diff --git a/terraform/infrastructure/azure/main.tf b/terraform/infrastructure/azure/main.tf
index ea57f6b788..e265bb2d65 100644
--- a/terraform/infrastructure/azure/main.tf
+++ b/terraform/infrastructure/azure/main.tf
@@ -40,7 +40,7 @@ locals {
     { name = "recovery", port = "9999", health_check_protocol = "Tcp", path = null, priority = 104 },
     { name = "join", port = "30090", health_check_protocol = "Tcp", path = null, priority = 105 },
     var.debug ? [{ name = "debugd", port = "4000", health_check_protocol = "Tcp", path = null, priority = 106 }] : [],
-    var.emergency_ssh ? [{ name = "ssh", port = "22", health_check_protocol = "Tcp", path = null, priority = 107 }],
+    var.emergency_ssh ? [{ name = "ssh", port = "22", health_check_protocol = "Tcp", path = null, priority = 107 }] : [],
   ])
   // wildcard_lb_dns_name is the DNS name of the load balancer with a wildcard for the name.
   // example: given "name-1234567890.location.cloudapp.azure.com" it will return "*.location.cloudapp.azure.com"
@@ -273,11 +273,8 @@ module "scale_set_group" {
   image_id                  = var.image_id
   network_security_group_id = azurerm_network_security_group.security_group.id
   subnet_id                 = azurerm_subnet.node_subnet.id
-  backend_address_pool_ids = each.value.role == "control-plane" ? concat(
-    [module.loadbalancer_backend_control_plane.backendpool_id],
-    var.emergency_ssh ? [module.loadbalancer_backend_control_plane_ssh[0].backendpool_id] : []
-  ) : []
-  marketplace_image = var.marketplace_image
+  backend_address_pool_ids  = each.value.role == "control-plane" ? [module.loadbalancer_backend_control_plane.backendpool_id] : []
+  marketplace_image         = var.marketplace_image
 }
 
 module "jump_host" {
@@ -299,3 +296,15 @@ data "azurerm_user_assigned_identity" "uaid" {
   name                = local.uai_name
   resource_group_name = local.uai_resource_group
 }
+
+# emergency ssh configuration files
+resource "local_file" "ssh_config" {
+  filename         = "./ssh_config"
+  file_permissions = "0600"
+  content          = <<EOF
+  Host *
+    PreferredAuthentications publickey
+    IdentityFile ./emergency_ssh_key
+    ProxyJump root@${azurerm_public_ip.loadbalancer_ip[0].ip_address}
+  EOF
+}