Error occurring during the SSH handshake with ADF

Question

Error occurring during the SSH handshake with ADF

Justin Doh 1,000

I am trying to find a solution on this error when I tried to copy data from a client who uses AWS for SFPT.

I am using ADF (Azure Data Factory) to move data from this client's SFTP.

Bottom is details of error message:

ErrorCode=SftpFailedToConnectToSftpServer,'Type=Microsoft.DataTransfer.Common.Shared.HybridDeliveryException,Message=Failed to connect to Sftp server 's-93b17c7faf6f45218.server.transfer.us-east-1.amazonaws.com'.,Source=Microsoft.DataTransfer.ClientLibrary.SftpConnector,''Type=Renci.SshNet.Common.SshConnectionException,Message=Server HMAC algorithm not found,Source=Renci.SshNet,'

When I tested the connection, it is working fine, but when I tried to copy data, error occurs.

I am trying to find a solution on my end before reaching out to the client and ask them to modify their configuration.

The question for me is, why does it work when I tested connection, but it fails when I try to copy data?

I am also able to preview the data from a client's SFTP (in ADF) even though it is slow, but not sure why it fails when I try Copy data.

Ganesh Chelluri 190 Reputation points Microsoft External Staff Moderator

2026-09-14T21:37:15.56+00:00
Hello @Justin Doh ,

Thank you for sharing the complete error and confirming that both Test Connection and data preview succeed.

The Copy Activity failure occurs during SSH message-authentication negotiation:

Server HMAC algorithm not found

This means the SSH session created for the Copy Activity did not find a mutually supported HMAC algorithm with the SFTP server. Test Connection and Preview do not by themselves confirm that the full Copy Activity execution path will negotiate and transfer data successfully.

Please try the following:

Confirm that Test Connection, Preview, and Copy Activity use the same SFTP linked service and the same Integration Runtime.

In the SFTP source settings, temporarily set Maximum concurrent connections to 1, publish the change, and retry the copy with one small file.

If the same HMAC error continues, ask the SFTP administrator to provide:

The AWS Transfer Family security policy currently assigned to the endpoint.

The enabled SSH HMAC/MAC algorithms.

The server-side SSH negotiation log for the failed pipeline timestamp.

The SFTP endpoint must offer at least one HMAC algorithm supported by the ADF SFTP execution path. If the endpoint offers only incompatible variants, the SFTP administrator will need to adjust the AWS Transfer Family security policy or endpoint configuration.

After the configuration is updated, rerun the Copy Activity and confirm that the activity succeeds and the file reaches the destination.

Please do not post credentials, private keys, subscription identifiers, or complete connection strings in the public thread. The security-policy name and enabled algorithm names are sufficient for the next comparison
Justin Doh 1,000 Reputation points

2026-09-14T21:54:20.09+00:00

@Ganesh Chelluri Thank you so much for giving me feedback.

I tried 1 & 2, but error still occurs.

I am wondering what I should ask client (SFTP administrator) to do.

Previously, I got a feedback like:

Re-enable at least one HMAC algorithm that is compatible with Azure Data Factory’s SFTP connector

or

Enable hmac-sha2-256 or hmac-sha2-512 on your AWS Transfer Family server.

Is that still same approach that I should do?

This is all new concept (HMAC algorithm) to me, so I wanted to make sure I give a clear instruction.

Thank you.
Ganesh Chelluri 190 Reputation points Microsoft External Staff Moderator

2026-09-15T16:50:54.5366667+00:00
Hello @Justin Doh ,

Thank you for completing the first two checks and confirming that the Copy Activity still fails with the same Server HMAC algorithm not found error.

Yes, the next action is to involve the administrator of the AWS Transfer Family SFTP endpoint. Please ask the administrator to:

Confirm the AWS Transfer Family security policy currently assigned to the SFTP endpoint.

Provide the list of SSH MAC/HMAC algorithms enabled by that policy. No credentials, private keys, or connection strings are required.

Check whether the endpoint offers either of these non-ETM MAC algorithms:

hmac-sha2-256

hmac-sha2-512

If the endpoint currently offers only Encrypt-then-MAC variants, such as ******@openssh.com or ******@openssh.com, enable a mutually compatible non-ETM MAC algorithm as well.

You can send the following request to the SFTP administrator:

“Azure Data Factory Copy Activity is failing during the SSH handshake with Server HMAC algorithm not found. Please confirm the AWS Transfer Family security policy assigned to the endpoint and the MAC algorithms it currently offers. Please ensure that the endpoint offers a mutually compatible non-ETM HMAC algorithm, such as hmac-sha2-256 or hmac-sha2-512, and then let us know when the configuration is ready for retesting.”

After the administrator makes the change, rerun the Copy Activity with one small file and keep Maximum concurrent connections set to 1 for the validation test.

Please share the security-policy name, enabled MAC algorithm names, and the result of the new Copy Activity test. Do not post credentials, private keys, or connection stringsHello Justin,

Thank you for completing the first two checks and confirming that the Copy Activity still fails with the same Server HMAC algorithm not found error.

Yes, the next action is to involve the administrator of the AWS Transfer Family SFTP endpoint. Please ask the administrator to:

Confirm the AWS Transfer Family security policy currently assigned to the SFTP endpoint.

Provide the list of SSH MAC/HMAC algorithms enabled by that policy. No credentials, private keys, or connection strings are required.

Check whether the endpoint offers either of these non-ETM MAC algorithms:

hmac-sha2-256

hmac-sha2-512

If the endpoint currently offers only Encrypt-then-MAC variants, such as ******@openssh.com or ******@openssh.com, enable a mutually compatible non-ETM MAC algorithm as well.

You can send the following request to the SFTP administrator:

“Azure Data Factory Copy Activity is failing during the SSH handshake with Server HMAC algorithm not found. Please confirm the AWS Transfer Family security policy assigned to the endpoint and the MAC algorithms it currently offers. Please ensure that the endpoint offers a mutually compatible non-ETM HMAC algorithm, such as hmac-sha2-256 or hmac-sha2-512, and then let us know when the configuration is ready for retesting.”

After the administrator makes the change, rerun the Copy Activity with one small file and keep Maximum concurrent connections set to 1 for the validation test.

Please share the AWS Transfer Family security-policy name, the enabled MAC/HMAC algorithm names, and whether the new Copy Activity test succeeded or returned the same sanitized error. Please do not include credentials, keys, connection strings, resource identifiers, IP addresses, hostnames, screenshots, or complete logs.
Do not post credentials, private keys, or connection strings
Justin Doh 1,000 Reputation points

2026-09-16T01:33:54.56+00:00

@Ganesh Chelluri Thank you for your help.

I will tell the client to make change (like "Please confirm the AWS Transfer Family.. Please ensure..").

But I am not sure what technical information I need to provide them.

Do I have to provide client any information from my end?

I am not sure when you mentioned "Please share the AWS Transfer Family security-policy name, the enabled MAC/HMAC algorithm names". Are you asking me to share that to you or to the client?

Since this is new to me, I do not want to sound not knowing what I am doing to a client.

Thank you.
Justin Doh 1,000 Reputation points

2026-09-17T17:35:25.7566667+00:00

@Ganesh Chelluri I would like to follow up on my previous comment.

Thank you!

2 answers

Your answer

Ganesh Chelluri 190 Reputation points Microsoft External Staff Moderator

2026-09-14T21:37:15.56+00:00

Hello @Justin Doh ,

Thank you for sharing the complete error and confirming that both Test Connection and data preview succeed.

The Copy Activity failure occurs during SSH message-authentication negotiation:

Server HMAC algorithm not found

This means the SSH session created for the Copy Activity did not find a mutually supported HMAC algorithm with the SFTP server. Test Connection and Preview do not by themselves confirm that the full Copy Activity execution path will negotiate and transfer data successfully.

Please try the following:

Confirm that Test Connection, Preview, and Copy Activity use the same SFTP linked service and the same Integration Runtime.

In the SFTP source settings, temporarily set Maximum concurrent connections to 1, publish the change, and retry the copy with one small file.

If the same HMAC error continues, ask the SFTP administrator to provide:

The AWS Transfer Family security policy currently assigned to the endpoint.

The enabled SSH HMAC/MAC algorithms.

The server-side SSH negotiation log for the failed pipeline timestamp.

The SFTP endpoint must offer at least one HMAC algorithm supported by the ADF SFTP execution path. If the endpoint offers only incompatible variants, the SFTP administrator will need to adjust the AWS Transfer Family security policy or endpoint configuration.

After the configuration is updated, rerun the Copy Activity and confirm that the activity succeeds and the file reaches the destination.

Please do not post credentials, private keys, subscription identifiers, or complete connection strings in the public thread. The security-policy name and enabled algorithm names are sufficient for the next comparison
Justin Doh 1,000 Reputation points

2026-09-14T21:54:20.09+00:00

@Ganesh Chelluri Thank you so much for giving me feedback.

I tried 1 & 2, but error still occurs.

I am wondering what I should ask client (SFTP administrator) to do.

Previously, I got a feedback like:

Re-enable at least one HMAC algorithm that is compatible with Azure Data Factory’s SFTP connector

or

Enable hmac-sha2-256 or hmac-sha2-512 on your AWS Transfer Family server.

Is that still same approach that I should do?

This is all new concept (HMAC algorithm) to me, so I wanted to make sure I give a clear instruction.

Thank you.
Justin Doh 1,000 Reputation points

2026-09-16T01:33:54.56+00:00

@Ganesh Chelluri Thank you for your help.

I will tell the client to make change (like "Please confirm the AWS Transfer Family.. Please ensure..").

But I am not sure what technical information I need to provide them.

Do I have to provide client any information from my end?

I am not sure when you mentioned "Please share the AWS Transfer Family security-policy name, the enabled MAC/HMAC algorithm names". Are you asking me to share that to you or to the client?

Since this is new to me, I do not want to sound not knowing what I am doing to a client.

Thank you.
Justin Doh 1,000 Reputation points

2026-09-17T17:35:25.7566667+00:00

@Ganesh Chelluri I would like to follow up on my previous comment.

Thank you!

Answer 1

The key clue here is the specific error:

Server HMAC algorithm not found

This indicates the failure is occurring during SSH algorithm negotiation, before any file transfer begins. In practice, it usually means the SFTP server and the SSH client used by the ADF Copy activity cannot agree on a common HMAC/MAC algorithm.

What makes your scenario interesting is that:

Test connection succeeds
Preview data succeeds (although slowly)
Copy activity fails

This suggests the issue is unlikely to be networking, firewall rules, credentials, or folder permissions. If those were the problem, Preview would typically fail as well.

One possibility is that Test Connection and Preview do not exercise exactly the same code path as the full Copy activity. The Copy activity establishes the actual transfer session and may perform a different SSH capability negotiation than the lightweight validation or preview operations. As a result, a linked service can validate successfully while the transfer session later fails during HMAC negotiation. [learn.microsoft.com]

Before asking the client to modify their AWS Transfer Family configuration, I would verify:

The Copy activity is using the same linked service and integration runtime that were used for the successful connection test.
The issue is reproducible across multiple files and is not tied to a specific dataset configuration.
Whether the failure occurs consistently for every Copy run, which would further support an SSH algorithm compatibility issue rather than an intermittent connectivity problem.

If those checks are confirmed, the evidence points strongly toward a server-side HMAC/MAC algorithm compatibility mismatch. At that stage, the client can review which MAC algorithms are enabled on the AWS SFTP endpoint and compare them with those supported by the ADF SFTP connector.

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.

Answer 2

The failure is most likely due to SSH algorithm compatibility during the actual copy session, not a basic connectivity problem.

Server HMAC algorithm not found indicates the SFTP server is offering HMAC algorithms that Azure Data Factory does not support for the copy operation. A similar accepted Microsoft Q&A answer states that ADF does not support the -etm HMAC variants required by some SFTP servers, and when the server does not offer a compatible algorithm, the connection fails.

Why test connection or preview can appear to work while Copy fails:

They are not guaranteed to exercise the same transfer path. Test connection validates that ADF can reach the server and complete a basic connection check.
Preview is a lighter operation. It may succeed slowly while the full copy activity opens transfer sessions that require algorithm negotiation the server rejects.
Copy can create multiple connections. ADF can open parallel connections during download, and the SFTP troubleshooting guidance notes that multiple parallel connections can trigger server-side throttling or different SSH/SFTP failures.

Actions to try on the ADF side first:

Confirm the linked service type is SFTP Make sure the linked service is Sftp, not FTP. The SFTP linked service default port is 22 unless the server uses a different port.
Limit concurrency to 1 In the SFTP dataset or copy settings, set maximum concurrent connections to 1 and rerun the copy. This is specifically recommended when copy fails but connection behavior is inconsistent, because parallel connections can trigger server throttling.
If writing to SFTP, disable temp-file rename only when rename is unsupported This does not apply to reading from the client SFTP source, but it matters if the destination is also SFTP and errors such as UserErrorSftpPathNotFound, UserErrorSftpPermissionDenied, or SftpOperationFail occur during write.
Validate the server’s supported SSH/HMAC settings with the client If concurrency = 1 does not help, the remaining likely cause is cryptographic incompatibility on the server side. In that case, the client must enable an algorithm supported by ADF, or a bridge pattern is needed.

What this means for resolution:

If reducing concurrent connections to 1 fixes it, the issue is likely server throttling during copy.
If it still fails with Server HMAC algorithm not found, this is a server/ADF compatibility issue rather than an ADF misconfiguration.
In that case, the practical options are:
- ask the client to enable an ADF-compatible algorithm on the SFTP server, or
- use an intermediary such as an Azure VM or Azure Function App to pull from SFTP and then hand off to ADF through a supported store such as HTTPS or Azure Blob Storage.