How to use SCP with Linux Onprem ARC enabled server with ssh extension using az ssh arc commands

Question

How to use SCP with Linux Onprem ARC enabled server with ssh extension using az ssh arc commands

Georgiev, Ivan 0

Hello ,

We cannot perform scp on Linux Onprem ARC enabled server using AZ CLI , there is a possibility with "az ssh" with generating a custom ssh config file with Azure VM with ssh addon

az ssh config -n {AZUREVMNAME} -g {RGNAME} --subscription {SUBSCRIPTIONID} --file ./sshconfig

scp.exe -F .\sshconfig .\blabla.txt {VMIP}:~/

However "az ssh arc" does not have the config option , did anyone try this with an ARC enabled machine and az ssh arc ?

0 comments

1 answer

Your answer

Answer 1

Hello Georgiev, Ivan,

Greetings! Thanks for raising this question in the Q&A forum

The reason az ssh arc doesn't work for your SCP scenario is that it's a connect-only command, meant to open an interactive SSH session directly. It has no --file parameter, so it cannot generate a reusable SSH config file. That capability belongs to the separate az ssh config command, and the good news is az ssh config fully supports Arc-enabled servers, not just Azure VMs, through the --resource-type parameter.

Here is how to do it:

Generate the SSH config file for your Arc server

Instead of az ssh arc, use az ssh config and set --resource-type to Microsoft.HybridCompute/machines (this is the resource type for Arc-enabled servers):

az ssh config --resource-group {RGNAME} --name {ARCSERVERNAME} --resource-type Microsoft.HybridCompute/machines --subscription {SUBSCRIPTIONID} --file ./sshconfig

If you are connecting with a local user instead of an AAD/Entra certificate, add --local-user {username} to the command.

Use the generated config file with SCP

Once the config file is created, use it with scp.exe -F exactly the way you already do for Azure VMs:

scp.exe -F .\sshconfig .\blabla.txt {RGNAME}-{ARCSERVERNAME}:~/

The host alias in the config file will be in the format {ResourceGroup}-{MachineName} (or with the username appended if using a local user), so check the generated sshconfig file to confirm the exact alias before running the scp command.

Prerequisites to confirm on the Arc side

Make sure the SSH service configuration on the Arc-enabled server has been enabled for the port you are targeting, since this is required for az ssh config/az ssh vm connections to Arc machines the same as for az ssh arc:

az rest --method put --uri https://management.azure.com/subscriptions/{SUBSCRIPTIONID}/resourceGroups/{RGNAME}/providers/Microsoft.HybridCompute/machines/{ARCSERVERNAME}/providers/Microsoft.HybridConnectivity/endpoints/default/serviceconfigurations/SSH?api-version=2023-03-15 --body "{\"properties\": {\"serviceName\": \"SSH\", \"port\": 22}}"

Keep the ssh extension current

Arc SSH connections on ssh extension versions older than 2.0.4 stopped working as of May 21, 2025, so confirm you are on a current version:

az extension update --name ssh
az extension show --name ssh

This approach also works with other tools that accept an SSH command, such as rsync or git, by pointing them at the same config file with -F .\sshconfig.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix