How to use SCP with Linux Onprem ARC enabled server with ssh extension using az ssh arc commands

Hello Georgiev, Ivan,

Yes, SCP can be used with an Azure Arc-enabled Linux server. You do not generate the configuration through az`` ``ssh`` ``arc. Instead, use az`` ``ssh`` ``config and specify the Arc server resource type.

Generate the SSH configuration:

az ssh config `
  --resource-group <ResourceGroupName> `
  --name <ArcServerName> `
  --resource-type Microsoft.HybridCompute/machines `
  --subscription <SubscriptionId> `
  --file .\sshconfig

If you are connecting with a local Linux account, include:

--local-user <LinuxUserName>

Then open the generated sshconfig file and check the value shown after Host. Use that host alias with SCP:

scp.exe -F .\sshconfig .\blabla.txt <HostAlias>:~/

For example, when using a local user, the alias may appear similar to:

<ResourceGroupName>-<ArcServerName>-<LinuxUserName>

Therefore, the SCP command would be:

scp.exe -F .\sshconfig .\blabla.txt <ResourceGroupName>-<ArcServerName>-<LinuxUserName>:~/
`

az ``ssh`` ``config supports both Azure VMs and Azure Arc-enabled servers and creates a configuration that can be used by OpenSSH-based tools such as SCP, rsync, and Git. az`` ``ssh`` ``arc itself is primarily used to initiate the SSH connection and does not generate the reusable config file.

Also ensure that SSH access is enabled for the Arc server, sshd is running, and the Azure CLI SSH extension is current:

az extension add --upgrade --name ssh

For Arc connections, SSH extension version 2.0.4 or later is required.

References:

• Azure CLI az ssh command reference
• SSH access to Azure Arc-enabled servers

Hello Georgiev, Ivan,

Greetings! Thanks for raising this question in the Q&A forum

The reason az ssh arc doesn't work for your SCP scenario is that it's a connect-only command, meant to open an interactive SSH session directly. It has no --file parameter, so it cannot generate a reusable SSH config file. That capability belongs to the separate az ssh config command, and the good news is az ssh config fully supports Arc-enabled servers, not just Azure VMs, through the --resource-type parameter.

Here is how to do it:

1. Generate the SSH config file for your Arc server

Instead of az ssh arc, use az ssh config and set --resource-type to Microsoft.HybridCompute/machines (this is the resource type for Arc-enabled servers):

az ssh config --resource-group {RGNAME} --name {ARCSERVERNAME} --resource-type Microsoft.HybridCompute/machines --subscription {SUBSCRIPTIONID} --file ./sshconfig

If you are connecting with a local user instead of an AAD/Entra certificate, add --local-user {username} to the command.

1. Use the generated config file with SCP

Once the config file is created, use it with scp.exe -F exactly the way you already do for Azure VMs:

scp.exe -F .\sshconfig .\blabla.txt {RGNAME}-{ARCSERVERNAME}:~/

The host alias in the config file will be in the format {ResourceGroup}-{MachineName} (or with the username appended if using a local user), so check the generated sshconfig file to confirm the exact alias before running the scp command.

1. Prerequisites to confirm on the Arc side

Make sure the SSH service configuration on the Arc-enabled server has been enabled for the port you are targeting, since this is required for az ssh config/az ssh vm connections to Arc machines the same as for az ssh arc:

az rest --method put --uri https://management.azure.com/subscriptions/{SUBSCRIPTIONID}/resourceGroups/{RGNAME}/providers/Microsoft.HybridCompute/machines/{ARCSERVERNAME}/providers/Microsoft.HybridConnectivity/endpoints/default/serviceconfigurations/SSH?api-version=2023-03-15 --body "{\"properties\": {\"serviceName\": \"SSH\", \"port\": 22}}"

1. Keep the ssh extension current

Arc SSH connections on ssh extension versions older than 2.0.4 stopped working as of May 21, 2025, so confirm you are on a current version:

az extension update --name ssh
az extension show --name ssh

This approach also works with other tools that accept an SSH command, such as rsync or git, by pointing them at the same config file with -F .\sshconfig.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix