Connect a provisioned machine from the Azure portal (preview)

This article describes how to create an Azure Arc site, upload an ownership voucher, and connect a provisioned machine to Azure.

Prerequisites

Before you begin, make sure you complete the following prerequisites:

• Set up your subscription.
• Install small form factor on your machines or virtual machines (VMs).
• Have a Windows PC with the Configurator App installed.
• Have the ownership voucher (.pem) files for your machines.

Create and configure an Azure Arc site

Create the site

1. In the Azure portal, search for and select Azure Arc.

2. Go to Operations > Machine provisioning (preview).

3. On Get started, select Provision.

   

4. On the Basics tab, select Create new to create a new site, or choose an existing site.

5. Enter a site name, select your subscription, choose a resource group, and then select Create.

   Note

   By default, Azure creates a new resource group with the same name as the site. You can select an existing resource group instead.

Configure the site

1. On the Basics tab, select Configure under the selected site.

2. Configure the following settings on the Site Configuration pane.

   Setting	Value
   Region	East US
   Use Azure Arc Gateway	Yes
   Arc Gateway	Select an existing gateway or create a new one

3. Select Save.

Configure SSH keys for machine access

SSH keys are used for secure remote access to the machine over SSH. During provisioning, the public key is installed on the machine, and the corresponding private key is later used to authenticate SSH connections.

You can either generate a new SSH key pair in Azure or upload an existing SSH public key that you already use.

If you generate a new key pair in Azure, Azure creates both the public and private keys. The public key is installed on the machine, and the private key (.pem file) is downloaded to your local computer. You use the downloaded private key later to connect to the machine over SSH.

For example:

ssh -i mykey.pem clouduser@<ip-address>

Store the private SSH key securely. If the private key is lost and no other authentication method or authorized key exists on the machine, you might lose SSH access to the machine.

If you upload your own SSH public key, make sure that you securely store and manage the corresponding private key.

Multiple users can access the same machine either by securely sharing the same private key between authorized users or by adding additional SSH public keys to the machine for separate user access.

Add the machine

To add your machine:

1. Under Provisioned machines, select Add.

2. In the Add machines using ownership vouchers pane, upload the ownership voucher that you created in Install small form factor deployments of Azure Local on a machine. Select Add.

3. In the Operating system dropdown list, select Azure Linux 2604.

4. Enter a name for the SSH key that you use later.

5. Select Review + create.

Wait for the machine to become ready

During provisioning, the machine moves through several lifecycle states. The following diagram shows the possible machine states and transitions during provisioning.

Provisioning can take up to 25 minutes to complete.

1. Open the Provisioned machines tab.

2. Wait until Status changes to Provisioned.

   

Connect to the machine over SSH

After the machine state is Provisioned, you can connect to it over SSH.

To connect over SSH, you must have one of the following role assignments at the subscription level. Pick the role assignment based on the level of access needed:

• Virtual Machine Administrator Login: Users with this role can sign in with administrator privileges. This role provides sudo level access on the provisioned machine.

• Virtual Machine User Login: Users with this role can sign in with regular user privileges. This role provides non-sudo level access on the provisioned machine.

Connect by using Azure Cloud Shell

1. Open the Provisioned Machine resource in the Azure portal.

2. Select Settings > Connect.

3. Open Azure Cloud Shell.

4. Upload your private key file to Cloud Shell.

   

5. Restrict permissions on the uploaded key file.

   chmod 600 /path/to/uploaded-key-file
   

6. Copy the SSH command shown in the portal and paste it into CloudShell.

7. Update the command to reference the uploaded .pem file path in --private-key-file.

8. Run the command to establish the SSH connection.

Connect over the local network (optional)

For local access and file transfers, you can configure SSH on your local machine.

1. Create an SSH config file:

   az ssh config -g <MANAGED_RESOURCE_GROUP_NAME> -n <ARC_FOR_SERVERS_NAME> --file ./sshconfig -i </path/to/private-key>
   

2. Use the config file to copy files:

   scp -F ~/sshconfig ~/setup-k3s-arc.sh <MANAGED_RESOURCE_GROUP_NAME>-<ARC_FOR_SERVERS_NAME>-clouduser:~
   

3. Use the config file to connect:

   ssh -F ~/sshconfig <MANAGED_RESOURCE_GROUP_NAME>-<ARC_FOR_SERVERS_NAME>-clouduser
   

Configure devices with Configurator App (optional)

The Configurator App can help you:

• Configure static IP settings and advanced networking options
• Monitor installation progress
• Troubleshoot local issues

To use the app:

1. Install the Configurator App from the Configurator App download link.
2. Reopen the app and run it as an administrator.
3. Connect by using the device serial number or the IP address shown on the console.
4. If the device is still running the maintenance environment (ROE), sign in with:
   • Username: edgeuser
   • Password: Password1
5. After the target OS is installed, sign in using your SSH key and configured username.

Next steps

• Run containerized workloads.