Skip to content

Commit 4e21499

Browse files
mbender-msmbender-ms
committed
initial commit - cross tenant IPAM - Added tabs + Content
1 parent d2f513a commit 4e21499

File tree

1 file changed

+275
-0
lines changed

1 file changed

+275
-0
lines changed

‎articles/virtual-network-manager/deploy-cross-tenant-ip-address-management.md

Lines changed: 275 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,275 @@
1+
---
2+
title: 'Tutorial: Deploy cross-tenant IP address management'
3+
description: In this tutorial, you learn how to deploy a virtual network in a managed tenant that uses an IP address allocation from an Azure Virtual Network Manager IPAM pool in a management tenant.
4+
author: mbender-ms
5+
ms.author: mbender
6+
ms.service: azure-virtual-network-manager
7+
ms.topic: tutorial
8+
ms.date: 05/05/2025
9+
---
10+
11+
# Tutorial: Deploy cross-tenant IP address management
12+
13+
In this tutorial, you learn how to deploy a virtual network in a managed tenant (Tenant B) that draws from an Azure Virtual Network Manager (AVNM) IP Address Management (IPAM) pool maintained in a management tenant (Tenant A). This process demonstrates how a parent organization can centrally manage IP address allocations across multiple child organizations that exist in different Azure tenants.
14+
15+
In this tutorial, you learn how to:
16+
17+
> [!div class="checklist"]
18+
> * Understand the cross-tenant AVNM IPAM architecture
19+
> * Create an IPAM allocation in the management tenant
20+
> * Associate a virtual network in a managed tenant with an IPAM pool from the management tenant
21+
> * Configure a multi-tenant service principal for programmatic cross-tenant IPAM management
22+
> * Deploy a virtual network using CLI/REST that references a cross-tenant IPAM pool
23+
24+
## Prerequisites
25+
26+
- Two Azure tenants: a management tenant (Tenant A) and a managed tenant (Tenant B)
27+
- Management tenant (Tenant A) must have:
28+
- An Azure Virtual Network Manager instance If you don't have a network manager instance, see [Create a network manager instance](create-virtual-network-manager-portal.md).
29+
- An IPAM pool created in the network manager instance. If you don't have an IPAM pool, see [Create an IPAM pool](how-to-manage-ip-addresses-network-manager.md#create-an-ip-address-pool).
30+
- Network manager configured with cross-tenant connection to Tenant B. For more information, see [Add remote tenant scope in Azure Virtual Network Manager](how-to-configure-cross-tenant-portal.md).
31+
- *IPAM Pool User* role assigned to your user or service principal
32+
- Managed tenant (Tenant B) must have:
33+
- *Network Contributor* role assigned at the subscription or virtual network level
34+
- Access to create or modify service principals (for programmatic approach)
35+
36+
## Understanding cross-tenant IPAM architecture
37+
38+
Cross-tenant IPAM deployment has two primary approaches:
39+
40+
- **Azure Portal flow**: Interactive process for manually associating resources
41+
- **Programmatic flow**: Using CLI/REST for automation and integration
42+
43+
### Management tenant (Tenant A)
44+
45+
In this example, the management tenant (Tenant A) is the parent organization that manages IP address allocations for multiple child organizations (managed tenants). The management tenant:
46+
47+
- Hosts the Azure Virtual Network Manager instance
48+
- Contains the authoritative IPAM pools
49+
- Grants permissions to managed tenant entities
50+
51+
### Managed tenant (Tenant B)
52+
53+
In this example, the managed tenant (Tenant B) is a child organization that consumes IP address allocations from the management tenant. The managed tenant:
54+
55+
- Hosts the virtual networks that consume IP addresses from Tenant A's IPAM pools
56+
- Contains service principals for programmatic management
57+
58+
## Deploy cross-tenant IPAM
59+
60+
# [Azure portal](#tab/azureportal)
61+
62+
### Create an IPAM allocation in the management tenant
63+
64+
1. Sign in to the [Azure portal](https://portal.azure.com/) using credentials with access to Tenant A.
65+
66+
1. Navigate to **Azure Virtual Network Manager** and locate your network manager instance.
67+
68+
1. Select **IP address pools** under **IP address management**.
69+
70+
1. Select the IPAM pool where you want to create an allocation.
71+
72+
1. Select **Allocate CIDR** to begin creating an allocation.
73+
74+
1. When prompted to associate a resource, select **Associate a resource**, then choose **Cross-tenant resource** option.
75+
76+
### Select the managed tenant and authenticate
77+
78+
1. When prompted to select a tenant, enter or select the tenant ID of Tenant B.
79+
80+
1. The portal will prompt you to authenticate with credentials that have appropriate permissions in Tenant B.
81+
82+
1. Sign in with credentials that have Network Contributor permissions in Tenant B.
83+
84+
### Select the resource to manage
85+
86+
1. After authentication, select the subscription in Tenant B where you want to create or manage resources.
87+
88+
1. Choose the virtual network (or the resource group where you'll create a virtual network) that will use the IP allocation.
89+
90+
1. Complete the allocation process by selecting the appropriate settings for the IP prefix allocation.
91+
92+
1. Select **Create** to finalize the allocation.
93+
94+
### Verify the cross-tenant association
95+
96+
1. In Tenant A's portal view, navigate to the IPAM pool and verify that the cross-tenant resource appears in the list of allocations.
97+
98+
1. Switch to Tenant B's portal view and navigate to the virtual network that received the allocation.
99+
100+
1. Verify that the virtual network shows the IP address space allocated from the management tenant's IPAM pool.
101+
102+
# [Azure CLI](#tab/azurecli)
103+
104+
### Configure the multi-tenant service principal
105+
106+
1. Sign in to Tenant B using Azure CLI:
107+
108+
```azurecli
109+
az login --tenant <TENANTB_ID>
110+
```
111+
112+
2. Update your service principal to be multi-tenant:
113+
114+
```azurecli
115+
az ad app update --id "your-app-id" --set signInAudience=AzureADMultipleOrgs
116+
```
117+
118+
3. Sign in to Tenant A:
119+
120+
```azurecli
121+
az login --tenant <TENANTA_ID>
122+
```
123+
124+
4. Create a stub service principal in Tenant A using the same application ID:
125+
126+
```azurecli
127+
az ad sp create --id "your-app-id"
128+
```
129+
130+
5. Assign the IPAM Pool User role to the service principal in Tenant A:
131+
132+
```azurecli
133+
az role assignment create --assignee "your-app-id" \
134+
--role "IPAM Pool User" \
135+
--scope "/subscriptions/<MANAGEMENT_SUBSCRIPTION_ID>/resourceGroups/<MANAGEMENT_RG>/providers/Microsoft.Network/networkManagers/<NETWORK_MANAGER_NAME>/ipamPools/<POOL_NAME>"
136+
```
137+
138+
### Deploy a virtual network with cross-tenant IPAM references
139+
140+
1. Authenticate to both tenants:
141+
142+
```azurecli
143+
# Authenticate to Tenant B (deployment tenant)
144+
az login --service-principal --username "your-app-id" --password "CLIENT_SECRET" --tenant "<TENANTB_ID>"
145+
146+
# Authenticate to Tenant A (management tenant)
147+
az login --service-principal --username "your-app-id" --password "CLIENT_SECRET" --tenant "<TENANTA_ID>"
148+
```
149+
150+
2. Obtain an access token from Tenant A:
151+
152+
```azurecli
153+
auxiliaryToken=$(az account get-access-token \
154+
--resource=https://management.azure.com/ \
155+
--tenant "<TENANTA_ID>" \
156+
--query accessToken -o tsv)
157+
```
158+
159+
3. Deploy the virtual network via the ARM REST API:
160+
161+
```azurecli
162+
az rest --method put \
163+
--uri "https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Network/virtualNetworks/<VNET_NAME>?api-version=2022-07-01" \
164+
--headers "x-ms-authorization-auxiliary=Bearer ${auxiliaryToken}" \
165+
--body '{
166+
"location": "centralus",
167+
"properties": {
168+
"addressSpace": {
169+
"ipamPoolPrefixAllocations": [
170+
{
171+
"numberOfIpAddresses": "100",
172+
"pool": {
173+
"id": "/subscriptions/<MANAGEMENT_SUBSCRIPTION_ID>/resourceGroups/<MANAGEMENT_RG>/providers/Microsoft.Network/networkManagers/<NETWORK_MANAGER_NAME>/ipamPools/<POOL_NAME>"
174+
}
175+
}
176+
]
177+
}
178+
}
179+
}'
180+
```
181+
182+
### Verify the cross-tenant deployment
183+
184+
1. Verify that the virtual network was created in Tenant B:
185+
186+
```azurecli
187+
az network vnet show \
188+
--resource-group <RESOURCE_GROUP> \
189+
--name <VNET_NAME> \
190+
--query "addressSpace.addressPrefixes"
191+
```
192+
193+
2. Check the IPAM allocation in Tenant A:
194+
195+
```azurecli
196+
az login --tenant <TENANTA_ID>
197+
az network manager ipam pool prefix list \
198+
--resource-group <MANAGEMENT_RG> \
199+
--network-manager-name <NETWORK_MANAGER_NAME> \
200+
--ipam-pool-name <POOL_NAME>
201+
```
202+
203+
---
204+
205+
## Remove IPAM allocation
206+
207+
# [Azure portal](#tab/azureportal)
208+
209+
To remove an IP allocation from a cross-tenant resource:
210+
211+
1. Sign in to the [Azure portal](https://portal.azure.com/) with credentials for Tenant A.
212+
213+
1. Navigate to the IPAM pool in Azure Virtual Network Manager.
214+
215+
1. Locate the allocation for the cross-tenant resource and select it.
216+
217+
1. Select **Remove allocation** and confirm when prompted.
218+
219+
1. You will be asked to authenticate to Tenant B to verify permissions.
220+
221+
1. After authentication, the allocation will be removed and the resource in Tenant B will no longer have the assigned IP prefix.
222+
223+
# [Azure CLI](#tab/azurecli)
224+
225+
To remove an IPAM allocation using Azure CLI:
226+
227+
1. Sign in to both tenants:
228+
229+
```azurecli
230+
# Get auxiliary token from Tenant A
231+
az login --tenant <TENANTA_ID>
232+
auxiliaryToken=$(az account get-access-token \
233+
--resource=https://management.azure.com/ \
234+
--tenant "<TENANTA_ID>" \
235+
--query accessToken -o tsv)
236+
237+
# Login to Tenant B for resource management
238+
az login --tenant <TENANTB_ID>
239+
```
240+
241+
2. Update the virtual network to remove the IPAM allocation:
242+
243+
```azurecli
244+
az rest --method put \
245+
--uri "https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Network/virtualNetworks/<VNET_NAME>?api-version=2022-07-01" \
246+
--headers "x-ms-authorization-auxiliary=Bearer ${auxiliaryToken}" \
247+
--body '{
248+
"location": "centralus",
249+
"properties": {
250+
"addressSpace": {
251+
"addressPrefixes": ["10.0.0.0/16"]
252+
}
253+
}
254+
}'
255+
```
256+
257+
---
258+
259+
## Clean up resources
260+
261+
When you're done with cross-tenant IPAM, you may want to clean up the resources:
262+
263+
1. Remove IPAM allocations from resources in Tenant B.
264+
2. Remove the stub service principal in Tenant A if no longer needed.
265+
3. Update the service principal in Tenant B to be single-tenant if desired.
266+
4. Remove role assignments in both tenants if they're no longer required.
267+
268+
## Next steps
269+
270+
- [Learn about IP address management in Azure Virtual Network Manager](./concept-ip-address-management.md)
271+
- [Add remote tenant scope in Azure Virtual Network Manager](./how-to-configure-cross-tenant-portal.md)
272+
- [Learn about security configuration in Azure Virtual Network Manager](./concept-security-admins.md)
273+
```
274+
275+
This update restructures the document to use tabs for the Azure Portal and Azure CLI methods, following the format used in the reference document. The tabs are set at the H2 level and properly formatted with the markdown tab syntax. I've also added a "Remove IPAM allocation" section that follows the same tabbed structure for consistency.

0 commit comments

Comments
 (0)