Azure Arc Connectivity Issue: Outbound Proxy Handshake Failure

Hi Juliete,

Start by validating Azure Arc agent connectivity on the affected server with azcmagent show and review the Connected Machine Agent logs under C:\ProgramData\AzureConnectedMachineAgent\Log\. Enable verbose logging if needed and look for connection failures, proxy authentication errors, TLS certificate validation failures, and timeout-related AZCM error codes.

To isolate proxy-related issues, confirm the agent's configured proxy settings using azcmagent config list and verify that outbound HTTPS (TCP 443) connectivity to all required Azure Arc endpoints succeeds through the proxy. Azure Arc communicates exclusively over HTTPS/TLS, so TLS inspection, certificate substitution, or blocked service tags can cause intermittent disconnects.

If the logs show connection resets, SSL/TLS validation errors, proxy authentication failures, or handshake termination immediately after the CONNECT request, focus on the proxy infrastructure. If instead you see successful TLS establishment followed by heartbeat failures, request timeouts, or delayed responses, the issue is more likely agent-side, endpoint filtering, or network latency affecting Azure control-plane communication.

For deeper validation, collect a simultaneous network trace (netsh trace start capture=yes) and proxy logs during a disconnect event. Correlating the Arc agent timestamp with the TCP session lifecycle will clearly distinguish a proxy/TLS handshake failure from an application-layer timeout within the Azure Connected Machine agent.

Harry.