Azure / Azure/azure-powershell

Unable to Complete Cross Tenant Peering with ARM

Open
#17,407 16 comments 0 reactions 0 assignees View on GitHub
act-identity-squad ARM - Templates bug customer-reported Service Attention Tracking
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
3d 14h
Merged PRs (30d)
54

Description

### Description

Similar to issues reported in [Azure CLI ](https://github.com/Azure/azure-cli/issues/16691)however different way to reproduce.

Scenario
Attempting to deploy an ARM Template as described in [Article](https://docs.microsoft.com/en-gb/azure/virtual-network/create-peering-different-subscriptions#template) which will complete a peering between two Virtual Networks in different tenants which returns an error message. The same happens in CLI when using group deployment.

The ARM Template:

`{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {},
"resources": [
{
"apiVersion": "2017-10-01",
"type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
"name": "",
"location": "",
"properties": {
"allowVirtualNetworkAccess": true,
"allowForwardedTraffic": true,
"allowGatewayTransit": false,
"useRemoteGateways": true,
"remoteVirtualNetwork": {
"id": "/subscriptions//resourceGroups//providers/Microsoft.Network/virtualNetworks/"
}
}
}
],
"outputs": {}
}`

Command being used to deploy:

`New-AzResourceGroupDeployment -Name "VirtualNetworkDeployment" -ResourceGroupName ""` -TemplateFile .\virtualNetworkPeer.json -Verbose`

### Issue script & Debug output

```PowerShell
New-AzResourceGroupDeployment : 11:34:21 - The deployment 'VirtualNetworkDeployment' failed with error(s). Showing 1 out of 1 error(s).
Status Message: The client has permission to perform action 'Microsoft.Network/virtualNetworks/peer/action' on scope
'/subscriptions//resourcegroups//providers/Microsoft.Network/virtualNetworks//virtualNetworkPeerings/', however the current tenant '' is not authorized to access linked subscription ''.
```

### Environment data

```PowerShell
Name Value
---- -----
PSVersion 5.1.19041.1320
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.19041.1320
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
```

### Module versions

```PowerShell
4.2.0
```

### Error output

```PowerShell
New-AzResourceGroupDeployment : 11:34:21 - The deployment 'VirtualNetworkDeployment' failed with error(s). Showing 1 out of 1 error(s).
Status Message: The client has permission to perform action 'Microsoft.Network/virtualNetworks/peer/action' on scope
'/subscriptions//resourcegroups//providers/Microsoft.Network/virtualNetworks//virtualNetworkPeerings/', however the current tenant '' is not authorized to access linked subscription ''.
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the deployment with .\virtualNetworkPeer.json and New-AzResourceGroupDeployment using the reported cross-tenant virtual network peering template. Trace the authorization failure for Microsoft.Network/virtualNetworks/peer/action and the linked destination subscription in Azure PowerShell module 4.2. Done means the documented cross-tenant deployment succeeds or the supported limitation and required configuration are clearly identified.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell
Domain
cloud, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.