Azure VNet Peering across different AAD

Question

I want to peering two VNet in different AAD in different CSP but I could not get it work. I already have set the roles in both subscriptions but using PowerShell I get the error "don't have access to the subscription"

For set the peering I follow these steps:

1 - Set user roles:
-AAD 1 -> Subscription 1 -> create Guest User from Subscription 2 with Network Contributor role
-AAD 2 -> Subscription 2 -> create Guest User from Subscription 1 with Network Contributor role

2 - Run PowerShell Command in Subscription 1:

$vNetFromSubs1=Get-AzVirtualNetwork -Name myVnetA -ResourceGroupName myResourceGroupA
Add-AzVirtualNetworkPeering `
  -Name 'myVnet1ToMyVnet2' `
  -VirtualNetwork $vNetFromSubs1 `
  -RemoteVirtualNetworkId "VNET-ID-FROM-SUBS-2"

After run this command, I got the error: Don't have access to subscription 2
What am I doing wrong? I did it as the Microsoft documentation says.

alphaz18 alphaz18 · Accepted Answer · 2020-07-14T20:30:53

as per the documentation states: https://docs.microsoft.com/en-us/azure/virtual-network/create-peering-different-subscriptions#powershell

Did you ensure that that the guest users you added was given network contributor role to the specific vnet resource? I just tested it and it does work without issue. also make sure you redeem the guest user invitation.

Azure VNet Peering across different AAD

1 Answers