Azure Arc Ghost Registrations - 64% of Our Arc Servers Don't Exist

The Compliance Report Problem

Azure Policy dashboard: "850 Arc-enabled servers, 72% compliant"

VMware vCenter: "547 VMs total"

Math: 850 - 547 = 303 ghost registrations

Our compliance data was fiction.

What Are Ghost Registrations?

Problem: When you delete a VM, Azure Arc registration persists.

Result:

• Compliance reports include servers that don't exist
• Cost tracking is wrong
• Security dashboards show phantom vulnerabilities
• Nobody knows which servers are real

How It Happens

Scenario 1: Delete VM Without Removing Arc Agent

Most common

1. VMware admin deletes VM
2. Arc agent never uninstalls (VM gone)
3. Arc registration stays in Azure
4. Shows as "offline" forever

Scenario 2: VM Name Reuse

1. Delete VM named "SQL-PROD-01"
2. Create new VM with same name
3. Now TWO Arc registrations for "SQL-PROD-01"
4. Which one is real? Nobody knows.

Scenario 3: Failed Deletions

1. Try to delete Arc registration
2. API times out
3. Azure portal shows "deleted"
4. Resource Graph still shows it

The Impact

Compliance Reports Are Fiction

Azure Policy: "347 servers need patches"

Reality: 64% of those are ghosts

Finance: "Why are we patching 347 servers when we only have 220?"

Cost Tracking Is Wrong

Arc costs $5/server/month if you exceed free tier.

Bill: $4,250/month (850 servers)

Reality: $2,735/month (547 servers)

Overpayment: $1,515/month = $18K/year

Security False Positives

Microsoft Defender: "Critical vulnerabilities on 150 servers"

SOC team: Spends 40 hours investigating

Reality: 96 of those servers don't exist

How to Detect Ghosts

Method 1: Resource Graph Query

kql