Skip to content

Commit dd9883d

Browse files
mbender-msmbender-ms
committed
split article into 2 separate experiences
1 parent 814b9e8 commit dd9883d

File tree

3 files changed

+201
-245
lines changed

3 files changed

+201
-245
lines changed

‎articles/virtual-network-manager/deploy-cross-tenant-ip-address-management-cli.md

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
---
2+
title: 'Deploy cross-tenant IP address management using Azure CLI/REST API'
3+
description: Learn how to deploy a virtual network in a managed tenant that uses an IP address allocation from an Azure Virtual Network Manager IPAM pool in a management tenant using Azure CLI or REST API.
4+
author: mbender-ms
5+
ms.author: mbender
6+
ms.service: azure-virtual-network-manager
7+
ms.topic: tutorial
8+
ms.date: 05/05/2025
9+
---
10+
11+
# Deploy cross-tenant IP address management using Azure CLI/REST API
12+
13+
This article demonstrates how to deploy a virtual network in a managed tenant (Tenant B) using an IP address allocation from an Azure Virtual Network Manager IP address management (IPAM) pool in a management tenant (Tenant A). You use the Azure CLI or REST API to configure cross-tenant IPAM, enabling centralized IP address management across multiple tenants. This guide also covers prerequisites, configuration steps, and how to remove IPAM allocations.
14+
15+
## Prerequisites
16+
17+
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
18+
- The [latest Azure CLI](/cli/azure/install-azure-cli) version installed.
19+
- Two Azure tenants: a management tenant (Tenant A) and a managed tenant (Tenant B)
20+
- Management tenant (Tenant A) must have:
21+
- An Azure Virtual Network Manager instance. If you don't have a network manager instance, see [Create a network manager instance](create-virtual-network-manager-portal.md).
22+
- An IPAM pool created in the network manager instance. If you don't have an IPAM pool, see [Create an IPAM pool](how-to-manage-ip-addresses-network-manager.md#create-an-ip-address-pool).
23+
- Network manager configured with cross-tenant connection to Tenant B. For more information, see [Add remote tenant scope in Azure Virtual Network Manager](how-to-configure-cross-tenant-portal.md).
24+
- *IPAM Pool User* role assigned to your user or service principal.
25+
- Managed tenant (Tenant B) must have:
26+
- *Network Contributor* role assigned at the subscription or virtual network level.
27+
- A service principal with the *Network Contributor* role assigned at the subscription or resource level for using the Azure CLI or REST API.
28+
29+
### Configure the multitenant service principal
30+
31+
1. Sign in to Tenant B using Azure CLI:
32+
33+
```azurecli
34+
az login --tenant <managedTenantID>
35+
```
36+
37+
2. Update your service principal to be multitenant:
38+
39+
```azurecli
40+
az ad app update --id "<servicePrincipalAppID>" --set signInAudience=AzureADMultipleOrgs
41+
```
42+
43+
3. Sign in to Tenant A:
44+
45+
```azurecli
46+
az login --tenant <managementTenantID>
47+
```
48+
49+
4. Create a stub service principal in Tenant A using the same application ID:
50+
51+
```azurecli
52+
az ad sp create --id "<servicePrincipalAppID>"
53+
```
54+
55+
5. Assign the *IPAM Pool User* role to the service principal in Tenant A:
56+
57+
```azurecli
58+
az role assignment create --assignee "<servicePrincipalAppID>" --role "IPAM Pool User" --scope "/subscriptions/<managementTenantSubscriptionID>/resourceGroups/<managementTenantResourceGroupName>/providers/Microsoft.Network/networkManagers/<networkManagerName>/ipamPools/<ipamPoolName>"
59+
```
60+
61+
### Deploy a virtual network with cross-tenant IPAM references
62+
63+
1. Authenticate to both tenants:
64+
65+
```azurecli
66+
az login --service-principal --username "<servicePrincipalAppID>" --password "<servicePrincipalPassword>" --tenant "<managedTenantID>"
67+
az login --service-principal --username "<servicePrincipalAppID>" --password "<servicePrincipalPassword>" --tenant "<managementTenantID>"
68+
```
69+
70+
2. Obtain an access token from Tenant A:
71+
72+
```azurecli
73+
auxiliaryToken=$(az account get-access-token \
74+
--resource=https://management.azure.com/ \
75+
--tenant "<managementTenantID>" \
76+
--query accessToken -o tsv)
77+
```
78+
79+
3. Deploy the virtual network via the Azure Resource Manager REST API:
80+
81+
```azurecli
82+
az rest --method put \
83+
--uri "https://management.azure.com/subscriptions/<managedTenantSubscriptionID>/resourceGroups/<managedTenantResourceGroupName>/providers/Microsoft.Network/virtualNetworks/<managedTenantVirtualNetworkName>?api-version=2022-07-01" \
84+
--headers "x-ms-authorization-auxiliary=Bearer ${auxiliaryToken}" \
85+
--body '{
86+
"location": "centralus",
87+
"properties": {
88+
"addressSpace": {
89+
"ipamPoolPrefixAllocations": [
90+
{
91+
"numberOfIpAddresses": "100",
92+
"pool": {
93+
"id": "/subscriptions/<managementTenantSubscriptionID>/resourceGroups/<managementTenantResourceGroupName>/providers/Microsoft.Network/networkManagers/<networkManagerName>/ipamPools/<ipamPoolName>"
94+
}
95+
}
96+
]
97+
}
98+
}
99+
}'
100+
```
101+
102+
## Remove IPAM allocation using Azure CLI
103+
104+
1. Sign in to both tenants and obtain an auxiliary token from Tenant A:
105+
106+
```azurecli
107+
az login --tenant <managementTenantID>
108+
auxiliaryToken=$(az account get-access-token \
109+
--resource=https://management.azure.com/ \
110+
--tenant "<managementTenantID>" \
111+
--query accessToken -o tsv)
112+
```
113+
114+
2. Update the virtual network to remove the IPAM allocation:
115+
116+
```azurecli
117+
az rest --method put \
118+
--uri "https://management.azure.com/subscriptions/<managedTenantSubscriptionID>/resourceGroups/<managedTenantResourceGroupName>/providers/Microsoft.Network/virtualNetworks/<managedTenantVirtualNetworkName>?api-version=2022-07-01" \
119+
--headers "x-ms-authorization-auxiliary=Bearer ${auxiliaryToken}" \
120+
--body '{
121+
"location": "centralus",
122+
"properties": {
123+
"addressSpace": {
124+
"addressPrefixes": ["10.0.0.0/16"]
125+
}
126+
}
127+
}'
128+
```
129+
130+
## Next steps
131+
132+
- [Learn about IP address management in Azure Virtual Network Manager](./concept-ip-address-management.md)
133+
- [Add remote tenant scope in Azure Virtual Network Manager](./how-to-configure-cross-tenant-portal.md)

‎articles/virtual-network-manager/deploy-cross-tenant-ip-address-management-portal.md

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
---
2+
title: 'Deploy cross-tenant IP address management using the Azure portal'
3+
description: Learn how to deploy a virtual network in a managed tenant that uses an IP address allocation from an Azure Virtual Network Manager IPAM pool in a management tenant using the Azure portal.
4+
author: mbender-ms
5+
ms.author: mbender
6+
ms.service: azure-virtual-network-manager
7+
ms.topic: tutorial
8+
ms.date: 05/05/2025
9+
---
10+
11+
# Deploy cross-tenant IP address management using the Azure portal
12+
13+
This article demonstrates how to deploy a virtual network in a managed tenant (Tenant B) using an IP address allocation from an Azure Virtual Network Manager IP address management (IPAM) pool in a management tenant (Tenant A). You use the Azure portal to configure cross-tenant IPAM, enabling centralized IP address management across multiple tenants. This guide also covers prerequisites, configuration steps, and how to remove IPAM allocations.
14+
15+
## Prerequisites
16+
17+
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
18+
- Two Azure tenants: a management tenant (Tenant A) and a managed tenant (Tenant B)
19+
- Management tenant (Tenant A) must have:
20+
- An Azure Virtual Network Manager instance. If you don't have a network manager instance, see [Create a network manager instance](create-virtual-network-manager-portal.md).
21+
- An IPAM pool created in the network manager instance. If you don't have an IPAM pool, see [Create an IPAM pool](how-to-manage-ip-addresses-network-manager.md#create-an-ip-address-pool).
22+
- Network manager configured with cross-tenant connection to Tenant B. For more information, see [Add remote tenant scope in Azure Virtual Network Manager](how-to-configure-cross-tenant-portal.md).
23+
- *IPAM Pool User* role assigned to your user or service principal.
24+
- Managed tenant (Tenant B) must have:
25+
- *Network Contributor* role assigned at the subscription or virtual network level.
26+
27+
## Deploy cross-tenant IPAM using the Azure portal
28+
29+
### Create an IPAM allocation in the management tenant
30+
31+
1. Sign in to the [Azure portal](https://portal.azure.com/) using credentials with access to Tenant A.
32+
1. Navigate to **Azure Virtual Network Manager** and locate your network manager instance.
33+
1. Select **IP address pools** under **IP address management**.
34+
1. Select the IPAM pool where you want to create an allocation.
35+
1. Select **+ Create** > **Allocate resources**.
36+
1. In the **Allocate resources** pane, select the **Tenant :** dropdown and choose the managed tenant (Tenant B) where you want to allocate IP addresses.
37+
1. Select **Apply** and then select **Authenticate**.
38+
39+
> [!NOTE]
40+
> The authentication process requires you to sign in with a user or service principal that has the *Network Contributor* role in Tenant B at the subscription or resource level.
41+
42+
1. After authentication, select the virtual network, you want to associate with the IP address pool and select **Associate**.
43+
44+
### Verify the cross-tenant association
45+
46+
1. In Tenant A's portal view, navigate to your IP address pool and select **Allocations** under **Settings**.
47+
1. Select **Resources** and verify that the virtual network from Tenant B is listed as an allocated resource.
48+
1. Switch to Tenant B's portal view and navigate to the virtual network that received the allocation.
49+
1. Select **Subnets** under **Settings** and verify the name listed under **IPAM pool** matches the name of the IPAM pool in the management tenant (Tenant A).
50+
51+
## Remove IPAM allocation
52+
53+
To remove an IP allocation from a cross-tenant resource:
54+
55+
1. Sign in to the [Azure portal](https://portal.azure.com/) with credentials for Tenant A.
56+
1. Navigate to **Azure Virtual Network Manager** and locate your network manager instance.
57+
1. Select **IP address pools** under **IP address management**.
58+
1. On the **IP address pools** page, select **Allocations** under **Settings**.
59+
1. Select the virtual network that you want to remove the IPAM allocation from.
60+
1. Select **X Remove**.
61+
1. Authenticate to Tenant B and complete authentication.
62+
1. Once authenticated, select **Yes** to remove the IPAM allocation.
63+
1. Refresh the page to verify that the IPAM allocation is removed.
64+
65+
## Next steps
66+
67+
- [Learn about IP address management in Azure Virtual Network Manager](./concept-ip-address-management.md)
68+
- [Add remote tenant scope in Azure Virtual Network Manager](./how-to-configure-cross-tenant-portal.md)

0 commit comments

Comments
 (0)