Here's my aaa config, I'm using authorization but I don't see any logs in my ACS when RME attempts to use SCP.

aaa authentication login default group tacacs+ local enable

aaa authentication enable default line group tacacs+ enable

aaa authorization config-commands

aaa authorization commands 15 default group tacacs+ local

aaa accounting exec default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

aaa accounting network default start-stop group tacacs+

ip ssh version 2

ip scp server enable

You need to be using exec-level authorization. You have authorization only for config-commands and commands. See my example config.

[Edit]

When the user logs in, they should be immediately dropped to a '#' prompt. The "show privilege" command should indicate they have level 15 access.

Thanks Joe, this was exactly what was missing,

aaa authorization exec default group tacacs+,

it now works perfectly.

For non-TACACS configs, this config also works:

aaa authorization exec default local if-authenticated

Hi JOY,

I am also facing same problem.Actually, when I try to run SCP command from CMD it is showing privilege denied. I have configure device according to your post. 

we are using ACS tacacs server for aaa, have privilege 15 access also.

we have logged in the device using SSH successfully.

ERROR:-C:\Users\Administrator>scp spectrum@10.192.10.97:running-config .
password:
Authentication succeeded. Your password will expire in 1 weeks + 1 days + 3 hou
rs + 31 Minutes
Privilege denied.
Connection to 10.192.10.97 closed by remote host.

Please provide the solution ASAP.

Regards 

Deependra