Backup Agent required on AMS to handle VMs?

I've been evaluating ABR10 update 3 (build 10.0.12497).

Two servers are protected with agents and a third server is the AMS without active protection (no ABR10 agent.)

First off, it appears that I'm able to recover to a VM only by using a system that is assigned to the Physical Machine group, which means that the machine must have an agent installed. Is the AMS software not capable of creating a VM on its own? If not, then I'm having to buy a third agent license, just to have an AMS server do some grunt work on behalf of machines that I do want to protect actively. Is this assumption correct?

Also, I did a simple simulation of a protected machine being offline by unplugging the AMS from the network. (I did not want to disconnect the production machine.) I was unable to do any kind of recovery task on the AMS, because the original servers were unreachable. So, this tells me that I'm not able to create a VM of a downed system. Is that correct? If not, what am I doing wrong? Why should I need to access a live protected system to create a VM? Wouldn't any necessary drivers and such be available in the volume archive?