You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/virtual-network/create-peering-different-subscriptions.md
+46-12Lines changed: 46 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -30,21 +30,33 @@ This tutorial peers virtual networks in the same region. You can also peer virtu
30
30
31
31
## Prerequisites
32
32
33
+
# [**Portal**](#tab/create-peering-portal)
34
+
33
35
- An Azure account(s) with two active subscriptions. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
34
36
35
37
- An Azure account with permissions in both subscriptions or an account in each subscription with the proper permissions to create a virtual network peering. For a list of permissions, see [Virtual network peering permissions](virtual-network-manage-peering.md#permissions).
36
38
37
-
-If the virtual networks are in different subscriptions and Active Directory tenants, and you intend to separate the duty of managing the network belonging to each tenant, then add the user from each tenant as a guest in the opposite tenant and assign them a reader role to the virtual network.
39
+
-To separate the duty of managing the network belonging to each tenant, add the user from each tenant as a guest in the opposite tenant and assign them a reader role to the virtual network. This procedure applies if the virtual networks are in different subscriptions and Active Directory tenants.
38
40
39
-
-If the virtual networks are in different subscriptions and Active Directory tenants, and you do not intend to separate the duty of managing the network belonging to each tenant, then add the user from tenant A as a guest in the opposite tenant and assign them the correct permissions to establish a network peering. This user will be able to initiate and connect the network peering from each subscription.
41
+
-To establish a network peering when you don't intend to separate the duty of managing the network belonging to each tenant, add the user from tenant A as a guest in the opposite tenant. Then, assign them the correct permissions to initiate and connect the network peering from each subscription. With these permissions, the user is able to establish the network peering from each subscription.
40
42
41
43
- For more information about guest users, see [Add Azure Active Directory B2B collaboration users in the Azure portal](../active-directory/external-identities/add-users-administrator.md?toc=%2fazure%2fvirtual-network%2ftoc.json#add-guest-users-to-the-directory).
42
44
43
45
- Each user must accept the guest user invitation from the opposite Azure Active Directory tenant.
- This how-to article requires version 2.31.0 or later of the Azure CLI. If using Azure Cloud Shell, the latest version is already installed.
49
+
- An Azure account(s) with two active subscriptions. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
50
+
51
+
- An Azure account with permissions in both subscriptions or an account in each subscription with the proper permissions to create a virtual network peering. For a list of permissions, see [Virtual network peering permissions](virtual-network-manage-peering.md#permissions).
52
+
53
+
- To separate the duty of managing the network belonging to each tenant, add the user from each tenant as a guest in the opposite tenant and assign them a reader role to the virtual network. This procedure applies if the virtual networks are in different subscriptions and Active Directory tenants.
54
+
55
+
- To establish a network peering when you don't intend to separate the duty of managing the network belonging to each tenant, add the user from tenant A as a guest in the opposite tenant. Then, assign them the correct permissions to initiate and connect the network peering from each subscription. With these permissions, the user is able to establish the network peering from each subscription.
56
+
57
+
- For more information about guest users, see [Add Azure Active Directory B2B collaboration users in the Azure portal](../active-directory/external-identities/add-users-administrator.md?toc=%2fazure%2fvirtual-network%2ftoc.json#add-guest-users-to-the-directory).
58
+
59
+
- Each user must accept the guest user invitation from the opposite Azure Active Directory tenant.
48
60
49
61
- Azure PowerShell installed locally or Azure Cloud Shell.
50
62
@@ -54,7 +66,27 @@ This tutorial peers virtual networks in the same region. You can also peer virtu
54
66
55
67
If you choose to install and use PowerShell locally, this article requires the Azure PowerShell module version 5.4.1 or later. Run `Get-Module -ListAvailable Az` to find the installed version. If you need to upgrade, see [Install Azure PowerShell module](/powershell/azure/install-Az-ps). If you're running PowerShell locally, you also need to run `Connect-AzAccount` to create a connection with Azure.
56
68
57
-
In the following steps, you'll learn how to peer virtual networks in different subscriptions and Azure Active Directory tenants.
69
+
# [**Azure CLI**](#tab/create-peering-cli)
70
+
71
+
- An Azure account(s) with two active subscriptions. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
72
+
73
+
- An Azure account with permissions in both subscriptions or an account in each subscription with the proper permissions to create a virtual network peering. For a list of permissions, see [Virtual network peering permissions](virtual-network-manage-peering.md#permissions).
74
+
75
+
- To separate the duty of managing the network belonging to each tenant, add the user from each tenant as a guest in the opposite tenant and assign them a reader role to the virtual network. This procedure applies if the virtual networks are in different subscriptions and Active Directory tenants.
76
+
77
+
- To establish a network peering when you don't intend to separate the duty of managing the network belonging to each tenant, add the user from tenant A as a guest in the opposite tenant. Then, assign them the correct permissions to initiate and connect the network peering from each subscription. With these permissions, the user is able to establish the network peering from each subscription.
78
+
79
+
- For more information about guest users, see [Add Azure Active Directory B2B collaboration users in the Azure portal](../active-directory/external-identities/add-users-administrator.md?toc=%2fazure%2fvirtual-network%2ftoc.json#add-guest-users-to-the-directory).
80
+
81
+
- Each user must accept the guest user invitation from the opposite Azure Active Directory tenant.
- This how-to article requires version 2.31.0 or later of the Azure CLI. If using Azure Cloud Shell, the latest version is already installed.
86
+
87
+
---
88
+
89
+
In the following steps, learn how to peer virtual networks in different subscriptions and Azure Active Directory tenants.
58
90
59
91
You can use the same account that has permissions in both subscriptions or you can use separate accounts for each subscription to set up the peering. An account with permissions in both subscriptions can complete all of the steps without signing out and signing in to portal and assigning permissions.
60
92
@@ -282,7 +314,7 @@ Use [az ad user list](/cli/azure/ad/user#az-ad-user-list) to obtain the object I
282
314
```azurecli-interactive
283
315
az ad user list --display-name UserB
284
316
```
285
-
```bash
317
+
```output
286
318
[
287
319
{
288
320
"businessPhones": [],
@@ -368,7 +400,7 @@ echo $vnetidA
368
400
369
401
## Create virtual network - myVNetB
370
402
371
-
In this section, you'll sign in as **UserB** and create a virtual network for the peering connection to **myVNetA**.
403
+
In this section, you sign in as **UserB** and create a virtual network for the peering connection to **myVNetA**.
372
404
373
405
# [**Portal**](#tab/create-peering-portal)
374
406
@@ -583,7 +615,7 @@ Use [az ad user list](/cli/azure/ad/user#az-ad-user-list) to obtain the object I
583
615
az ad user list --display-name UserA
584
616
```
585
617
586
-
```bash
618
+
```output
587
619
[
588
620
{
589
621
"businessPhones": [],
@@ -667,7 +699,7 @@ echo $vnetidB
667
699
668
700
## Create peering connection - myVNetA to myVNetB
669
701
670
-
You'll need the **Resource ID** for **myVNetB** from the previous steps to set up the peering connection.
702
+
You need the **Resource ID** for **myVNetB** from the previous steps to set up the peering connection.
671
703
672
704
# [**Portal**](#tab/create-peering-portal)
673
705
@@ -837,11 +869,11 @@ az network vnet peering list \
837
869
838
870
---
839
871
840
-
The peering connection will show in **Peerings** in a **Initiated** state. To complete the peer, a corresponding connection must be set up in **myVNetB**.
872
+
The peering connection shows in **Peerings** in a **Initiated** state. To complete the peer, a corresponding connection must be set up in **myVNetB**.
841
873
842
874
## Create peering connection - myVNetB to myVNetA
843
875
844
-
You'll need the **Resource IDs** for **myVNetA** from the previous steps to set up the peering connection.
876
+
You need the **Resource IDs** for **myVNetA** from the previous steps to set up the peering connection.
845
877
846
878
# [**Portal**](#tab/create-peering-portal)
847
879
@@ -1015,7 +1047,9 @@ For more information about using your own DNS for name resolution, see, [Name re
1015
1047
For more information about Azure DNS, see [What is Azure DNS?](../dns/dns-overview.md).
1016
1048
1017
1049
## Next steps
1018
-
<!-- Add a context sentence for the following links -->
1050
+
1019
1051
- Thoroughly familiarize yourself with important [virtual network peering constraints and behaviors](virtual-network-manage-peering.md#requirements-and-constraints) before creating a virtual network peering for production use.
1052
+
1020
1053
- Learn about all [virtual network peering settings](virtual-network-manage-peering.md#create-a-peering).
1054
+
1021
1055
- Learn how to [create a hub and spoke network topology](/azure/architecture/reference-architectures/hybrid-networking/hub-spoke#virtual-network-peering) with virtual network peering.
0 commit comments