Azure Local & disconnected operations

Connected Azure Local still talks to Azure for management, policy and Arc services. Disconnected operations moves that control plane on-site: identity, policy enforcement, and the Arc resource bridge all run locally, and an Azure subscription stays in the picture only for billing and licensing. The hardware sizing, the identity design, and the update workflow are all different the moment you choose disconnected — it isn't a flag you flip later.

The structural pattern: an azurerm_stack_hci_cluster registration for the Azure Local cluster itself, and the Arc resource bridge that exposes Arc-enabled VMs and AKS from the local control plane. azurerm doesn't yet cover the resource bridge directly, so it goes through azapi. Check current resource provider API versions on Microsoft Learn before deploying — this stack moves fast.

Terraform

resource "azurerm_stack_hci_cluster" "sovereign_cluster" {
  name                = "azlocal-sov-site01"
  resource_group_name = azurerm_resource_group.edge.name
  location            = "westeurope"
  client_id           = azuread_application.hci_cluster.client_id
  tenant_id           = data.azurerm_client_config.current.tenant_id
}

# Arc resource bridge - the local control plane that lets Azure Local
# expose Arc-enabled VMs and AKS even when the site runs disconnected
resource "azapi_resource" "resource_bridge" {
  type      = "Microsoft.ResourceConnector/appliances@2024-02-01"
  name      = "arcbridge-sov-site01"
  location  = "westeurope"
  parent_id = azurerm_resource_group.edge.id

  body = {
    properties = {
      distro = "AKSEdge"
      infrastructureConfig = {
        provider = "HCI"
      }
    }
  }
}

Bicep

resource sovereignCluster 'Microsoft.AzureStackHCI/clusters@2024-04-01' = {
  name: 'azlocal-sov-site01'
  location: 'westeurope'
  properties: {
    aadClientId: hciClusterAppId
    aadTenantId: tenant().tenantId
  }
}

resource resourceBridge 'Microsoft.ResourceConnector/appliances@2024-02-01' = {
  name: 'arcbridge-sov-site01'
  location: 'westeurope'
  properties: {
    distro: 'AKSEdge'
    infrastructureConfig: {
      provider: 'HCI'
    }
  }
}