getting error during setup the vnet peering in two different subscription/tenant

Question

getting error during setup the vnet peering in two different subscription/tenant

Khushi 0

Hi,

I am trying to set up the vnet peering by using the below MS article. But getting error as attached image. Please help me to try to fix this.

https://learn.microsoft.com/en-us/azure/virtual-network/create-peering-different-subscriptions?tabs=create-peering-portal

User's image

JimmySalian-2011 42,486 Reputation points

2023-12-12T16:37:10.9533333+00:00

Hi Khushi,

It is not clear if you are using Portal or Azure CLI or PS Module?

Usually the access token is invalid could be related to account access issue or the Azure CLI version or PS Modules version, can you try and check if all the modules are updated to latest release and also you can logout completely and try again?

$ az logout

$ az login

Hope this helps.

JS

==

Please Accept the answer if the information helped you. This will help us and others in the community as well.
Khushi 0 Reputation points

2023-12-13T00:36:56.1466667+00:00

JimmySalian-2011, Thanks for the response. I am using azure portal to do vnet peering and to authenticate using user id. same as mentioned in the ms article. and I have also assigned the permission. But still facing error. Can you please help me as soon as possible.

Thanks!
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-12-13T12:57:39.1333333+00:00
Hello @Khushi ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you are getting an "authentication failed" error when configuring Vnet peering in two different subscriptions/tenants.

Did you check the prerequisites properly, assign the permissions on both subscriptions and initiate the network peering configuration?

Are you using a single account to create the Vnet peering or an account in each subscription?

An Azure account with permissions in both subscriptions or an account in each subscription with the proper permissions to create a virtual network peering.

To separate the duty of managing the network belonging to each tenant, add the user from each tenant as a guest in the opposite tenant and assign them the Network Contributor role to the virtual network. This procedure applies if the virtual networks are in different subscriptions and Active Directory tenants.

To establish a network peering when you don't intend to separate the duty of managing the network belonging to each tenant, add the user from tenant A as a guest in the opposite tenant. Then, assign them the Network Contributor role to initiate and connect the network peering from each subscription. With these permissions, the user is able to establish the network peering from each subscription.

Refer: https://learn.microsoft.com/en-us/azure/virtual-network/create-peering-different-subscriptions?tabs=create-peering-portal#prerequisites

Regards,

Gita
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-12-14T12:17:19.1533333+00:00

@Khushi , could you please provide an update on this post?
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-12-15T10:51:42.96+00:00

@Khushi , do you have any new updates on this issue?
Khushi 0 Reputation points

2024-01-07T01:31:50.4233333+00:00

Yes, I have checked multiple times. But still getting same error.
Silvia Wibowo 6,041 Reputation points Microsoft Employee Volunteer Moderator

2024-01-08T00:40:49.3666667+00:00
Hi @Khushi , please give more information: at which point did you get the error message, creating peering vnet1 to vnet2? You said you've checked multiple times, what exactly did you check? We're trying to help, but we will not get any progress if you do not give us any additional information such as:

Is it the same user you're using for both tenants?

What role(s) do you assign to the user in first tenant? In second tenant?

Does it give you the same error if you try to establish peering from vnet2 to vnet1?

Any screenshots will be helpful. Feel free to redact sensitive info.
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2024-01-10T13:01:21.2+00:00

@Khushi , could you please share the above requested details?

Are you using a single account to create the Vnet peering or an account in each subscription?

Your answer

JimmySalian-2011 42,486 Reputation points

2023-12-12T16:37:10.9533333+00:00

Hi Khushi,

It is not clear if you are using Portal or Azure CLI or PS Module?

Usually the access token is invalid could be related to account access issue or the Azure CLI version or PS Modules version, can you try and check if all the modules are updated to latest release and also you can logout completely and try again?

$ az logout

$ az login

Hope this helps.

JS

==

Please Accept the answer if the information helped you. This will help us and others in the community as well.
Khushi 0 Reputation points

2023-12-13T00:36:56.1466667+00:00

JimmySalian-2011, Thanks for the response. I am using azure portal to do vnet peering and to authenticate using user id. same as mentioned in the ms article. and I have also assigned the permission. But still facing error. Can you please help me as soon as possible.

Thanks!
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-12-13T12:57:39.1333333+00:00

Hello @Khushi ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you are getting an "authentication failed" error when configuring Vnet peering in two different subscriptions/tenants.

Did you check the prerequisites properly, assign the permissions on both subscriptions and initiate the network peering configuration?

Are you using a single account to create the Vnet peering or an account in each subscription?

An Azure account with permissions in both subscriptions or an account in each subscription with the proper permissions to create a virtual network peering.

To separate the duty of managing the network belonging to each tenant, add the user from each tenant as a guest in the opposite tenant and assign them the Network Contributor role to the virtual network. This procedure applies if the virtual networks are in different subscriptions and Active Directory tenants.

To establish a network peering when you don't intend to separate the duty of managing the network belonging to each tenant, add the user from tenant A as a guest in the opposite tenant. Then, assign them the Network Contributor role to initiate and connect the network peering from each subscription. With these permissions, the user is able to establish the network peering from each subscription.

Refer: https://learn.microsoft.com/en-us/azure/virtual-network/create-peering-different-subscriptions?tabs=create-peering-portal#prerequisites

Regards,

Gita
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-12-14T12:17:19.1533333+00:00

@Khushi , could you please provide an update on this post?
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-12-15T10:51:42.96+00:00

@Khushi , do you have any new updates on this issue?
Khushi 0 Reputation points

2024-01-07T01:31:50.4233333+00:00

Yes, I have checked multiple times. But still getting same error.
Silvia Wibowo 6,041 Reputation points Microsoft Employee Volunteer Moderator

2024-01-08T00:40:49.3666667+00:00

Hi @Khushi , please give more information: at which point did you get the error message, creating peering vnet1 to vnet2? You said you've checked multiple times, what exactly did you check? We're trying to help, but we will not get any progress if you do not give us any additional information such as:

Is it the same user you're using for both tenants?

What role(s) do you assign to the user in first tenant? In second tenant?

Does it give you the same error if you try to establish peering from vnet2 to vnet1?

Any screenshots will be helpful. Feel free to redact sensitive info.
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2024-01-10T13:01:21.2+00:00

@Khushi , could you please share the above requested details?

Are you using a single account to create the Vnet peering or an account in each subscription?

Share via

getting error during setup the vnet peering in two different subscription/tenant

Your answer