Can we onboard the vm instances from Azure local to Azure arc using Arc private link scope?

Question

We want to establish private connection between Azure local VM instances (vm instances on the Azure local cluster nodes) to Azure Arc services. So, we want to onboard these VMs to Arc using Arc private link scope. Please let me know

1. Will this scenario work?
2. Can Azure local support private link scope?
3. If no, please explain me why?

Answer 1

Hello Ajit,

Thank you for reaching out Q/A.

Yes. Azure Arc Private Link can be used to onboard VM instances running on Azure Local to Azure Arc, but with important design and support considerations.

Azure Local itself doesn’t “support Private Link” as a platform feature, but Azure Local VMs can consume Azure Arc Private Link when networking and DNS are designed correctly.

• The Azure Local network is connected to an Azure Virtual Network using Site-to-Site VPN or ExpressRoute (or has controlled outbound HTTPS access).
• A Private Endpoint is deployed in that Azure VNet and associated with the Arc Private Link Scope.
• DNS is configured so the Arc endpoints resolve to the private IP address of the Private Endpoint.

Reference:

Use Azure Private Link to securely connect servers to Azure Arc

Create an Azure Arc private link scope

Hope this helps! Please let me know if you have any queries in comments.

Answer 2

Hi Ajit Sane,

yes, this scenario is supported, but with important conditions.

Azure Local VMs can be onboarded to Azure Arc using Arc Private Link Scope, but the support depends on how network connectivity is designed. Azure Local itself does not natively host Private Link. What matters is whether the VMs can resolve and reach the Arc private endpoints over private connectivity.

Arc Private Link Scope works by exposing private endpoints in a virtual network in Azure. Your Azure Local VMs must have line of sight to that VNet through VPN or ExpressRoute. They must also use DNS that resolves the Arc service FQDNs to the private endpoint IPs instead of public IPs.

So, Azure Local does not directly “support” Private Link as a feature, but Azure Local VMs can use Arc Private Link if networking and DNS are configured correctly.

Requirements is

Private endpoints for Arc services deployed in Azure.

Network connectivity from Azure Local to the Azure VNet (VPN/ER).

Proper DNS configuration so Arc endpoints resolve privately.

Outbound HTTPS allowed to those private IPs.

If Azure Local is isolated without connectivity to the Azure VNet hosting the private endpoints, then this will not work, because Private Link is not local to Azure Local clusters.

So the scenario works, but it is a networking and DNS design question, not a platform limitation of Azure Local itself.

rgds,

Alex