The best cloud platform for hybrid cloud with existing on-premises servers

Azure Arc connects the Windows and Linux servers you already run to Azure as resources, and Microsoft's Arc price list marks inventory, tagging, SSH access and Run Command free on each of them. That is why we name Microsoft Azure the best cloud platform for hybrid cloud when the starting point is existing on-premises servers: the machines stay where they are, and the paid policy and update services are priced per server as you turn them on. A site that later needs new cloud-managed capacity has Azure Local as a separate purchase on validated hardware you buy.

AWS is the better pick for a team that builds on AWS and wants EC2, EBS, EKS and RDS inside its own building, on an Outposts rack that AWS owns and manages. Google Cloud suits an estate that is already Kubernetes: GKE attached clusters manages conformant clusters where they run, and Distributed Cloud software-only installs GKE on Linux servers or VMware you provide.

What should a buyer with existing on-premises servers weigh?

Arc and Systems Manager both register a server without a per-machine fee and then charge for specific functions, per server on Azure and per session or command on AWS. Google makes fleet registration free and bills its attached-cluster service by the schedulable user-cluster vCPU. So the figure to ask each vendor for is the monthly cost of the functions you will turn on across the whole fleet.

AWS owns and manages the equipment in an Outposts rack. Azure Local and Google Distributed Cloud connected both run on certified hardware that the customer procures. Have each quote name the hardware charges and the party responsible for maintaining the equipment. The smallest order each vendor accepts decides whether a branch office or a plant qualifies at all.

The single-rack Outposts configuration runs EC2, EBS, EKS, ECS and RDS on site, and S3 on Outposts is not available on it. An application that needs a managed database or object storage at the site works only where that service runs locally. Check each service your workloads call against the list for the exact edition in your quote.

NIST's cloud computing guidance says network limits and service disruptions reduce the usefulness of a cloud system, most of all for applications that do not tolerate interruption. Compare the circuit each site has today with the published minimum for the product, then ask what keeps running when the link drops. On Azure Local, on an Outposts rack and on both Google Distributed Cloud editions, workloads that are already running continue, and the differences are in how long they continue and in which management actions stop.

Outposts capacity is bought for a term with a choice of upfront payment, and Google Distributed Cloud connected is capacity priced by sales quote with a multi-year commitment on offer. Azure Local is metered by the physical core, and Google's attached-cluster and software-only products are metered by the schedulable user-cluster vCPU. A term fixes the capacity you pay for before you know how much of it the site uses, and a metered bill follows the cores or vCPUs that the product's own meter counts. NIST's guidance also counts the cost of migrating out of a cloud, so read what each contract says happens when the term ends.

Managing the servers and clusters you already run

Adding cloud-managed capacity on site

Separate products for sites with no cloud link

Microsoft Azure: Arc for the servers you have and Azure Local for new capacity

Arc-enabled servers connects Windows and Linux physical servers and virtual machines hosted outside Azure through the Connected Machine agent, and each one becomes an Azure resource with its own resource ID. The Arc price list marks the core control plane free: inventory with tagging and Resource Graph queries, plus management through SSH, Run Command and the Custom Script Extension. The agent talks outbound over TCP port 443, and a machine that stays disconnected for 45 days can be marked Expired until an administrator reconnects it.

Azure Policy guest configuration, sold together with Change Tracking and Inventory, costs $6 per server per month on the same price list, and Update Manager comes to $5 per server per month on 31 connected days. Defender for Servers Plan 2 includes both at no additional cost, and Plan 1 includes neither. Windows Server licenses with active Software Assurance or an active subscription get Update Manager, Change Tracking and Inventory and Azure Machine Configuration at no additional cost, and some of those services still carry log ingestion, compute and storage charges.

A Microsoft blog post on Arc customers describes Ferguson, a US plumbing distributor, using Arc to manage servers in many locations from one place. Arc reaches clusters through Arc-enabled Kubernetes, which attaches any CNCF-certified cluster as an Azure resource and adds GitOps, Azure Monitor, Defender for Containers and Azure Policy as services you select.

A hyperconverged Azure Local deployment runs on 1 to 16 physical machines that the customer buys as validated systems from the Azure Local Catalog. Microsoft's system requirements limit its support to hardware listed in that catalog, so a server Arc already manages qualifies only if it is a catalog system, and a single machine has to use one drive type, NVMe or SSD. On site it runs Windows and Linux virtual machines and AKS enabled by Azure Arc, with SQL Server among the workloads Microsoft lists for this deployment type. Microsoft's customer story on CDW describes the IT provider moving non-production virtual machines to Azure Local and deploying a small cluster for a new market launch.

The same requirements page sets the minimum connection to Azure at 10 Mbit and says a rural T1 line or a satellite connection is adequate for the cluster to sync. The Azure Local FAQ requires a successful sync once in every 30 consecutive days. A cluster that misses the window keeps its host infrastructure and current virtual machines running and cannot create new ones until it syncs.

Sites with no connection to the public cloud have a separate route, Azure Local with disconnected operations, which Microsoft grants by approval to customers on an eligible agreement with a Standard or higher support plan. A production deployment needs a dedicated three-node management cluster with at least 24 physical cores per node, in addition to the cluster that runs the workloads.

Microsoft bills Azure Local per physical core on a daily basis for every core in a registered machine, and its retail price feed lists the hyperconverged host fee at $0.33 per core per day. Purchase runs through an Azure subscription, so ask for the term and the support plan in the quote. The Azure Local price list says the subscription covers the host software only, which leaves the hardware and the guest operating system licenses as separate costs, and it has included AKS at no extra charge since the 2402 release. Windows Server Datacenter licenses with active Software Assurance, held through an Enterprise Agreement or a Cloud Solution Provider, can be exchanged to waive the host fee on cloud-connected hyperconverged deployments without external storage.

AWS: Systems Manager for the fleet and an Outposts rack for local AWS services

AWS registers any number of on-premises servers with Systems Manager at no registration or per-instance charge, according to the Systems Manager price list. A machine joins through a hybrid activation and the SSM Agent, and the operating system families supported outside EC2 are Linux and Windows Server. Inventory, Compliance, State Manager and Fleet Manager carry no additional charge. Session Manager costs $0.05 per session and Run Command $0.002 per invocation on these machines, and patching that relies on Run Command is billed on that meter.

A second-generation Outposts rack in its single-rack form is one 42U rack with compute, storage and networking built in, and AWS owns and manages the equipment. The Outposts FAQ rules out reusing your existing servers and ordering your own hardware for the rack. AWS delivers the rack assembled and installs it, and the customer is responsible for physical security and access at the site. The smaller Outposts servers are closed to new customers: AWS has discontinued sales of the 1U and 2U models.

The single rack runs EC2, EBS, EKS, ECS, RDS, IoT Greengrass and Application Load Balancer on site, and the list varies with the parent Region the rack attaches to. The Outposts features page names SQL Server, MySQL and PostgreSQL as the RDS engines and says S3 on Outposts is not supported on a single rack. AWS's case study on British American Tobacco describes a pilot at one factory in Mexico that moved its manufacturing execution system, SQL Server and Windows Server workloads from on-premises VMware to Outposts.

AWS's service link guidance calls for redundant connections of at least 500 Mbps for each compute rack and a maximum round trip of 175 milliseconds to the parent Region. The FAQ says the racks are not designed for disconnected operations. In an unexpected outage, running EC2 instances and their attached EBS volumes continue and stay reachable through the local gateway, and launching, starting, stopping or terminating instances waits until the link returns.

The Outposts pricing page describes a three-year term with All Upfront, Partial Upfront or No Upfront payment, and the FAQ sets the minimum single-rack configuration on that term at 576 vCPU and 20 TB of EBS, so confirm which term AWS offers for your configuration before you order. The price covers delivery, installation, maintenance and software patches, with operating system charges billed on top, and ordering requires AWS Enterprise Support. A rack that is neither renewed nor returned when the term ends continues month to month at the No Upfront rate.

Google Cloud: attached clusters and GKE on hardware you provide

GKE attached clusters manages standard CNCF-conformant Kubernetes clusters on third-party infrastructure, and its prerequisites call for x86 nodes and outbound access to Google service endpoints. An attached cluster gets Config Sync, Policy Controller, Cloud Service Mesh and Connect Gateway, and its workloads stay on the cluster where they already run.

Registering a cluster to a fleet is free on its own, and Google's fleet documentation says third-party clusters, on-premises distributions included, incur a per-vCPU charge. The GKE price list puts attached clusters at $0.10 per vCPU-hour, counted on schedulable user-cluster vCPUs.

Distributed Cloud software-only installs GKE on Linux bare-metal servers or VMware that the customer provides, with storage the customer provisions. For this edition the price list charges $0.03288 per vCPU-hour on the same basis, with admin and control-plane vCPUs excluded, and VM Runtime needs no additional SKU for running virtual machines. Google supports a standalone cluster with one control-plane node, which it documents as a single point of failure, and high availability takes at least three.

Google designs the software-only edition for a permanent connection to Google Cloud, and its connectivity reference gives the entitlement a 12-hour disconnection tolerance. With the link down, cluster creation, upgrades and Connect Gateway stop, and applications keep operating through the local Kubernetes API.

For Distributed Cloud connected, the customer procures certified hardware and contracts a certified systems integrator to deploy it. A standard order is three nodes, and a single-node option is limited to customers on an allowlist. The product page sets a minimum of 96 vCPUs per site and prices the product on compute capacity through a sales quote, with a five-year commitment among the options.

The connected product's installation requirements ask for 20 Mbps down and 5 Mbps up and name Enhanced Support as the minimum support plan. Workloads and the local control plane keep running for up to seven days without Google Cloud, after which the site reconnects to refresh authentication tokens and storage encryption keys. Google's customer index says Virgin Voyages uses Gemini Enterprise on Google Distributed Cloud Edge for personalized service regardless of satellite connectivity.

A site with no uplink has a separate product, the air-gapped appliance: one cluster across three bare-metal nodes that runs virtual machines, containers, Vertex AI and block and object storage. Google has announced it as generally available.

Which cloud platform should a buyer with existing on-premises servers choose?

Microsoft Azure is our pick for a hybrid cloud built on existing on-premises servers. Arc takes the Windows and Linux machines as they are and inventories them at no charge. Policy and updates are priced per server, so the bill follows the functions you turn on. When a site needs local cloud capacity, Azure Local is available as a separate purchase that starts with a single catalog system on a modest link and keeps its virtual machines running through a missed sync.

Azure Local needs catalog hardware, and Google's software-only edition installs on Linux machines or VMware you already have. That weighs less for this buyer because Arc manages the existing servers in place, with nothing moved onto new hardware, and the Azure Local purchase is optional.

AWS is the better pick when your team builds on AWS and wants those services in its own building. The Outposts rack runs EC2, EBS, EKS and RDS locally on equipment AWS owns and maintains, and it suits a site that has the space and the redundant link for a full rack and accepts a multi-year term.

Google Cloud is the better pick when the estate is already Kubernetes. Attached clusters brings policy and configuration management to conformant clusters where they run, and the software-only edition puts GKE on Linux servers or VMware you provide, both metered on schedulable user-cluster vCPUs.

Other hybrid cloud providers