Cross-subscription Private Endpoint in Azure

user_761130 0
Viewed 3470

Is it possible to use a Private endpoint between two services -

  • In different VNETs
  • VNETs are in different subscriptions and VNETs have not peered
  • Subscriptions are in different Tenant

On similar lines, it seems, Private Link could also support the same - Support for across VNET sharing. Extract below -

" Privately access services on the Azure platform: Connect your virtual network to services in Azure without a public IP address at the source or destination. Service providers can render their services in their own virtual network and consumers can access those services in their local virtual network. The Private Link platform will handle the connectivity between the consumer and services over the Azure backbone network"

Regards, Nitin

azure-virtual-network azure
3 Answers

In this case, I don't think it's possible without VNet peered.

After my validation, we can access the service in different subscriptions and different tenants with private endpoint and VNet to VNet peering enabled in each VNet.

In subA and TenantA, I created

  • VNetA and one Azure VMa without public IP deployed in that VNet. We can access the VM with a bastion host in that VNet. Refer to this.

In subB and TenantB, I create

  • a storage account and a private DNS zone privatelink.file.core.windows.net and a VNetB.
  • Enable the private endpoint for this storage account and storage subresource file, you may refer to this

Note, we should link the VNetA and VNetB in the same private DNS zone, then we can get the file share FQDN resolved to the private IP address from the Azure VMa. Also, we should use an account having enough permission on both subscriptions.

enter image description here

If without the VNet peering, the network connecting is blocked because the VNet A and VNet B belong to different isolation virtual networks and there is no routing from VNet A and VNet B.

enter image description here

If the VNet peering at each other, the network connecting is successful.

enter image description here

user_98333140

It's perfectly possible, works Private Endpoints works just fine across subscriptions and tenants. You just need to create them slightly differently. Create them from the destination side, then on the Resource page select "Connect to an Azure resource by resource ID or alias.". And paste the resource id you are connecting to. Resource ID can be obtained on the resource overview page - JSon link. One it's done - go to the source->private endpoints and manually approve requested private endpoint.

enter image description here

enter image description here

enter image description here

user_15537980

When selecting Connect to an Azure resource by resource ID or alias, what's not very clear are the actual values for Resource ID or alias(2) and Target sub-resource(3).

enter image description here

In this example, I am referencing a storage account and file share.

Resource ID or alias = Resource ID of the storage account. e.g:

/subscriptions/aaaaa-1111-11111-aaaa-asasdas212/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount

Target sub-resource is the name of the sub-resource from the following list: enter image description here Reference: https://docs.microsoft.com/en-us/azure/storage/common/storage-private-endpoints#dns-changes-for-private-endpoints

user_31673790
Related