Multitenant private endpoint

Question

I have a subscription in Tenant A that needs to access a SQL database in Tenant B's subscription. To achieve this, I am creating a private endpoint in Tenant B's subscription. What should the architecture look like? And do the VNets in Tenant A and Tenant B need to be peered for Tenant A to access the SQL database in Tenant B?

Answer 1

Hi @ Merin Mary

Thanks for the Question and using Microsoft Q&A platform

As per my understanding, you need to access SQL database in Tenant B's subscription from the subscription in Tenant A.

To access SQL database in Tenant B subscription, you need to create a Private Endpoint for the SQL database in Tenant B's subscription. This endpoint will give the database a private IP address within Tenant B's Virtual Network (VNet).

The VNets in Tenant A and Tenant B must be peered. This is necessary for secure communication between both VNets. You will need to establish VNet peering to allow Tenant A to access the database through the private endpoint.

Please go through these documentations that might help you:

https://learn.microsoft.com/en-us/azure/virtual-network/create-peering-different-subscriptions?tabs=create-peering-portal

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

https://learn.microsoft.com/en-us/azure/azure-sql/database/private-endpoint-overview?view=azuresql#approve-a-private-endpoint-connection

Hope this helps. Do let us know if you any further queries. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 2

Thankyou ! We have some ip conflicts between the vnets ? What could be some possible solution if we cannot peer because of the ip conflict?

Answer 3

Thankyou so much ! This is architecture/solution we were looking for