Skip to content

Commit 067a45f

Browse files
ShannonLeavittShannonLeavitt
authored
Merge pull request #216758 from mbender-ms/avnm-cross-tenant-cli
AVNM - New Article - Cross-tennant connection How-to w/ CLI
2 parents 8cbbf67 + df081d1 commit 067a45f

File tree

2 files changed

+120
-0
lines changed

2 files changed

+120
-0
lines changed

‎articles/virtual-network-manager/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,8 @@
7777
items:
7878
- name: Configure cross-tenant connection - Portal
7979
href: how-to-configure-cross-tenant-portal.md
80+
- name: Configure cross-tenant connection - CLI
81+
href: how-to-configure-cross-tenant-cli.md
8082
- name: View applied configurations
8183
href: how-to-view-applied-configurations.md
8284
- name: Define dynamic network group membership with Azure Policy

‎articles/virtual-network-manager/how-to-configure-cross-tenant-cli.md

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
---
2+
title: Configure cross-tenant connection in Azure Virtual Network Manager - CLI
3+
description: Learn to connect Azure subscriptions in Azure Virtual Network Manager using cross-tenant connections for the management of virtual networks across subscriptions.
4+
author: mbender-ms
5+
ms.author: mbender
6+
ms.service: virtual-network-manager
7+
ms.topic: how-to
8+
ms.date: 11/1/2022
9+
ms.custom: template-how-to
10+
#customerintent: As a cloud admin, in need to manage multi tenants from a single network manager instance. Cross tenant functionality will give me this so I can easily manage all network resources governed by azure virtual network manager
11+
---
12+
13+
# Configure cross-tenant connection in Azure Virtual Network Manager
14+
15+
In this article, you’ll learn how-to create cross-tenant connections in Azure Virtual Network Manager using [Azure CLI](/cli/azure/network/manager/scope-connection). Cross-tenant support allows organizations to use a central Network Manager instance for managing virtual networks across different tenants and subscriptions. First, you'll create the scope connection on the central network manager. Then you'll create the network manager connection on the connecting tenant, and verify connection. Last, you'll add virtual networks from different tenants and verify. Once completed, You can centrally manage the resources of other tenants from a central network manager instance.
16+
17+
> [!IMPORTANT]
18+
> Azure Virtual Network Manager is currently in public preview.
19+
> This preview version is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities.
20+
> For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
21+
22+
## Prerequisites
23+
24+
- Two Azure tenants with virtual networks needing to be managed by Azure Virtual Network Manager Deploy. During the how-to, the tenants will be referred to as follows:
25+
- **Central management tenant** - The tenant where an Azure Virtual Network Manager instance is installed, and you'll centrally manage network groups from cross-tenant connections.
26+
- **Target managed tenant** - The tenant containing virtual networks to be managed. This tenant will be connected to the central management tenant.
27+
- Azure Virtual Network Manager deployed in the central management tenant.
28+
- Required permissions include:
29+
- Administrator of central management tenant has guest account in target managed tenant.
30+
- Administrator guest account has *Network Contributor* permissions applied at appropriate scope level(Management group, subscription, or virtual network).
31+
32+
Need help with setting up permissions? Check out how to [add guest users in the Azure portal](../active-directory/external-identities/b2b-quickstart-add-guest-users-portal.md), and how to [assign user roles to resources in Azure portal](../role-based-access-control/role-assignments-portal.md)
33+
34+
## Create scope connection within network manager
35+
36+
Creation of the scope connection begins on the central management tenant with a network manager deployed, which is the network manager where you plan to manage all of your resources across tenants. In this task, you'll set up a scope connection to add a subscription from a target tenant. If you wish to use a management group, you'll modify the `–resource-id` argument to look like `/providers/Microsoft.Management/managementGroups/{mgId}`.
37+
38+
```azurecli
39+
# Create scope connection in network manager in the central management tenant
40+
az network manager scope-connection create --resource-group "myRG" --network-manager-name "myAVNM" --name "ToTargetManagedTenant" --description "This is a connection to manage resources in the target managed tenant" --resource-id "/subscriptions/13579864-1234-5678-abcd-0987654321ab" --tenant-id "24680975-1234-abcd-56fg-121314ab5643"
41+
```
42+
43+
## Create network manager connection on subscription in other tenant
44+
Once the scope connection is created, you'll switch to your target tenant for the network manager connection. During this task, you'll connect the target tenant to the scope connection created previously and verify the connection state.
45+
46+
1. Enter the following command to connect to the target managed tenant with your administrative account:
47+
48+
```azurecli
49+
50+
# Login to target managed tenant
51+
# Note: Change the --tenant value to the appropriate tenant ID
52+
az login --tenant "12345678-12a3-4abc-5cde-678909876543"
53+
```
54+
You'll be required to complete authentication with your organization based on your organizations policies.
55+
56+
1. Enter the following command to create the cross tenant connection on the central management.
57+
Set the subscription (note it’s the same as the one the connection references in step 1).
58+
59+
```azurecli
60+
# Set the Azure subscription
61+
az account set --subscription 87654321-abcd-1234-1def-0987654321ab
62+
63+
64+
# Create cross-tenant connection to central management tenant
65+
az network manager connection subscription create --connection-name "toCentralManagementTenant" --description "This connection allows management of the tenant by a central management tenant" --network-manager-id "/subscriptions/13579864-1234-5678-abcd-0987654321ab/resourceGroups/myRG/providers/Microsoft.Network/networkManagers/myAVNM"
66+
```
67+
68+
## Verify the connection state
69+
70+
1. Enter the following command to check the connection Status:
71+
72+
```azurecli
73+
# Check connection status
74+
az network manager connection subscription show --name "toCentralManagementTenant"
75+
```
76+
77+
1. Switch back to the central management tenant, and performing a get on the network manager shows the subscription added via the cross tenant scopes property.
78+
79+
```azurecli
80+
# View subscription added to network manager
81+
az network manager show --resource-group myAVNMResourceGroup --name myAVNM
82+
```
83+
84+
## Add static members to your network group
85+
In this task, you'll add a cross-tenant virtual network to your network group with static membership. The virtual network subscription used below is the same as referenced when creating connections above.
86+
87+
```azurecli
88+
# Create network group with static member from target managed tenant
89+
az network manager group static-member create --network-group-name "CrossTenantNetworkGroup" --network-manager-name "myAVNM" --resource-group "myAVNMResourceGroup" --static-member-name "targetVnet01" --resource-id="/subscriptions/87654321-abcd-1234-1def-0987654321ab
90+
/resourceGroups/myScopeAVNM/providers/Microsoft.Network/virtualNetworks/targetVnet01"
91+
```
92+
## Delete virtual network manager configurations
93+
94+
Now that the virtual network is in the network group, configurations will be applied. To remove the static member or cross-tenant resources, use the corresponding delete commands.
95+
96+
```azurecli
97+
98+
# Delete static member group
99+
az network manager group static-member delete --network-group-name "CrossTenantNetworkGroup" --network-manager-name " myAVNM" --resource-group "myRG" --static-member-name "fabrikamVnet”
100+
101+
# Delete scope connections
102+
az network manager scope-connection delete --resource-group "myRG" --network-manager-name "myAVNM" --name "ToTargetManagedTenant"
103+
104+
# Switch to ‘managed tenant’ if needed
105+
#
106+
az network manager connection subscription delete --name "toCentralManagementTenant"
107+
108+
```
109+
110+
## Next steps
111+
112+
> [!div class="nextstepaction"]
113+
114+
- Learn more about [Security admin rules](concept-security-admins.md).
115+
116+
- Learn how to [create a mesh network topology with Azure Virtual Network Manager using the Azure portal](how-to-create-mesh-network.md)
117+
118+
- Check out the [Azure Virtual Network Manager FAQ](faq.md)

0 commit comments

Comments
 (0)