You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Learn to connect Azure subscriptions in Azure Virtual Network Manager using cross-tenant connections for the management of virtual networks across subscriptions.
2
+
title: Configure a cross-tenant connection in Azure Virtual Network Manager Preview - CLI
3
+
description: Learn how to connect Azure subscriptions in Azure Virtual Network Manager by using cross-tenant connections for the management of virtual networks across subscriptions.
4
4
author: mbender-ms
5
5
ms.author: mbender
6
6
ms.service: virtual-network-manager
7
7
ms.topic: how-to
8
8
ms.date: 11/1/2022
9
9
ms.custom: template-how-to
10
-
#customerintent: As a cloud admin, in need to manage multi tenants from a single network manager instance. Cross tenant functionality will give me this so I can easily manage all network resources governed by azure virtual network manager
10
+
#customerintent: As a cloud admin, I need to manage multiple tenants from a single network manager so that I can easily manage all network resources governed by Azure Virtual Network Manager.
11
11
---
12
12
13
-
# Configure cross-tenant connection in Azure Virtual Network Manager
13
+
# Configure a cross-tenant connection in Azure Virtual Network Manager Preview - CLI
14
14
15
-
In this article, you’ll learn how-to create [cross-tenant connections](concept-cross-tenant.md) in Azure Virtual Network Manager using [Azure CLI](/cli/azure/network/manager/scope-connection). Cross-tenant support allows organizations to use a central Network Manager instance for managing virtual networks across different tenants and subscriptions. First, you'll create the scope connection on the central network manager. Then you'll create the network manager connection on the connecting tenant, and verify connection. Last, you'll add virtual networks from different tenants and verify. Once completed, You can centrally manage the resources of other tenants from a central network manager instance.
15
+
In this article, you'll learn how to create [cross-tenant connections](concept-cross-tenant.md) in Azure Virtual Network Manager by using the [Azure CLI](/cli/azure/network/manager/scope-connection). Cross-tenant support allows organizations to use a central network manager for managing virtual networks across tenants and subscriptions.
16
+
17
+
First, you'll create the scope connection on the central network manager. Then, you'll create the network manager connection on the connecting tenant and verify the connection. Last, you'll add virtual networks from different tenants and verify. After you complete all the tasks, you can centrally manage the resources of other tenants from your network manager.
16
18
17
19
> [!IMPORTANT]
18
-
> Azure Virtual Network Manager is currently in public preview.
19
-
> This preview version is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities.
20
-
> For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
20
+
> Azure Virtual Network Manager is currently in public preview. We provide this preview version without a service-level agreement, and we don't recommend it for production workloads. Certain features might not be supported or might have constrained capabilities. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
21
21
22
22
## Prerequisites
23
23
24
-
- Two Azure tenants with virtual networks needing to be managed by Azure Virtual Network Manager Deploy. During the how-to, the tenants will be referred to as follows:
25
-
-**Central management tenant** - The tenant where an Azure Virtual Network Manager instance is installed, and you'll centrally manage network groups from cross-tenant connections.
26
-
-**Target managed tenant** - The tenant containing virtual networks to be managed. This tenant will be connected to the central management tenant.
24
+
- Two Azure tenants with virtual networks that you want to manage through Azure Virtual Network Manager. This article refers to the tenants as follows:
25
+
-**Central management tenant**: The tenant where an Azure Virtual Network Manager instance is installed, and where you'll centrally manage network groups from cross-tenant connections.
26
+
-**Target managed tenant**: The tenant that contains virtual networks to be managed. This tenant will be connected to the central management tenant.
27
27
- Azure Virtual Network Manager deployed in the central management tenant.
28
-
- Required permissions include:
29
-
- Administrator of central management tenant has guest account in target managed tenant.
30
-
- Administrator guest account has *Network Contributor* permissions applied at appropriate scope level(Management group, subscription, or virtual network).
28
+
- These permissions:
29
+
- The administrator of the central management tenant has a guest account in the target managed tenant.
30
+
- The administrator guest account has *Network Contributor* permissions applied at the appropriate scope level (management group, subscription, or virtual network).
31
+
32
+
Need help with setting up permissions? Check out how to [add guest users in the Azure portal](../active-directory/external-identities/b2b-quickstart-add-guest-users-portal.md) and how to [assign user roles to resources in the Azure portal](../role-based-access-control/role-assignments-portal.md).
31
33
32
-
Need help with setting up permissions? Check out how to [add guest users in the Azure portal](../active-directory/external-identities/b2b-quickstart-add-guest-users-portal.md), and how to [assign user roles to resources in Azure portal](../role-based-access-control/role-assignments-portal.md)
34
+
## Create a scope connection within a network manager
33
35
34
-
## Create scope connection within network manager
36
+
Creation of the scope connection begins on the central management tenant with a network manager deployed. This is the network manager where you plan to manage all of your resources across tenants.
35
37
36
-
Creation of the scope connection begins on the central management tenant with a network manager deployed, which is the network manager where you plan to manage all of your resources across tenants. In this task, you'll set up a scope connection to add a subscription from a target tenant. If you wish to use a management group, you'll modify the `–resource-id` argument to look like `/providers/Microsoft.Management/managementGroups/{mgId}`.
38
+
In this task, you set up a scope connection to add a subscription from a target tenant. If you want to use a management group, modify the `–resource-id` argument to look like `/providers/Microsoft.Management/managementGroups/{mgId}`.
37
39
38
40
```azurecli
39
-
# Create scope connection in network manager in the central management tenant
41
+
# Create a scope connection in the network manager in the central management tenant
40
42
az network manager scope-connection create --resource-group "myRG" --network-manager-name "myAVNM" --name "ToTargetManagedTenant" --description "This is a connection to manage resources in the target managed tenant" --resource-id "/subscriptions/13579864-1234-5678-abcd-0987654321ab" --tenant-id "24680975-1234-abcd-56fg-121314ab5643"
41
43
```
42
44
43
-
## Create network manager connection on subscription in other tenant
44
-
Once the scope connection is created, you'll switch to your target tenant for the network manager connection. During this task, you'll connect the target tenant to the scope connection created previously and verify the connection state.
45
+
## Create a network manager connection on a subscription in another tenant
46
+
47
+
After you create the scope connection, you switch to your target tenant for the network manager connection. In this task, you connect the target tenant to the scope connection that you created previously. You also verify the connection state.
45
48
46
-
1. Enter the following command to connect to the target managed tenant with your administrative account:
49
+
1. Enter the following command to connect to the target managed tenant by using your administrative account:
47
50
48
51
```azurecli
49
52
50
-
# Login to target managed tenant
51
-
# Note: Change the --tenant value to the appropriate tenant ID
53
+
# Log in to the target managed tenant
54
+
# Change the --tenant value to the appropriate tenant ID
52
55
az login --tenant "12345678-12a3-4abc-5cde-678909876543"
53
56
```
54
-
You'll be required to complete authentication with your organization based on your organizations policies.
57
+
58
+
You're required to complete authentication with your organization, based on your organization's policies.
55
59
56
-
1. Enter the following command to create the cross tenant connection on the central management.
57
-
Set the subscription (note it’s the same as the one the connection references in step 1).
60
+
1. Enter the following commands to set the subscription and to create the cross-tenant connection on the central management tenant. The subscription is the same as the one that the connection referenced in the previous step.
58
61
59
62
```azurecli
60
63
# Set the Azure subscription
61
64
az account set --subscription 87654321-abcd-1234-1def-0987654321ab
62
65
63
66
64
-
# Create cross-tenant connection to central management tenant
67
+
# Create a cross-tenant connection to the central management tenant
65
68
az network manager connection subscription create --connection-name "toCentralManagementTenant" --description "This connection allows management of the tenant by a central management tenant" --network-manager-id "/subscriptions/13579864-1234-5678-abcd-0987654321ab/resourceGroups/myRG/providers/Microsoft.Network/networkManagers/myAVNM"
66
69
```
67
70
68
-
## Verify the connection state
71
+
## Verify the connection status
69
72
70
-
1. Enter the following command to check the connection Status:
73
+
1. Enter the following command to check the connection status:
71
74
72
75
```azurecli
73
76
# Check connection status
74
77
az network manager connection subscription show --name "toCentralManagementTenant"
75
78
```
76
79
77
-
1. Switch back to the central management tenant, and performing a get on the network manager shows the subscription added via the cross tenant scopes property.
80
+
1. Switch back to the central management tenant. Use the `show` command for the network manager to show the subscription added via the property for cross-tenant scopes:
78
81
79
82
```azurecli
80
-
# View subscription added to network manager
83
+
# View the subscription added to the network manager
81
84
az network manager show --resource-group myAVNMResourceGroup --name myAVNM
82
85
```
83
86
84
-
## Add static members to your network group
85
-
In this task, you'll add a cross-tenant virtual network to your network group with static membership. The virtual network subscription used below is the same as referenced when creating connections above.
87
+
## Add static members to a network group
88
+
89
+
In this task, you add a cross-tenant virtual network to your network group by using static membership. In the following command, the virtual network subscription is the same as the one that you referenced when you created connections earlier.
86
90
87
91
```azurecli
88
-
# Create network group with static member from target managed tenant
92
+
# Create a network group with a static member from the target managed tenant
89
93
az network manager group static-member create --network-group-name "CrossTenantNetworkGroup" --network-manager-name "myAVNM" --resource-group "myAVNMResourceGroup" --static-member-name "targetVnet01" --resource-id="/subscriptions/87654321-abcd-1234-1def-0987654321ab
Now that the virtual network is in the network group, configurations will be applied. To remove the static member or cross-tenant resources, use the corresponding delete commands.
98
+
Now that the virtual network is in the network group, configurations are applied. To remove the static member or cross-tenant resources, use the corresponding `delete` commands:
95
99
96
100
```azurecli
97
101
98
-
# Delete static member group
102
+
# Delete the static member group
99
103
az network manager group static-member delete --network-group-name "CrossTenantNetworkGroup" --network-manager-name " myAVNM" --resource-group "myRG" --static-member-name "targetVnet01”
0 commit comments