Once the private connection is established, can it be accessed from another Azure account using Private Link ?

Question

Once the private connection is established, can it be accessed from another Azure account using Private Link ?

$@chin 245

Hi,

Scenario:

Tenant A / Subscription 1:
- Resources: VM1 and SQL1/MySQL1 (PaaS)
- Private Endpoint is already established between VM1 and SQL1/MySQL1, and public access is disabled for the database.
Tenant B / Subscription 2:
- Goal: VM2 in Tenant B needs to connect to SQL1/MySQL1 in Tenant A using Azure Private Link.
- Setup:
  - A Private Endpoint for SQL1/MySQL1 was created in Tenant B.
  The Private Endpoint request was approved in Tenant A.
  - DNS resolution from VM2 correctly resolves to the private IP of the database in Tenant A.
  - NSG rules are open (outbound on VM2 is allowed).
  - No firewalls and UDR in the env and no permission issues are observed.

However, connectivity from VM2 to SQL1/MySQL1 is failing (e.g., telnet or direct database connection attempts do not work).

Questions:

Am I missing any required configuration?

Is this cross-tenant private link connection technically feasible?

Is there an alternative approach if this setup is not supported?

1 answer

Your answer

Answer 1

Praveen Bandaru 7,810 Microsoft External Staff Moderator

Hello$@chin

It seems you're trying to set up a connection using Azure Private Link between two different tenants, which requires several layers of configuration. Here's a breakdown of your situation:

Cross-Tenant Configuration: Connecting across tenants using Azure Private Link is technically possible, but it needs proper configuration.

Establish Cross-Tenant VNet Peering Create a VNet peering connection between Tenant-A and Tenant-B, ensuring proper permissions and route sharing are configured across tenants.
Ex: Configure User-Defined Routes (UDRs) In Tenant -B (VNet-B), define custom routes that direct traffic destined for on-premises networks to Tenant- A (VNet-A) as the next hop.
Deploy a Network Virtual Appliance (NVA) or Azure Route Server in VNet-A Use an NVA or Azure Route Server to manage route propagation and enable traffic forwarding from VNet-B to the on-premises environment via the existing ExpressRoute connection

Since your DNS resolution is working and you've established the Private Endpoint, the basic setup appears correct. However, you should check a few things to troubleshoot the connectivity issue.

Please ensure that the Network Security Groups (NSGs) are properly configured to allow inbound traffic from VM2 in Tenant B to the Private Endpoint in Tenant A, including verifying the inbound rules.
Also, ensure that the Private DNS Zone used for SQL1/MySQL1 is linked to VM2 or that VM2 can correctly resolve the SQL database's private endpoint.
If you are using VNet peering between the two tenants, make sure the peering settings allow traffic to flow as needed. You may need to enable 'Allow forwarded traffic' and/or 'Allow gateway transit'. Also, double-check the private IP assignment for the endpoint and confirm it is reachable from VM2.
If direct connectivity via Private Link is not reliable, you could set up a VPN gateway to facilitate communication between the two VNets. If applicable, consider establishing a VNet-to-VNet connection.

Please share the below information for more understanding:

Are there any specific error messages when you try to connect from VM2 to SQL1/MySQL1?
Have you verified the specific inbound rules in the NSGs on both ends?
Are you using any custom DNS settings beyond the default Azure routing?
Can you provide details on how your VNets are configured (VNet peering, whether they are in the same region, etc.)?
What specific methods are you trying for connection (e.g., direct connection, tools like telnet, etc.)?
Share the Psping results from your source machine for further investigation.

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Praveen Bandaru 7,810 Reputation points Microsoft External Staff Moderator

2025-06-12T18:45:05.2233333+00:00

Hello$@chin

I just wanted to follow up and see if you had a chance to review my response to your question. Please let us know if it was helpful, and feel free to reach out if you have any further queries.

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Praveen Bandaru 7,810 Reputation points Microsoft External Staff Moderator

2025-06-13T22:07:24.2033333+00:00

Hello$@chin

I just wanted to follow up and see if you had a chance to review my response to your question. Please let us know if it was helpful, and feel free to reach out if you have any further queries.

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Praveen Bandaru 7,810 Reputation points Microsoft External Staff Moderator

2025-06-16T15:16:11.15+00:00

Hello$@chin

I just wanted to follow up and see if you had a chance to review my response to your question. Please let us know if it was helpful, and feel free to reach out if you have any further queries.

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
$@chin 245 Reputation points

2025-06-18T16:28:14.4233333+00:00

Hi @Praveen Bandaru ,

I attempted to set up using the private endpoint configuration both end between Tenant A and Tenant B. In this setup, a SQL/MySQL instance in Tenant A is exposed using a resource alias, and a VM in Tenant B is able to resolve the private endpoint successfully. However, the connectivity between the VM in Tenant B and the SQL/MySQL instance in Tenant A is failing. I'm suspecting that this might require VNet peering or a VPN (VNet-to-VNet) connection.

Is VNet peering or VPN the only option to enable this kind of cross-tenant private connectivity via private endpoint ?

================================================

Additionally, I was referring to documentation (https://learn.microsoft.com/en-us/azure/architecture/networking/guide/cross-tenant-secure-access-private-endpoints) that suggests Private Link allows cross-tenant connections without needing VNet peering or VPN as it's not specify. However, it seems that when configuring Private Link via a load balancer, it primarily supports backend targets like VMs or VMSS, and not PaaS services like Azure SQL or MySQL.

Can you confirm if my understanding is correct? Specifically:

Is it possible to use Azure Private Link for cross-tenant connectivity to Azure SQL or MySQL without VNet peering or VPN?

Or is such connectivity only supported through VNet peering/VPN when involving these PaaS services ?
Praveen Bandaru 7,810 Reputation points Microsoft External Staff Moderator

2025-06-19T21:17:23.6+00:00
Hello$@chin

Thank you for your response check the below information:

Yes, Azure Private Link can facilitate cross-tenant connectivity to Azure SQL Database or Azure Database for MySQL without needing VNet peering or a VPN. However, there are some important considerations to keep in mind:- The Private Link service must be deployed in the same region as the virtual network.

You need to approve the private endpoint connection from the resource owner (e.g., the SQL server admin).

DNS configuration is crucial: ensure that the DNS resolves the private endpoint correctly, especially in cross-tenant scenarios.

To ensure traffic flows exclusively through the private endpoint, you should disable public network access on the Azure SQL or MySQL server.

Ensure that you need to link all VNETS properly in the Private DNs zone.

But mostly recommended is you need to go with peering and VPN option you will not encounter any issue.

Check the below public document for more understanding:

https://learn.microsoft.com/en-us/azure/azure-sql/database/private-endpoint-overview?view=azuresql

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Praveen Bandaru 7,810 Reputation points Microsoft External Staff Moderator

2025-06-20T18:32:56.3166667+00:00

Hello$@chin

I just wanted to follow up and see if you had a chance to review my response to your question. Please let us know if it was helpful, and feel free to reach out if you have any further queries.

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Share via

Once the private connection is established, can it be accessed from another Azure account using Private Link ?

1 answer

Your answer