Question 108266 in Azure Question posted in
The official documentation to get you started can be found here.

VNet whitelisting for Azure SQL Server across azure tenants

I have an Azure SQL Server residing in tenant A and I need to add a Virtual network rule for a subnet residing in tenant B.

For this, I have created a service principal and given it multi-tenant access. I am also able to see the SP in both tenants. The SP is given access to both the subscriptions and resources (SQL Server and VnNet) in both the tenants.

When I try to add the VNet rule using the SP credentials/login, I encounter the following error:

New-AzSqlServerVirtualNetworkRule:
The client has permission to perform action 'Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/Action'
on scope '/subscriptions/{subscription ID}/resourceGroups/{resource group name}/providers/Microsoft.Sql/servers/
{SQL Server name}/virtualNetworkRules/{rule name}',
however the current tenant 'xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' is not authorized to access linked subscription 'xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'.
Tags:

2

Answers


  1. 0

    To encounter the following error

    New-AzSqlServerVirtualNetworkRule: The client has permission to perform action 'Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/Action' on scope '/subscriptions/{subscription ID}/resourceGroups/{resource group name}/providers/Microsoft.Sql/servers/{SQL Server name}/virtualNetworkRules/{rule name}', however the current tenant 'xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' is not authorized to access linked subscription 'xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'.
    • The service connection in your Azure SQL Server across azure tenants will have only access to the virtual network in one tenant. It does not have access to the virtual network in the other tenant.
    • You can assign Network Contributor role to that virtual network in below steps:

    Go to Azure Portal ->Resource group -> Access Control (IAM) -> Add Role assignment. -> Select network Contributor -> Add

    enter image description here

    Login or Signup to reply.
  2. 0

    If I understand you correctly you want to connect resources that reside in two separate VNETs.

    Have you set up any VNET peering between the two networks (tutorial)?

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search