ARC not connecting to hybrid server

Question

ARC not connecting to hybrid server

Thomas G 0

Azure Arc-enabled servers unable to connect. Cannot get hybrid Azure Virtual Machine to publish in the remote tool or access the console

0 comments

3 answers

Your answer

Answer 1

For Azure Arc-enabled servers that are not showing up for remote tools or console access, check these areas in order:

Verify SSH or remote access is enabled on the Arc-enabled server.

Ensure the SSHD service is running on the server.
Ensure SSH traffic is allowed on the target port.
If needed, enable the SSH service configuration for Arc connectivity on port 22 or the nondefault port in use:

   az rest --method put --uri https://management.azure.com/subscriptions/<subscription>/resourceGroups/<resourcegroup>/providers/Microsoft.HybridCompute/machines/<arc enabled server name>/providers/Microsoft.HybridConnectivity/endpoints/default/serviceconfigurations/SSH?api-version=2023-03-15 --body '{"properties": {"serviceName": "SSH", "port": 22}}'

   Invoke-AzRestMethod -Method put -Path /subscriptions/<subscription>/resourceGroups/<resourcegroup>/providers/Microsoft.HybridCompute/machines/<arc enabled server name>/providers/Microsoft.HybridConnectivity/endpoints/default/serviceconfigurations/SSH?api-version=2023-03-15 -Payload '{"properties": {"serviceName": "SSH", "port": "22"}}'

Check Azure role assignments.
- To enable SSH connectivity the account needs Owner or Contributor on the Arc-enabled server.
- To connect, ensure the account has the required read access.
- For local login, assign Virtual Machine Local user Login.
- For Microsoft Entra login, assign Virtual Machine User Login or Virtual Machine Administrator Login, and ensure the Microsoft Entra SSH Login extension is installed on the Arc-enabled server.
Confirm the Microsoft.HybridConnectivity resource provider is registered.
- Run:
```
   az provider register -n Microsoft.HybridConnectivity
   az provider show -n Microsoft.HybridConnectivity
```
- Verify registrationState is Registered.
- Restart the hybrid agent on the Arc-enabled server after registration.
If the server uses Azure Arc Private Link, validate DNS resolution.
- Check that on-premises DNS forwards to Azure DNS or has the correct private A records.
- These lookups should return private IP addresses:
```
   nslookup gbl.his.arc.azure.com
   nslookup agentserviceapi.guestconfiguration.azure.com
```
- If they resolve to public IP addresses, correct the DNS configuration.
- It can take up to 15 minutes after associating a machine with a private link scope before connections are accepted.

Check agent connectivity and status if the machine is failing to connect to Azure Arc.

Verify the agent version and current state:

   azcmagent version
   azcmagent show

Run the connect command with verbose logging if onboarding or reconnect is failing:

   azcmagent connect \
     --resource-group "${RESOURCE_GROUP}" \
     --tenant-id "${TENANT_ID}" \
     --location "${LOCATION}" \
     --subscription-id "${SUBSCRIPTION_ID}" \
     --access-token "${ACCESS_TOKEN}" \
     --verbose

Enable debug logging:

   azcmagent config set log.level DEBUG
   journalctl -u azcmagent -f

If the target is actually an Azure virtual machine, do not use Azure Arc in production for that VM.
- Azure Arc-enabled servers is not supported for production use on Azure virtual machines.
- It can only be configured on an Azure VM for evaluation and testing purposes.

If the immediate goal is remote access, the most common blockers are:

SSHD not running or port 22 blocked
Missing Owner/Contributor role to enable connectivity
Missing login roles to connect
Microsoft.HybridConnectivity not registered
Private Link DNS resolving to public instead of private IPs

Answer 2

Welcome to Microsoft Q&A

Hello @Thomas G I hope you are doing well.

Looks like Azure Arc agent is not successfully communicating with Azure, preventing the machine from being fully managed as an Arc-enabled server. As a result, features such as Remote Support/Remote Tools and console access are unavailable.

Check the following:

Verify that the Azure Connected Machine Agent (azcmagent) is running and connected:

azcmagent show

Check that the status is Connected.

Confirm the server has outbound connectivity to the required Azure Arc endpoints over HTTPS (TCP 443) and that no proxy or firewall is blocking the traffic.

Ensure the machine's Azure Arc extensions are installed successfully and are in a healthy state.

In the Azure portal, verify that the Arc-enabled server shows Connected under Azure Arc > Machines. If it is disconnected, try reconnecting the agent:

azcmagent check

azcmagent reconnect

References

Azure Arc-enabled servers troubleshooting:

https://learn.microsoft.com/azure/azure-arc/servers/troubleshoot-agent-onboard

Azure Connected Machine Agent overview:

https://learn.microsoft.com/azure/azure-arc/servers/agent-overview

If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!

Jose Benjamin Solis Nolasco 12,281 Reputation points Volunteer Moderator

2026-07-16T14:38:58.32+00:00

@Thomas G Just following up, Do you need more guidance or assistance ?

If all your concerns have been resolved, I would greatly appreciate it if you could mark the answer as "Accepted." This helps both us and others in the community.

Answer 3

Hi, start on the server with azcmagent show and azcmagent check; those results usually tell you whether this is identity, proxy/DNS, TLS, or outbound endpoint reachability. Confirm the Connected Machine Agent services are running, system time is correct, and TCP 443 to the required Arc endpoints is allowed through the proxy/firewall. If a proxy is used, check the agent's proxy configuration rather than only the interactive user's settings. Then inspect the HIMDS/agent logs and Azure Activity Log for extension failures. Remote tools cannot work until the Arc resource is Connected and the required extension/connectivity endpoint is healthy. Re-onboard only after recording the current resource ID and logs, to avoid creating a duplicate machine object.