Azure Arc Private Link Error

Hello Brenna,

We understand that you're encountering an issue where Azure Arc-enabled on-prem Windows server is onboarded successfully, DNS resolution for Private Link endpoints works, and private endpoints exist, but extensions fail to install. The logs show "VM not in PrivateLink" And the Private Link check reports "No indication of Private Link Scope but found private endpoint.

 This might happen because the Arc machine resource is not associated with the Private Link Scope in Azure. DNS and private endpoints alone do not make the agent operate in Private Link mode. The property privateLinkScopeResourceId must be set on the machine resource, and the agent must know it’s in Private Link mode. Without this, extension downloads use public endpoints even if private IPs resolve.

Verify the association on the machine:

Run the below Azure CLI command to see, if the output is the full resource ID of your Arc Private Link Scope, e.g. /subscriptions/<SUB>/resourceGroups/<RG>/providers/Microsoft.HybridCompute/privateLinkScopes/<ScopeName> 

az resource show \
 --ids /subscriptions/<SUB>/resourceGroups/<RG>/providers/Microsoft.HybridCompute/machines/<MACHINE-NAME> \
 --query properties.privateLinkScopeResourceId -o tsv

If it’s empty (or points to the wrong scope), the machine isn’t mapped extensions will use public URLs even though your private endpoints resolve.

 Associate the machine to the Private Link Scope:

If you onboarded with the standard script and didn’t include a scope using below command,

This sets the agent into Private Link connectivity and writes the scope association

 # Optional: see current mode
azcmagent config get config.mode

# Disconnect (keeps the Azure resource; agent detaches)
azcmagent disconnect
 
# Re-connect including your actual scope resource ID
azcmagent connect `
 --subscription-id "<SUB>" `
 --resource-group "<RG>" `
 --location "<REGION>" `
 --tenant-id "<TENANT>" `
 --private-link-scope "/subscriptions/<SUB>/resourceGroups/<RG>/providers/Microsoft.HybridCompute/privateLinkScopes/<ScopeName>"

Additional verify the below points:

• The Arc machine and Arc Private Link Scope must be in the same Azure region, and the private endpoint must be in the same region as the VNet it’s attached to. Misaligned regions yield “no indication of scope” even with correct DNS.
• In Private Link Center, confirm connections are Approved and NICs are healthy. (Pending/Rejected leaves the agent in public mode.)
• DNS must resolve *.arc.azure.com and *.guestconfiguration.azure.com to private IPs.

Reference Document:

 https://learn.microsoft.com/en-us/azure/azure-arc/servers/private-link-security?wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider#how-it-works

https://learn.microsoft.com/en-us/azure/private-link/troubleshoot-private-endpoint-connectivity

Hope these suggestions help you get closer to a solution! If you continue facing issues, please let us know, thanks