Can't access azure resource at different region through private endpoint

Question

I have created managed disk full snapshot with private access using disk access resource in the eastus region.
After that I have created private endpoint to that disk access resource in eastasia region. after approving private endpoint connection I have created the VM in same vnet where private endpoint was created in eastasia region.
When I tried to access the exported snasphot with url, I was getting Authorization failure.

<?xml version="1.0" encoding="utf-8"?>
<Error><Code>AuthorizationFailure</Code><Message>This request is not authorized to perform this operation.
RequestId:697a7520-301e-007c-65a7-6be442000000
Time:2024-03-01T07:09:21.3563602Z</Message></Error>

Where as when I tried the same thing with private endpoint, vm and vnet in same region i.e. eastus, I can successfully access the exported snapshot.

According to docs, I should be able to access cross region resources.

Answer 1

Hello Gaurav Chawda,

Thank you for posting your query here!

Azure private endpoints allow you to securely connect to Azure resources from a virtual network, without exposing them to the public internet. You can use private endpoints to access resources in the same region or in different regions, as long as the resource provider supports cross-region access.

However, from your error message it seems you have encountered authorization failures when trying to access resources in different regions through private endpoints. There are several factors that may affect the cross-region access through private endpoints, such as:

· Not all Azure resources and providers support cross-region access through private endpoints. For example, Azure Storage accounts and Azure SQL Database servers support cross-region access, but Azure Cosmos DB accounts and Azure Key Vault vaults do not. You can check the list of supported resources and providers here: What is a private endpoint? - Azure Private Link | Microsoft Learn

If not, you may need to use a different resource type or provider, or use a different method to access the resource, such as a VPN or a service endpoint.

· Some Azure resources may require additional configuration to enable cross-region access through private endpoints. For example, Azure Storage accounts need to have the Allow cross-region replication property enabled, and Azure SQL Database servers need to have the Allow Azure services and resources to access this server property enabled.

· The private endpoint that connects to the resource in a different region needs to have the correct settings, such as the resource ID, the private DNS zone, and the private IP address. You can check the steps to create and configure a private endpoint here: https://docs.microsoft.com/en-us/azure/private-link/create-private-endpoint-portal

· The network security groups (NSGs) and firewalls that are applied to the virtual network, the subnet, or the resource may block the traffic between the private endpoint and the resource. You need to ensure that the network security rules allow the communication on the required ports and protocols. You can check the network security requirements for each resource type here: What is a private endpoint? - Azure Private Link | Microsoft Learn

You may also refer: https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-private-links-for-import-export-portal

Do let us know if you have any further queries. I’m happy to assist you further.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.