Hi there, we want to use Hub and Spoke with ExpressRoute and multiple subscriptions and we are observing an issue that, for example, the Route Table association to a subnet isn’t working if both are not within the same subscription. Therefore we are looking for some best practice informations to have a better understanding about the efficient distribution of the resources to the different subscriptions without loosing a clear separation of costs between each spoke and the hub. So main goals are separation of each spoke and the hub per subscription for better cost separation and additional permission level sperataion of duty (permissions) as IT should be responsible for Hub and all Network related topics DevOps Team should responsible for any other Spoke infrastructure Many thanks for your thoughts on that, regards joerg

@Jörg Lang Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well. I understand that you have a multi-subscription model and would like to know the best practice for fine-grained access management to Azure resources. You must consider using Azure RBAC Refer : How Azure RBAC works Some resources in Azure does not support cross-subscription association. Route table/NSGs are such resources. You must create individual resources in each subscription if you would like to use the resource. You can use a ARM template to create resources with same properties across subscriptions. What are ARM templates? Wrt permissions, You can assign permissions to individual users or groups . Azure includes several built-in roles that you can use, or you can also create your own Azure custom roles . For e.g., "IT" team can be given "Network Contributor" Role at the subscription or Resource Group level or the VNET Level "DevOps" can be given "Owner" or "Contributor" Role at the Resource Group level or the VNET Level Hope this helps. Please let us know if we can be of any further assistance here. Thanks, Kapil Please Accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer.

Best practice for Hub and Spoke with multiple subscriptions

Accepted answer

KapilAnanth-MSFT 44,561 Reputation points Microsoft Employee

2023-09-27T05:05:43.2866667+00:00
@Jörg Lang

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you have a multi-subscription model and would like to know the best practice for fine-grained access management to Azure resources.

You must consider using Azure RBAC

Refer : How Azure RBAC works

Some resources in Azure does not support cross-subscription association.

Route table/NSGs are such resources.

You must create individual resources in each subscription if you would like to use the resource.

You can use a ARM template to create resources with same properties across subscriptions.

What are ARM templates?

Wrt permissions,

You can assign permissions to individual users or groups.

Azure includes several built-in roles that you can use, or you can also create your own Azure custom roles.

For e.g.,

"IT" team can be given "Network Contributor" Role at the subscription or Resource Group level or the VNET Level

"DevOps" can be given "Owner" or "Contributor" Role at the Resource Group level or the VNET Level

Hope this helps.

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.
Please sign in to rate this answer.
Jörg Lang 120 Reputation points

2023-09-27T05:30:56.06+00:00

Hey Kapil,

many thanks for your quick feedback. That was really helpful.

I guess then our issue is the missing support for cross-subscription association. Is there a list available which resources are not supporting that?

I already thought about, as a workaround, to create the Route Table in each spoke to avoid that issue we are facing. No big deal as we use Terraform as IaC.

We have already prepared management groups, subscription association and Entra Id Groups for granting required RBAC-Roles to the users.

But with distributing the Route Table multiple times in each Spoke/Subscription, I guess we will see the issue, that the DevOps Team would also be able to modify the Route Table as they were planned to be Contributor on the Spoke Subscription.

So I guess it would make sense to create a Custom Role, as copy of contributor, with denied write permission to Network stuff.

What do you think?

One more question when it comes to cost allocation related to the costs of the network peering traffic. To which subscription will they be associated?

many thanks

joerg

KapilAnanth-MSFT 44,561 Reputation points Microsoft Employee

2023-09-27T05:49:51.0333333+00:00

@KapilAnanth-MSFT

You are welcome.

Wrt, "Is there a list available which resources are not supporting that?"

I guess there are no such explicit lists for this

But AFAIK, only a handful of resources support cross subscription association to begin with - this will be the shorter list

Some of the notable resources that support are
ExpressRoute Circuits
Private DNS Zones
VNET Peering

Wrt, "create a Custom Role, as copy of contributor, with denied write permission to Network stuff."

Yes, this would be a good idea

It's better to use Custom Roles as you get a deeper level of granularity

Wrt VNET Peering pricing,

You can refer to this site : https://azure.microsoft.com/en-us/pricing/details/virtual-network/

Make sure you select the Region and Currency of your choice.

Ingress and egress traffic is charged at both ends of the peered networks and the price depends upon if it's a "VNET Peering within the same region" or "Global VNET Peering"

Within "Global VNET Peering", price again varies depending upon the "Zones"

For instance, if data is being transferred from a VNET in zone 1 to a VNET in zone 2, customers will incur outbound data transfer rates for zone 1 and inbound data transfer rates for zone 2.

To provide more information on Zones

A sub-region is the lowest level geo-location that you may select to deploy your applications and associated data. For data transfers (except CDN), the following regions correspond to Zone 1, Zone 2, and Zone 3: Zone 1—Australia Central, Australia Central 2, Canada Central, Canada East, Central US, East US, East US 2, France Central, France South, Germany North, Germany West Central, North Central US, North Europe, Norway East, Norway West, South Central US, Switzerland North, Switzerland West, UK South, UK West, West Central US, West Europe, West US, West US 2 Zone 2—Australia East, Australia Southeast, Central India, East Asia, Japan East, Japan West, Korea Central, Korea South, Southeast Asia, South India, West India Zone 3—Brazil South, South Africa North, South Africa West, UAE Central, UAE North US Gov—US Gov Arizona, US Gov Texas, US Gov Virginia

Please let us know if we can be of any further assistance here. Thanks, Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.

Jörg Lang 120 Reputation points

2023-09-27T06:29:18.93+00:00

Many thanks Kapil

KapilAnanth-MSFT 44,561 Reputation points Microsoft Employee

2023-09-27T06:39:21.5333333+00:00

@Jörg Lang ,

You are most welcome.

Thanks for your continued contribution on Q&A and appreciate much for taking the time to share your feedback.

Cheers,

Kapil
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Best practice for Hub and Spoke with multiple subscriptions

0 additional answers

Your answer