Create a virtual network peering - Resource Manager, different subscriptions and Azure Active Directory tenants

Article
06/16/2023

In this tutorial, you learn to create a virtual network peering between virtual networks created through Resource Manager. The virtual networks exist in different subscriptions that may belong to different Azure Active Directory (Azure AD) tenants. Peering two virtual networks enables resources in different virtual networks to communicate with each other with the same bandwidth and latency as though the resources were in the same virtual network. Learn more about Virtual network peering.

Depending on whether the virtual networks are in the same, or different subscriptions the steps to create a virtual network peering are different. Steps to peer networks created with the classic deployment model are different. For more information about deployment models, see Azure deployment model.

Learn how to create a virtual network peering in other scenarios by selecting the scenario from the following table:

Azure deployment model	Azure subscription
Both Resource Manager	Same
One Resource Manager, one classic	Same
One Resource Manager, one classic	Different

A virtual network peering can't be created between two virtual networks deployed through the classic deployment model. If you need to connect virtual networks that were both created through the classic deployment model, you can use an Azure VPN Gateway to connect the virtual networks.

This tutorial peers virtual networks in the same region. You can also peer virtual networks in different supported regions. It's recommended that you familiarize yourself with the peering requirements and constraints before peering virtual networks.

Prerequisites

An Azure account(s) with two active subscriptions. Create an account for trial.
An Azure account with permissions in both subscriptions or an account in each subscription with the proper permissions to create a virtual network peering. For a list of permissions, see Virtual network peering permissions.
- To separate the duty of managing the network belonging to each tenant, add the user from each tenant as a guest in the opposite tenant and assign them the Network Contributor role to the virtual network. This procedure applies if the virtual networks are in different subscriptions and Active Directory tenants.
- To establish a network peering when you don't intend to separate the duty of managing the network belonging to each tenant, add the user from tenant A as a guest in the opposite tenant. Then, assign them the Network Contributor role to initiate and connect the network peering from each subscription. With these permissions, the user is able to establish the network peering from each subscription.
- For more information about guest users, see Add Azure Active Directory B2B collaboration users in the Azure portal.
- Each user must accept the guest user invitation from the opposite Azure Active Directory tenant.

An Azure account(s) with two active subscriptions. Create an account for trial.
An Azure account with permissions in both subscriptions or an account in each subscription with the proper permissions to create a virtual network peering. For a list of permissions, see Virtual network peering permissions.
- To separate the duty of managing the network belonging to each tenant, add the user from each tenant as a guest in the opposite tenant and assign them the Network Contributor role to the virtual network. This procedure applies if the virtual networks are in different subscriptions and Active Directory tenants.
- To establish a network peering when you don't intend to separate the duty of managing the network belonging to each tenant, add the user from tenant A as a guest in the opposite tenant. Then, assign them the Network Contributor role to initiate and connect the network peering from each subscription. With these permissions, the user is able to establish the network peering from each subscription.
- For more information about guest users, see Add Azure Active Directory B2B collaboration users in the Azure portal.
- Each user must accept the guest user invitation from the opposite Azure Active Directory tenant.
Azure PowerShell installed locally.
Sign in to Azure PowerShell and ensure you've selected the subscription with which you want to use this feature. For more information, see Sign in with Azure PowerShell.
Ensure your Az.Network module is 4.3.0 or later. To verify the installed module, use the command Get-InstalledModule -Name "Az.Network". If the module requires an update, use the command Update-Module -Name Az.Network if necessary.

This article requires the Azure PowerShell module version 5.4.1 or later. Run Get-Module -ListAvailable Az to find the installed version. If you need to upgrade, see Install Azure PowerShell module. You also need to run Connect-AzAccount -Environment AzureChinaCloud to create a connection with Azure.

In the following steps, learn how to peer virtual networks in different subscriptions and Azure Active Directory tenants.

You can use the same account that has permissions in both subscriptions or you can use separate accounts for each subscription to set up the peering. An account with permissions in both subscriptions can complete all of the steps without signing out and signing in to portal and assigning permissions.

The following resources and account examples are used in the steps in this article:

User account	Resource group	Subscription	Virtual network
UserA	myResourceGroupA	SubscriptionA	myVNetA
UserB	myResourceGroupB	SubscriptionB	myVNetB

Create virtual network - myVNetA

Note

If you are using a single account to complete the steps, you can skip the steps for logging out of the portal and assigning another user permissions to the virtual networks.

Sign-in to the Azure portal as UserA.
In the search box a the top of the portal, enter Virtual network. Select Virtual networks in the search results.
Select + Create.

In the Basics tab of Create virtual network, enter or select the following information:

Setting	Value
Project details
Subscription	Select your SubscriptionA.
Resource group	Select Create new. Enter myResourceGroupA in Name. Select OK.
Instance details
Name	Enter myVNetA.
Region	Select a region.

Select Next: IP Addresses.
In IPv4 address space, enter 10.1.0.0/16.
Select + Add subnet.
Enter or select the following information:

Setting Value

Subnet name Enter mySubnet.

Subnet address range Enter 10.1.0.0/24.
Select Add.
Select Review + create.
Select Create.

Setting	Value
Subnet name	Enter mySubnet.
Subnet address range	Enter 10.1.0.0/24.

Use Connect-AzAccount to sign in to SubscriptionA.

Connect-AzAccount -Environment AzureChinaCloud

If you're using one account for both subscriptions, sign in to that account and change the subscription context to SubscriptionA with Set-AzContext.

Set-AzContext -Subscription SubscriptionA

Create a resource group - myResourceGroupA

An Azure resource group is a logical container where Azure resources are deployed and managed.

Create a resource group with New-AzResourceGroup:

$rsg = @{
    Name = 'myResourceGroupA'
    Location = 'chinaeast2'
}
New-AzResourceGroup @rsg

Create the virtual network

Create a virtual network with New-AzVirtualNetwork. This example creates a default virtual network named myVNetA in the China East 2 location:

$vnet = @{
    Name = 'myVNetA'
    ResourceGroupName = 'myResourceGroupA'
    Location = 'chinaeast2'
    AddressPrefix = '10.1.0.0/16'
}
$virtualNetwork = New-AzVirtualNetwork @vnet

Add a subnet

Azure deploys resources to a subnet within a virtual network, so you need to create a subnet. Create a subnet configuration named default with Add-AzVirtualNetworkSubnetConfig:

$subnet = @{
    Name = 'default'
    VirtualNetwork = $virtualNetwork
    AddressPrefix = '10.1.0.0/24'
}
$subnetConfig = Add-AzVirtualNetworkSubnetConfig @subnet

Associate the subnet to the virtual network

You can write the subnet configuration to the virtual network with Set-AzVirtualNetwork. This command creates the subnet:

$virtualNetwork | Set-AzVirtualNetwork

Use az login to sign in to SubscriptionA.

az login

If you're using one account for both subscriptions, sign in to that account and change the subscription context to SubscriptionA with az account set.

az account set --subscription "SubscriptionA"

Create a resource group - myResourceGroupA

An Azure resource group is a logical container where Azure resources are deployed and managed.

Create a resource group with az group create:

az group create \
    --name myResourceGroupA \
    --location chinaeast2

Create the virtual network

Create a virtual network and subnet with az network vnet create. This example creates a default virtual network named myVNetA in the China East 2 location.

az network vnet create \
    --resource-group myResourceGroupA\
    --location chinaeast2 \
    --name myVNetA \
    --address-prefixes 10.1.0.0/16 \
    --subnet-name default \
    --subnet-prefixes 10.1.0.0/24

Assign permissions for UserB

A user account in the other subscription that you want to peer with must be added to the network you previously created. If you're using a single account for both subscriptions, you can skip this section.

Remain signed in to the portal as UserA.
In the search box a the top of the portal, enter Virtual network. Select Virtual networks in the search results.
Select myVNetA.
Select Access control (IAM).
Select + Add -> Add role assignment.
In Add role assignment in the Role tab, select Network Contributor.
Select Next.
In the Members tab, select + Select members.
In Select members in the search box, enter UserB.
Select Select.
Select Review + assign.
Select Review + assign.

Use Get-AzVirtualNetwork to obtain the resource ID for myVNetA. Assign UserB from SubscriptionB to myVNetA with New-AzRoleAssignment.

Use Get-AzADUser to obtain the object ID for UserB.

UserB is used in this example for the user account. Replace this value with the display name for the user from SubscriptionB that you wish to assign permissions to myVNetA. You can skip this step if you're using the same account for both subscriptions.

$id = @{
    Name = 'myVNetA'
    ResourceGroupName = 'myResourceGroupA'
}
$vnet = Get-AzVirtualNetwork @id

$obj = Get-AzADUser -DisplayName 'UserB'

$role = @{
    ObjectId = $obj.id
    RoleDefinitionName = 'Network Contributor'
    Scope = $vnet.id
}
New-AzRoleAssignment @role

Use az network vnet show to obtain the resource ID for myVNetA. Assign UserB from SubscriptionB to myVNetA with az role assignment create.

Use az ad user list to obtain the object ID for UserB.

az ad user list --display-name UserB

[
  {
    "businessPhones": [],
    "displayName": "UserB",
    "givenName": null,
    "id": "16d51293-ec4b-43b1-b54b-3422c108321a",
    "jobTitle": null,
    "mail": "userB@fabrikam.com",
    "mobilePhone": null,
    "officeLocation": null,
    "preferredLanguage": null,
    "surname": null,
    "userPrincipalName": "userb_fabrikam.com#EXT#@contoso.partner.onmschina.cn"
  }
]

Make note of the object ID of UserB in field id. In this example, its 16d51293-ec4b-43b1-b54b-3422c108321a.

vnetid=$(az network vnet show \
    --name myVNetA \
    --resource-group myResourceGroupA \
    --query id \
    --output tsv)

az role assignment create \
      --assignee 16d51293-ec4b-43b1-b54b-3422c108321a \
      --role "Network Contributor" \
      --scope $vnetid

Replace the example guid in --assignee with the real object ID for UserB.

Obtain resource ID of myVNetA

Remain signed in to the portal as UserA.
In the search box a the top of the portal, enter Virtual network. Select Virtual networks in the search results.
Select myVNetA.
In Settings, select Properties.
Copy the information in the Resource ID field and save for the later steps. The resource ID is similar to the following example: /subscriptions/<Subscription Id>/resourceGroups/myResourceGroupA/providers/Microsoft.Network/virtualNetworks/myVnetA.
Sign out of the portal as UserA.

The resource ID of myVNetA is required to set up the peering connection from myVNetB to myVNetA. Use Get-AzVirtualNetwork to obtain the resource ID for myVNetA.

$id = @{
    Name = 'myVNetA'
    ResourceGroupName = 'myResourceGroupA'
}
$vnetA = Get-AzVirtualNetwork @id

$vnetA.id

The resource ID of myVNetA is required to set up the peering connection from myVNetB to myVNetA. Use az network vnet show to obtain the resource ID for myVNetA.

vnetidA=$(az network vnet show \
    --name myVNetA \
    --resource-group myResourceGroupA \
    --query id \
    --output tsv)

echo $vnetidA

Create virtual network - myVNetB

In this section, you sign in as UserB and create a virtual network for the peering connection to myVNetA.

Sign in to the portal as UserB. If you're using one account for both subscriptions, change to SubscriptionB in the portal.
In the search box a the top of the portal, enter Virtual network. Select Virtual networks in the search results.
Select + Create.

In the Basics tab of Create virtual network, enter or select the following information:

Setting	Value
Project details
Subscription	Select your SubscriptionB.
Resource group	Select Create new. Enter myResourceGroupB in Name. Select OK.
Instance details
Name	Enter myVNetB.
Region	Select a region.

Select Next: IP Addresses.
In IPv4 address space, enter 10.2.0.0/16.
Select + Add subnet.
Enter or select the following information:

Setting Value

Subnet name Enter mySubnet.

Subnet address range Enter 10.2.0.0/24.
Select Add.
Select Review + create.
Select Create.

Setting	Value
Subnet name	Enter mySubnet.
Subnet address range	Enter 10.2.0.0/24.

Use Connect-AzAccount to sign in to SubscriptionB.

Connect-AzAccount -Environment AzureChinaCloud

If you're using one account for both subscriptions, sign in to that account and change the subscription context to SubscriptionB with Set-AzContext.

Set-AzContext -Subscription SubscriptionB

Create a resource group - myResourceGroupB

An Azure resource group is a logical container where Azure resources are deployed and managed.

Create a resource group with New-AzResourceGroup:

$rsg = @{
    Name = 'myResourceGroupB'
    Location = 'chinaeast2'
}
New-AzResourceGroup @rsg

Create the virtual network

Create a virtual network with New-AzVirtualNetwork. This example creates a default virtual network named myVNetB in the China East 2 location:

$vnet = @{
    Name = 'myVNetB'
    ResourceGroupName = 'myResourceGroupB'
    Location = 'chinaeast2'
    AddressPrefix = '10.2.0.0/16'
}
$virtualNetwork = New-AzVirtualNetwork @vnet

Add a subnet

Azure deploys resources to a subnet within a virtual network, so you need to create a subnet. Create a subnet configuration named default with Add-AzVirtualNetworkSubnetConfig:

$subnet = @{
    Name = 'default'
    VirtualNetwork = $virtualNetwork
    AddressPrefix = '10.2.0.0/24'
}
$subnetConfig = Add-AzVirtualNetworkSubnetConfig @subnet

Associate the subnet to the virtual network

You can write the subnet configuration to the virtual network with Set-AzVirtualNetwork. This command creates the subnet:

$virtualNetwork | Set-AzVirtualNetwork

Use az login to sign in to SubscriptionA.

az login

If you're using one account for both subscriptions, sign in to that account and change the subscription context to SubscriptionB with az account set.

az account set --subscription "SubscriptionB"

Create a resource group - myResourceGroupB

An Azure resource group is a logical container where Azure resources are deployed and managed.

Create a resource group with az group create:

az group create \
    --name myResourceGroupB \
    --location chinaeast2

Create the virtual network

Create a virtual network and subnet with az network vnet create. This example creates a default virtual network named myVNetB in the China East 2 location.

az network vnet create \
    --resource-group myResourceGroupB\
    --location chinaeast2 \
    --name myVNetB \
    --address-prefixes 10.2.0.0/16 \
    --subnet-name default \
    --subnet-prefixes 10.2.0.0/24

Assign permissions for UserA

Remain signed in to the portal as UserB.
In the search box a the top of the portal, enter Virtual network. Select Virtual networks in the search results.
Select myVNetB.
Select Access control (IAM).
Select + Add -> Add role assignment.
In Add role assignment in the Role tab, select Network Contributor.
Select Next.
In the Members tab, select + Select members.
In Select members in the search box, enter UserA.
Select Select.
Select Review + assign.
Select Review + assign.

Use Get-AzVirtualNetwork to obtain the resource ID for myVNetA. Assign UserA from SubscriptionA to myVNetB with New-AzRoleAssignment.

Use Get-AzADUser to obtain the object ID for UserA.

UserA is used in this example for the user account. Replace this value with the display name for the user from SubscriptionA that you wish to assign permissions to myVNetB. You can skip this step if you're using the same account for both subscriptions.

$id = @{
    Name = 'myVNetB'
    ResourceGroupName = 'myResourceGroupB'
}
$vnet = Get-AzVirtualNetwork @id

$obj = Get-AzADUser -DisplayName 'UserA'

$role = @{
    ObjectId = $obj.id
    RoleDefinitionName = 'Network Contributor'
    Scope = $vnet.id
}
New-AzRoleAssignment @role

Use az network vnet show to obtain the resource ID for myVNetB. Assign UserA from SubscriptionA to myVNetB with az role assignment create.

Use az ad user list to obtain the object ID for UserA.

az ad user list --display-name UserA

[
  {
    "businessPhones": [],
    "displayName": "UserA",
    "givenName": null,
    "id": "ee0645cc-e439-4ffc-b956-79577e473969",
    "jobTitle": null,
    "mail": "userA@contoso.com",
    "mobilePhone": null,
    "officeLocation": null,
    "preferredLanguage": null,
    "surname": null,
    "userPrincipalName": "usera_contoso.com#EXT#@fabrikam.partner.onmschina.cn"
  }
]

Make note of the object ID of UserA in field id. In this example, it's ee0645cc-e439-4ffc-b956-79577e473969.

vnetid=$(az network vnet show \
    --name myVNetB \
    --resource-group myResourceGroupB \
    --query id \
    --output tsv)

az role assignment create \
      --assignee ee0645cc-e439-4ffc-b956-79577e473969 \
      --role "Network Contributor" \
      --scope $vnetid

Obtain resource ID of myVNetB

The resource ID of myVNetB is required to set up the peering connection from myVNetA to myVNetB. Use the following steps to obtain the resource ID of myVNetB.

Remain signed in to the portal as UserB.
In the search box a the top of the portal, enter Virtual network. Select Virtual networks in the search results.
Select myVNetB.
In Settings, select Properties.
Copy the information in the Resource ID field and save for the later steps. The resource ID is similar to the following example: /subscriptions/<Subscription Id>/resourceGroups/myResourceGroupB/providers/Microsoft.Network/virtualNetworks/myVnetB.
Sign out of the portal as UserB.

The resource ID of myVNetB is required to set up the peering connection from myVNetA to myVNetB. Use Get-AzVirtualNetwork to obtain the resource ID for myVNetB.

$id = @{
    Name = 'myVNetB'
    ResourceGroupName = 'myResourceGroupB'
}
$vnetB = Get-AzVirtualNetwork @id

$vnetB.id

The resource ID of myVNetB is required to set up the peering connection from myVNetA to myVNetB. Use az network vnet show to obtain the resource ID for myVNetB.

vnetidB=$(az network vnet show \
    --name myVNetB \
    --resource-group myResourceGroupB \
    --query id \
    --output tsv)

echo $vnetidB

Create peering connection - myVNetA to myVNetB

You need the Resource ID for myVNetB from the previous steps to set up the peering connection.

Sign in to the Azure portal as UserA. If you're using one account for both subscriptions, change to SubscriptionA in the portal.
In the search box a the top of the portal, enter Virtual network. Select Virtual networks in the search results.
Select myVNetA.
Select Peerings.
Select + Add.

Enter or select the following information in Add peering:

Setting	Value
This virtual network
Peering link name	Enter myVNetAToMyVNetB.
Traffic to remote virtual network	Leave the default of Allow (default).
Traffic forwarded from remote virtual network	Leave the default of Allow (default).
Virtual network gateway	Leave the default of None (default).
Remote virtual network
Peering link name	Leave blank.
Virtual network deployment model	Select Resource manager.
Select the box for I know my resource ID.
Resource ID	Enter or paste the Resource ID for myVNetB.

In the pull-down box, select the Directory that corresponds with myVNetB and UserB.
Select Authenticate.
Select Add.
Sign out of the portal as UserA.

Use Connect-AzAccount to sign in to SubscriptionA.

Connect-AzAccount -Environment AzureChinaCloud

If you're using one account for both subscriptions, sign in to that account and change the subscription context to SubscriptionA with Set-AzContext.

Set-AzContext -Subscription SubscriptionA

Authenticate to SubscriptionB so that the peering can be set up.

Use Connect-AzAccount to sign in to SubscriptionB.

Connect-AzAccount -Environment AzureChinaCloud

Change to SubscriptionA (optional)

You may have to switch back to SubscriptionA to continue with the actions in SubscriptionA.

Change context to SubscriptionA.

Set-AzContext -Subscription SubscriptionA

Create peering connection

Use Add-AzVirtualNetworkPeering to create a peering connection between myVNetA and myVNetB.

$netA = @{
    Name = 'myVNetA'
    ResourceGroupName = 'myResourceGroupA'
}
$vnetA = Get-AzVirtualNetwork @netA

$peer = @{
    Name = 'myVNetAToMyVNetB'
    VirtualNetwork = $vnetA
    RemoteVirtualNetworkId = '/subscriptions/<SubscriptionB-Id>/resourceGroups/myResourceGroupB/providers/Microsoft.Network/virtualNetworks/myVnetB'
}
Add-AzVirtualNetworkPeering @peer

Use Get-AzVirtualNetworkPeering to obtain the status of the peering connections from myVNetA to myVNetB.

$status = @{
    ResourceGroupName =  'myResourceGroupA'
    VirtualNetworkName = 'myVNetA'
}
Get-AzVirtualNetworkPeering @status | Format-Table VirtualNetworkName, PeeringState

PS /home/azureuser> Get-AzVirtualNetworkPeering @status | Format-Table VirtualNetworkName, PeeringState

VirtualNetworkName PeeringState
------------------ ------------
myVNetA            Initiated

Use az login to sign in to SubscriptionA.

az login

If you're using one account for both subscriptions, sign in to that account and change the subscription context to SubscriptionA with az account set.

az account set --subscription "SubscriptionA"

Authenticate to SubscriptionB so that the peering can be set up.

Use az login to sign in to SubscriptionB.

az login

Change to SubscriptionA (optional)

You may have to switch back to SubscriptionA to continue with the actions in SubscriptionA.

Change context to SubscriptionA.

az account set --subscription "SubscriptionA"

Create peering connection

Use az network vnet peering create to create a peering connection between myVNetA and myVNetB.

az network vnet peering create \
    --name myVNetAToMyVNetB \
    --resource-group myResourceGroupA \
    --vnet-name myVNetA \
    --remote-vnet /subscriptions/<SubscriptionB-Id>/resourceGroups/myResourceGroupB/providers/Microsoft.Network/VirtualNetworks/myVNetB \
    --allow-vnet-access

Use az network vnet peering list to obtain the status of the peering connections from myVNetA to myVNetB.

az network vnet peering list \
    --resource-group myResourceGroupA \
    --vnet-name myVNetA \
    --output table

The peering connection shows in Peerings in a Initiated state. To complete the peer, a corresponding connection must be set up in myVNetB.

Create peering connection - myVNetB to myVNetA

You need the Resource IDs for myVNetA from the previous steps to set up the peering connection.

Sign in to the Azure portal as UserB. If you're using one account for both subscriptions, change to SubscriptionB in the portal.
In the search box a the top of the portal, enter Virtual network. Select Virtual networks in the search results.
Select myVNetB.
Select Peerings.
Select + Add.

Enter or select the following information in Add peering:

Setting	Value
This virtual network
Peering link name	Enter myVNetBToMyVNetA.
Traffic to remote virtual network	Leave the default of Allow (default).
Traffic forwarded from remote virtual network	Leave the default of Allow (default).
Virtual network gateway	Leave the default of None (default).
Remote virtual network
Peering link name	Leave blank.
Virtual network deployment model	Select Resource manager.
Select the box for I know my resource ID.
Resource ID	Enter or paste the Resource ID for myVNetA.

In the pull-down box, select the Directory that corresponds with myVNetA and UserA.
Select Authenticate.
Select Add.

Use Connect-AzAccount to sign in to SubscriptionB.

Connect-AzAccount -Environment AzureChinaCloud

If you're using one account for both subscriptions, sign in to that account and change the subscription context to SubscriptionB with Set-AzContext.

Set-AzContext -Subscription SubscriptionB

Authenticate to SubscriptionA so that the peering can be set up.

Use Connect-AzAccount to sign in to SubscriptionA.

Connect-AzAccount -Environment AzureChinaCloud

Change to SubscriptionB (optional)

You may have to switch back to SubscriptionB to continue with the actions in SubscriptionB.

Change context to SubscriptionB.

Set-AzContext -Subscription SubscriptionB

Create peering connection

Use Add-AzVirtualNetworkPeering to create a peering connection between myVNetB and myVNetA.

$netB = @{
    Name = 'myVNetB'
    ResourceGroupName = 'myResourceGroupB'
}
$vnetB = Get-AzVirtualNetwork @netB

$peer = @{
    Name = 'myVNetBToMyVNetA'
    VirtualNetwork = $vnetB
    RemoteVirtualNetworkId = '/subscriptions/<SubscriptionA-Id>/resourceGroups/myResourceGroupA/providers/Microsoft.Network/virtualNetworks/myVNetA'
}
Add-AzVirtualNetworkPeering @peer

User Get-AzVirtualNetworkPeering to obtain the status of the peering connections from myVNetB to myVNetA.

$status = @{
    ResourceGroupName =  'myResourceGroupB'
    VirtualNetworkName = 'myVNetB'
}
Get-AzVirtualNetworkPeering @status | Format-Table VirtualNetworkName, PeeringState

PS /home/azureuser> Get-AzVirtualNetworkPeering @status | Format-Table VirtualNetworkName, PeeringState

VirtualNetworkName PeeringState
------------------ ------------
myVNetB            Connected

Use az login to sign in to SubscriptionB.

az login

If you're using one account for both subscriptions, sign in to that account and change the subscription context to SubscriptionB with az account set.

az account set --subscription "SubscriptionB"

Authenticate to SubscriptionA so that the peering can be set up.

Use az login to sign in to SubscriptionA.

az login

Change to SubscriptionB (optional)

You may have to switch back to SubscriptionB to continue with the actions in SubscriptionB.

Change context to SubscriptionB.

az account set --subscription "SubscriptionB"

Create peering connection

Use az network vnet peering create to create a peering connection between myVNetB and myVNetA.

az network vnet peering create \
    --name myVNetBToMyVNetA \
    --resource-group myResourceGroupB \
    --vnet-name myVNetB \
    --remote-vnet /subscriptions/<SubscriptionA-Id>/resourceGroups/myResourceGroupA/providers/Microsoft.Network/VirtualNetworks/myVNetA \
    --allow-vnet-access

Use az network vnet peering list to obtain the status of the peering connections from myVNetB to myVNetA.

az network vnet peering list \
    --resource-group myResourceGroupB \
    --vnet-name myVNetB \
    --output table

The peering is successfully established after you see Connected in the Peering status column for both virtual networks in the peering. Any Azure resources you create in either virtual network are now able to communicate with each other through their IP addresses. If you're using default Azure name resolution for the virtual networks, the resources in the virtual networks aren't able to resolve names across the virtual networks. If you want to resolve names across virtual networks in a peering, you must create your own DNS server or use Azure DNS.

For more information about using your own DNS for name resolution, see, Name resolution using your own DNS server.

For more information about Azure DNS, see What is Azure DNS?.

Next steps

Thoroughly familiarize yourself with important virtual network peering constraints and behaviors before creating a virtual network peering for production use.
Learn about all virtual network peering settings.

Create a virtual network peering - Resource Manager, different subscriptions and Azure Active Directory tenants

Prerequisites

Create virtual network - myVNetA

Create a resource group - myResourceGroupA

Create the virtual network

Add a subnet

Associate the subnet to the virtual network

Create a resource group - myResourceGroupA

Create the virtual network

Assign permissions for UserB

Obtain resource ID of myVNetA

Create virtual network - myVNetB

Create a resource group - myResourceGroupB

Create the virtual network

Add a subnet

Associate the subnet to the virtual network

Create a resource group - myResourceGroupB

Create the virtual network

Assign permissions for UserA

Obtain resource ID of myVNetB

Create peering connection - myVNetA to myVNetB

Change to SubscriptionA (optional)

Create peering connection

Change to SubscriptionA (optional)

Create peering connection

Create peering connection - myVNetB to myVNetA

Change to SubscriptionB (optional)

Create peering connection

Change to SubscriptionB (optional)

Create peering connection

Next steps

Additional resources

Additional resources