1

I have an Azure SQL Server residing in tenant A and I need to add a Virtual network rule for a subnet residing in tenant B.

For this, I have created a service principal and given it multi-tenant access. I am also able to see the SP in both tenants. The SP is given access to both the subscriptions and resources (SQL Server and VnNet) in both the tenants.

When I try to add the VNet rule using the SP credentials/login, I encounter the following error:

New-AzSqlServerVirtualNetworkRule:
The client has permission to perform action 'Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/Action'
on scope '/subscriptions/{subscription ID}/resourceGroups/{resource group name}/providers/Microsoft.Sql/servers/
{SQL Server name}/virtualNetworkRules/{rule name}',
however the current tenant 'xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' is not authorized to access linked subscription 'xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'.
mohabbati
  • 1,162
  • 1
  • 13
  • 31
Subha_26
  • 440
  • 4
  • 14

2 Answers2

1

To encounter the following error

New-AzSqlServerVirtualNetworkRule: The client has permission to perform action 'Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/Action' on scope '/subscriptions/{subscription ID}/resourceGroups/{resource group name}/providers/Microsoft.Sql/servers/{SQL Server name}/virtualNetworkRules/{rule name}', however the current tenant 'xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' is not authorized to access linked subscription 'xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'.
  • The service connection in your Azure SQL Server across azure tenants will have only access to the virtual network in one tenant. It does not have access to the virtual network in the other tenant.
  • You can assign Network Contributor role to that virtual network in below steps:

Go to Azure Portal ->Resource group -> Access Control (IAM) -> Add Role assignment. -> Select network Contributor -> Add

enter image description here

Imran
  • 3,875
  • 2
  • 3
  • 12
  • Access is given at VNet, Resource group and Subscription level. Tried with network contributor role, and also contributor role. Still getting the same error. – Subha_26 May 24 '22 at 07:29
1

If I understand you correctly you want to connect resources that reside in two separate VNETs.

Have you set up any VNET peering between the two networks (tutorial)?

FinneVirta
  • 374
  • 1
  • 4
  • 14