced here. Expect 10–15 minutes for the first batch of VMs to check in after you create the connector.
watch -n 30 'aws ssm describe-instance-information \
--filters "Key=ResourceType,Values=ManagedInstance" \
--query "InstanceInformationList[?PlatformType!=null].[InstanceId,PlatformType,PingStatus,ComputerName]" \
--output table \
--region us-east-1'Azure-onboarded instances show up with a mi- prefix in their instance ID (as opposed to i- for native EC2), which is the quickest way to tell them apart in scripts and CLI output. Once PingStatus reads Online, the VM is fully managed and ready for Session Manager, Run Command, and Automation.
Step 6: Connect to an Azure VM with Session Manager — no SSH key required
This is the payoff moment. Once an Azure VM is registered as a managed node, Session Manager works on it exactly like it would on an EC2 instance — no SSH keys to distribute, no inbound port 22 or RDP 3389 to open, and every session logged to CloudWatch or S3 if you've configured session logging.
aws ssm start-session \
--target mi-0abc123def456789 \
--region us-east-1
# Or run a one-off command without an interactive session:
aws ssm send-command \
--instance-ids "mi-0abc123def456789" \
--document-name "AWS-RunShellScript" \
--parameters 'commands=["uname -a", "df -h"]' \
--region us-east-1If you'd rather use the browser-based terminal, Fleet Manager's console now shows Azure-managed instances in the same node list as EC2, with a "Connect" button that opens the same in-browser terminal you'd use for any AWS instance. There's no separate UI to learn — that unification is the entire point of the July release.
Step 7: Build a cross-cloud Automation runbook
Automation runbooks are where the time savings really show up, since you can now write one document that targets both EC2 and Azure managed nodes by resource tag rather than maintaining parallel Terraform modules or Ansible playbooks per cloud. Here's a minimal runbook that installs a security patch and confirms a service restarts cleanly, targetable at any managed node regardless of which cloud it lives in.
{
"schemaVersion": "0.3",
"description": "Cross-cloud patch and service restart",
"parameters": {
"TargetTag": {
"type": "String",
"default": "environment:production"
}
},
"mainSteps": [
{
"name": "RunPatchCommand",
"action": "aws:runCommand",
"inputs": {
"DocumentName": "AWS-RunPatchBaseline",
"Targets": [
{ "Key": "tag:environment", "Values": ["production"] }
],
"Parameters": { "Operation": "Install" }
}
},
{
"name": "RestartService",
"action": "aws:runCommand",
"inputs": {
"DocumentName": "AWS-RunShellScript",
"Targets": [
{ "Key": "tag:environment", "Values": ["production"] }
],
"Parameters": {
"commands": ["systemctl restart nginx || echo 'no nginx on this node'"]
}
}
}
]
}Save that as cross-cloud-patch.json and register it as an Automation document, then execute it by tag rather than by instance ID list — that's what lets the same runbook keep working as you add or remove Azure VMs over time.
aws ssm create-document \
--name "CrossCloudPatchRestart" \
--content file://cross-cloud-patch.json \
--document-type "Automation" \
--document-format JSON
aws ssm start-automation-execution \
--document-name "CrossCloudPatchRestart" \
--region us-east-1Step 8: Set up a patch baseline that applies to both fleets
Patch Manager's baselines were previously scoped mentally to "AWS stuff," but with Azure VMs registered as managed nodes, the same baseline definitions apply across both. Create one baseline per OS family — Amazon Linux, Ubuntu, Windows Server — and let tags decide which instances (AWS or Azure) fall under each.
aws ssm create-patch-baseline \
--name "multicloud-ubuntu-baseline" \
--operating-system "UBUNTU" \
--approval-rules '{
"PatchRules": [
{
"PatchFilterGroup": {
"PatchFilters": [
{ "Key": "PRIORITY", "Values": ["required", "important"] }
]
},
"ApproveAfterDays": 3,
"ComplianceLevel": "CRITICAL"
}
]
}'
aws ssm register-patch-baseline-for-patch-group \
--baseline-id "pb-0abc123def456789" \
--patch-group "multicloud-ubuntu"Tag both your EC2 and Azure-managed instances with Patch Group: multicloud-ubuntu and Patch Manager will scan and remediate both fleets on the same maintenance window, with compliance reported through the same dashboard.
Step 9: Configure a maintenance window to run patching on a schedule
Manually triggering patch runs doesn't scale. A maintenance window automates the cadence and, critically, lets you cap how many nodes get patched in parallel so a bad patch doesn't take down your whole fleet at once — a real risk when that fleet spans two clouds with different failure characteristics.
aws ssm create-maintenance-window \
--name "multicloud-weekly-patch" \
--schedule "cron(0 3 ? * SUN *)" \
--duration 4 \
--cutoff 1 \
--allow-unassociated-targets
aws ssm register-target-with-maintenance-window \
--window-id "mw-0abc123def456789" \
--resource-type "INSTANCE" \
--targets '[{"Key":"tag:PatchGroup","Values":["multicloud-ubuntu"]}]'
aws ssm register-task-with-maintenance-window \
--window-id "mw-0abc123def456789" \
--task-arn "AWS-RunPatchBaseline" \
--task-type "RUN_COMMAND" \
--max-concurrency "25%" \
--max-errors "10%" \
--targets '[{"Key":"tag:PatchGroup","Values":["multicloud-ubuntu"]}]'The max-concurrency and max-errors parameters are your safety valve. Setting concurrency to 25% means only a quarter of your tagged fleet patches at once, so if something breaks, you catch it before it spreads across the rest of the fleet, whether those nodes sit in Azure or AWS.
Step 10: Pull cross-cloud inventory and compliance reports
Inventory is where a lot of teams get real, immediate value even before they touch Automation or patching. It gives you a single queryable table of installed software, running services, and network configuration across every managed node, AWS or Azure.
aws ssm get-inventory \
--filters "Key=AWS:InstanceInformation.PlatformType,Values=Linux" \
--result-attributes '[{"TypeName":"AWS:Application"}]' \
--region us-east-1 \
--query "Entities[].Data" \
--output json | jq '.'
aws ssm list-compliance-summaries \
--region us-east-1 \
--query "ComplianceSummaryItems[].[ComplianceType,CompliantSummary.CompliantCount,NonCompliantSummary.NonCompliantCount]" \
--output tableFeed that output into Athena or QuickSight if you want dashboards, or just export it to CSV for a quarterly compliance report. The point is it's one query, not two separate exports you have to reconcile by hand.
Step 11: Understand the new pricing before it changes on September 30
The pricing shift is significant enough to warrant its own step, because it affects your monthly bill differently depending on how many hybrid or multicloud nodes you run and how often you actually use Session Manager and Run Command against them.
| Aspect | Old model (pre-July 2026) | New model (from Sept 30, 2026) |
|---|---|---|
| Node limit for hybrid/multicloud | 1,000-instance cap under Advanced Instances Tier | No cap |
| Upfront tier fee | Required to unlock Session Manager/Run Command on non-EC2 nodes | None — pay-as-you-go only |
| Session Manager cost model | Bundled into per-instance tier fee | Billed per session usage |
| Run Command cost model | Bundled into per-instance tier fee | Billed per invocation on non-EC2 nodes |
| EC2-only Systems Manager use | Free, as always | Still free — this change targets hybrid/multicloud nodes only |
| Agent deployment to Azure VMs | Manual installation required | Automated via Cloud Connector |
Systems Manager usage against native EC2 instances remains free the way it always has — this pricing change specifically targets hybrid and multicloud (non-EC2) managed nodes. If you're only testing this on a handful of Azure VMs, expect the bill to be negligible; the pay-as-you-go model is built for teams scaling past what the old 1,000-node Advanced Instances Tier ever allowed, without forcing them to pre-pay for capacity they might not use.
Step 12: Lock down IAM with least-privilege access for the connector
Once everything works end-to-end, go back and tighten the IAM role you created in Step 2. The broad managed policies got you moving fast; production deployments need scoped permissions. Replace the attached SecretsManagerReadWrite policy with an inline policy limited to the specific secret ARN the connector uses:
aws iam detach-role-policy \
--role-name SSM-CloudConnector-Azure \
--policy-arn arn:aws:iam::aws:policy/SecretsManagerReadWrite
aws iam put-role-policy \
--role-name SSM-CloudConnector-Azure \
--policy-name ScopedSecretsAccess \
--policy-document '{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": ["secretsmanager:GetSecretValue"],
"Resource": "arn:aws:secretsmanager:us-east-1:123456789012:secret:ssm-cloud-connector/*"
}]
}'Also rotate the Azure client secret from Step 3 on a schedule — 90 days is a reasonable default — and enable CloudTrail logging on the Systems Manager API calls if you haven't already, so every Session Manager connection and Run Command invocation against your Azure VMs shows up in your existing audit pipeline.
Bonus: wire CloudWatch alarms to your Automation executions
There's a related change worth folding into this setup while you're in the console: Systems Manager Automation now evaluates CloudWatch alarm monitoring using the runbook's own execution identity — the IAM role you pass into the runbook — instead of the older SSM service-linked role. Practically, that means if you want an Automation execution to pause or roll back when a CloudWatch alarm trips mid-run (say, error rates spike on a node right after a patch), the role your runbook assumes needs explicit CloudWatch read permissions, or the alarm check silently fails to gate the execution.
aws iam put-role-policy \
--role-name SSM-Automation-ExecutionRole \
--policy-name AlarmMonitoringAccess \
--policy-document '{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"cloudwatch:DescribeAlarms",
"cloudwatch:GetMetricData"
],
"Resource": "*"
}]
}'Attach that policy to whatever role you pass as the AutomationAssumeRole parameter on your cross-cloud runbook, then add an aws:pause step that checks alarm state before proceeding to the next node batch. For a multicloud fleet this matters more than it would for EC2 alone, since a patch that goes sideways on an Azure VM won't necessarily show up in an AWS-native health check — a CloudWatch alarm fed by a custom metric from the Azure side is often the only signal you'll get before the runbook moves on to the next batch of nodes.
It's also worth pointing your Session Manager and Run Command audit trail at the same CloudWatch log group you use for alarm evaluation, so a postmortem on a bad patch run doesn't require correlating timestamps across two separate logging systems by hand. That single change — one log group, one alarm evaluation path — is a small thing operationally, but it's the difference between a five-minute root cause and a half-day one when something breaks at 2 a.m. across a fleet spanning two clouds.
Complete working project: a minimal multicloud fleet
Here's the shape of a small but complete setup you can adapt: one AWS account running the Cloud Connector, one Azure subscription with three tagged VMs, a shared patch baseline, and a weekly maintenance window. The directory structure below groups everything into files you can check into version control.
multicloud-ssm/
├── iam/
│ ├── cloud-connector-trust-policy.json
│ └── scoped-secrets-policy.json
├── azure/
│ └── register-app.sh
├── connector/
│ └── create-connector.sh
├── automation/
│ └── cross-cloud-patch.json
├── patching/
│ ├── create-baseline.sh
│ └── create-maintenance-window.sh
└── README.mdRun the scripts in order: azure/register-app.sh, then connector/create-connector.sh, wait 15 minutes for agent propagation, then the patching scripts. That sequencing matters — if you register the patch baseline and maintenance window before the Cloud Connector has finished onboarding VMs, the maintenance window will run against an empty target set and silently do nothing, which is a confusing way to lose an afternoon.
Common pitfalls when setting up multicloud Systems Manager
- Forgetting outbound HTTPS on Azure network security groups. The SSM Agent needs to reach AWS's
ssm,ssmmessages, andec2messagesendpoints over 443. If your Azure VM sits behind a restrictive NSG or firewall, the agent installs but never reportsOnline. - Using an Azure role assignment scoped too narrowly. Reader access alone lets AWS see your VMs but not deploy the agent. You need Virtual Machine Contributor (or a custom role with the equivalent write permissions) for
--auto-deploy-agentto actually work. - Assuming the client secret from Step 3 doesn't expire. It does — the
--years 1flag in the example sets a one-year expiry. Set a calendar reminder or you'll have a connector that silently stops discovering new VMs eleven months from now. - Mixing up instance ID prefixes in scripts. Azure-managed nodes use an
mi-prefix, noti-. Scripts hardcoded to expect EC2-style IDs will silently skip Azure nodes in loops or filters. - Not tagging VMs before running automation by tag. If a runbook targets
tag:environment=productionand a newly onboarded Azure VM has no tags yet, it gets skipped from patching entirely with no error raised. - Leaving the broad IAM policy attached in production. The quick-start policies in Step 2 are for getting the connector working, not for staying attached indefinitely. Skipping Step 12 is the most common security gap teams leave behind.
- Underestimating agent propagation time on large VM counts. Onboarding 5 VMs takes minutes; onboarding 500 can take well over an hour as the connector works through Azure's extension deployment rate limits. Don't assume a stalled fleet manager count means the connector is broken — check again in 30 minutes first.
- Running the Cloud Connector setup from a personal Azure account instead of a service account. Tying the app registration to an individual's Azure AD identity means the connector breaks the moment that person leaves the team or their account gets deprovisioned. Register the app under a shared automation identity or service principal that outlives any one engineer.
Expected output at each stage
Knowing what success looks like at each checkpoint saves time troubleshooting phantom problems. Here's what you should see if things are working correctly.
# After Step 5, describe-instance-information should show:
-----------------------------------------------------------------------
| DescribeInstanceInformation |
+----------------------+------------+------------+---------------------+
| mi-0abc123def456789 | Linux | Online | azure-web-01 |
| mi-0def456abc789123 | Linux | Online | azure-web-02 |
| i-0123456789abcdef0 | Linux | Online | ec2-app-01 |
+----------------------+------------+------------+---------------------+
# After Step 6, start-session returns:
Starting session with SessionId: user-0a1b2c3d4e5f6g7h8
sh-5.1$ uname -a
Linux azure-web-01 5.15.0-1053-azure #61-Ubuntu SMP x86_64 GNU/LinuxIf your Azure VM's kernel string doesn't show the -azure suffix, you're likely connected to an EC2 instance instead — double-check the instance ID you targeted.
Troubleshooting: 9 issues and how to fix them
- Cloud Connector creation fails with "invalid credentials." The Azure role assignment from Step 3 hasn't propagated yet. Wait 2–3 minutes and retry — Azure RBAC changes aren't always instant.
- Azure VMs never appear in Fleet Manager. Check that the VM's network security group allows outbound 443. Also confirm the VM extension actually installed by running
az vm extension list --vm-name YOUR_VM --resource-group YOUR_RGon the Azure side. - Session Manager returns "TargetNotConnected." The agent is installed but hasn't checked in recently, usually because of a network blip or the instance being stopped and restarted. Give it 5 minutes and check
PingStatusagain. - Run Command times out on Azure nodes specifically. Azure VM extensions can take longer to fully initialize than EC2 user-data scripts. Increase the command timeout parameter from the default 600 seconds to 1200 for your first few runs against Azure nodes.
- Patch baseline shows 0 compliant and 0 non-compliant instances. Your patch group tag doesn't match what's registered on the baseline. Re-check the exact tag key and value on both the baseline registration and the instance tags — this is case-sensitive.
- Automation execution stalls at "Waiting" indefinitely. Usually an IAM issue — the Automation service role needs
ssm:SendCommandandssm:GetCommandInvocationpermissions scoped to the target instances, including the Azure managed-instance ARNs, not just EC2 ARNs. - Cost Explorer shows unexpected Systems Manager charges. Before September 30, 2026, hybrid/multicloud nodes may already be accruing charges under the transitional pricing. Check the Systems Manager pricing page for the exact cutover date applicable to your account and region.
- Client secret rotation breaks the connector silently. If you rotate the Azure app's client secret outside of updating the Cloud Connector configuration, discovery quietly stops working with no obvious error in the console. Always update the connector's stored secret ARN in the same change as rotating the Azure-side secret.
- Maintenance window shows zero registered targets after tagging VMs. Tag propagation into Systems Manager's target-matching engine isn't always instant — give it a few minutes after applying tags before assuming the window registration itself is broken, and re-run
register-target-with-maintenance-windowonly if the gap persists past 10 minutes.
Advanced tips for running this at scale
Once the basic multicloud fleet is stable, a few refinements make a real difference at 50+ nodes. First, split your patch groups by both OS and criticality tier rather than one baseline per OS — a "production-critical-ubuntu" group with a tighter approval window than "dev-ubuntu" gives you faster patching on low-risk environments without rushing production changes. Second, use resource groups in Azure that mirror your AWS tagging taxonomy from the start; retrofitting tags across an existing Azure estate to match your AWS conventions is tedious and error-prone once dozens of VMs are already onboarded.
Third, if you're running this across multiple Azure subscriptions, create one Cloud Connector per subscription rather than trying to get a single connector to span subscription boundaries — AWS's connector model is scoped to one subscription per connector as of the July 2026 release, and multi-subscription support isn't yet part of the API. Fourth, wire Session Manager logging to a dedicated CloudWatch log group with a retention policy matching your compliance requirements (30, 90, or 365 days are common choices), since by default session logs aren't retained indefinitely and you don't want to discover that gap during an audit.
Finally, budget for the pay-as-you-go pricing by setting a Cost Explorer budget alert specifically filtered to the Systems Manager service and the Session Manager/Run Command usage types, rather than relying on the monthly bill to tell you after the fact. Given the September 30, 2026 pricing cutover, teams onboarding a large hybrid fleet in the weeks before that date should model both the old and new cost structures to know what to expect on the other side of the transition.
How this compares to running separate tools per cloud
| Capability | Separate tools (Azure Arc + native SSM) | Unified via SSM Cloud Connector |
|---|---|---|
| Console views to check | Two — Azure Portal and AWS console | One — AWS Fleet Manager |
| Patch baseline definitions | Maintained separately per platform | Shared baseline, tag-driven targeting |
| Remote access method | Azure Bastion or RDP/SSH; Session Manager for AWS | Session Manager for both |
| Automation runbook language | Azure Automation runbooks + AWS SSM documents | Single SSM Automation document |
| Agent installation | Manual or per-platform scripted install | Automated by Cloud Connector |
| Audit trail | Split across Azure Activity Log and AWS CloudTrail | Consolidated in CloudTrail for both fleets |
The tradeoff worth naming honestly: consolidating into AWS's console means AWS becomes your single point of failure for management tooling, even for the Azure half of your fleet. If Systems Manager has an outage in your chosen region, you lose Session Manager access to your Azure VMs too, even though the VMs themselves are running fine on Azure's infrastructure. For teams that value operational independence between clouds specifically as a resilience strategy, that's a real consideration, not just a footnote.
That said, most teams adopting this setup aren't running Azure as a resilience hedge against AWS outages in the first place — they ended up multicloud through an acquisition, a business unit's prior vendor choice, or a compliance requirement tied to a specific customer contract. For that far more common scenario, the operational cost of running two full management stacks usually outweighs the theoretical risk of a correlated outage, especially given how rarely Systems Manager itself goes down compared to, say, a full regional AWS outage. Weigh the tradeoff against your actual failure history, not a hypothetical one, before deciding how much of your Azure fleet to bring under this umbrella on day one.
Frequently asked questions
Does the AWS Systems Manager Cloud Connector for Azure cost extra to set up?
Creating the connector itself isn't a separate line-item charge. What you pay for is Session Manager and Run Command usage against the Azure-managed nodes once the new pay-as-you-go pricing takes effect on September 30, 2026. Usage against native EC2 instances remains free.
Can I use this to manage on-premises servers alongside Azure and EC2?
Yes. On-premises and other hybrid nodes were already supported by Systems Manager through its Activations feature before the July 2026 release. They fall under the same Advanced Instances Tier removal and pay-as-you-go pricing change as the new Azure-connected nodes.
Do I need to install the SSM Agent manually on each Azure VM?
No, that's the point of the Cloud Connector's auto-deploy feature — it pushes the agent through Azure's VM extension mechanism to every discovered VM, including ones created after the connector goes live, as long as the service principal has Virtual Machine Contributor access.
What happens to VMs that already had the SSM Agent installed manually before the Cloud Connector existed?
They continue working. The Cloud Connector's discovery process recognizes already-registered managed instances and simply picks up ongoing management of them rather than reinstalling the agent.
Is Google Cloud supported by the Cloud Connector as well?
As of the July 2026 release, the Cloud Connector is specific to Microsoft Azure. AWS hasn't announced a GCP equivalent as part of this release.
Can I limit which Azure VMs get onboarded automatically?
Yes, by scoping the service principal's role assignment to a specific resource group rather than the whole subscription in Step 3. Only VMs within that scope will be discovered and onboarded.
Does removing the Advanced Instances Tier affect existing hybrid Systems Manager users who already paid for that tier?
The tier itself is gone as of July 1, 2026, and the pricing model transitions fully to pay-as-you-go by September 30, 2026. Check the official Systems Manager pricing page for the precise transition details applicable to your account.
What IAM permissions does my everyday user need to use Session Manager on Azure-managed nodes?
The same ssm:StartSession and related permissions you'd already grant for EC2 Session Manager access work identically for Azure-managed nodes, since both appear as the same resource type in IAM policy evaluation.
Related Coverage
- Kubernetes on AWS EKS Setup: 12 Steps, 100 Min [2026]
- AWS Elastic Beanstalk Setup: 12 Steps, 90 Min [2026]
- AWS Step Functions Terraform Tutorial: 12 Steps, 90 Min [2026]
- How to Set Up AWS Cost Explorer & Budgets: 12 Steps, 90 Min [2026]
- Azure AI Foundry Agents: 12 Steps, 100 Min [2026]
