How to setup private link for multiple VNETs in different Azure tentants

amien 0

I have the following setup

Azure tentant1 : vnet1 : subnet 1 : private link/private end-point to Azure SQL database vnet2
Azure tentant1 : vnet1 : subnet 2 : Delegated to Microsoft.PowerPlatform/vnetaccesslinks
Azure tentant2 : vnet2 : contains an Azure SQL database

My goal is to create a Virtual Network Gateway in PowerBI. Which is Azure tentant1.

I needed to add another subnet in vnet1 (subnet2) because you need to have a delegation in order to create a vnet data gateway in PowerBI. And you can't create a private end-point with a delegation. For some reason the connection is not working in PowerBI. what im i missing?

Do i need to use a Private DNS zone on both sides?
Do i need to add Virtual network links on both sides? linked to its own vnet or cross vnet?
How does the Recordset need to look like on both Private DNS zone?

Can someone explain my next steps, that would be much appreciated. What am i missing?

Sai Prasanna Sinde (Quadrant Resource LLC) 1,000 Reputation points Microsoft Vendor

2024-08-26T05:08:28.21+00:00

Hi@amien,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you are trying to setup private link for multiple VNETs in different Azure tenants.

1.Utilizing a Private DNS zone on both sides is essential for the correct resolution of private endpoint IP addresses. The Private DNS zone must be linked to the virtual network hosting the private endpoint, enabling the DNS query to resolve the private IP address of the resource endpoint.

2.It is necessary to establish virtual network links on both sides, connecting them to their respective virtual networks. This configuration guarantees that DNS requests from the virtual network will seek DNS records within the private DNS zone.

3.The record set within the private DNS zone must include the accurate A records for the resources. For instance, if there is a SQL database, its A record should correspond the FQDN of the SQL database to its private IP address. It is crucial to verify that the A records are properly configured and free of any incorrect IP addresses.

4.Ensure that the private DNS zones are properly linked to the virtual networks. Verify the accuracy of the A records within the private DNS zones.

5.Make sure that the DNS forwarder is configured correctly to relay DNS queries to the private DNS zone. Make sure there are no conflicting IP address ranges or DNS settings.

Kindly let us know if the above helps or you need further assistance on this issue.
amien 0 Reputation points

2024-08-26T06:32:01.3433333+00:00
Sai Prasanna Sinde (Quadrant Resource LLC) .. Thanks for this extensive answer. I will read it again, but meanwhile i have two questions.

I understand that i need to have a private DNS zone on both sides. For the DNS forwarder, do i need to deploy something for this? Like a Azure DNS Private Resolver?

How many Private-End points are involved? Just one: the one that is created on my side and then use the Resource ID of the SQL database on the other side? Or do i need to have a private endpoint on both sides?
Sai Prasanna Sinde (Quadrant Resource LLC) 1,000 Reputation points Microsoft Vendor

2024-08-26T10:18:43.2533333+00:00

Hi@amien,

Can you please share a rough network diagram of your set-up, as we will get a better idea of what you are trying to implement here.
amien 0 Reputation points

2024-08-26T11:44:25.1066667+00:00

Hi Sai Prasanna Sinde (Quadrant Resource LLC)

Based on your comments .. i'm now a step further : So while the Azure SQL is on subscription 1 .. i can connect to it from subscription 2 using a VM/MSSM in the correct vnet.

However, i can't connect from it in PowerBI (in Subscription 2).. i have created a Virtual network data gateway .. to a different subnet because of the needed delegation. Still both in the same VNET.

But when creating the connection, using the Virtual network data gateway, i get this error:

Reason: An instance-specific error occurred while establishing a connection to SQL Server. Connection was denied since Deny Public Network Access is set to Yes (https://docs.microsoft.com/azure/azure-sql/database/connectivity-settings#deny-public-network-access). To connect to this server, use the Private Endpoint from inside your virtual network

For some reason, PowerBI doesn't use the private endpoint to connect and resolved the public endpoint instead. Do i need to have private resolver to fix this?
Sai Prasanna Sinde (Quadrant Resource LLC) 1,000 Reputation points Microsoft Vendor

2024-08-27T02:50:20.31+00:00

Hi@amien,

As you are facing issue with Power Bi Virtual Network Data Gateway set-up, you can take this to (https://community.fabric.microsoft.com/t5/Power-BI-forums/ct-p/powerbi)as we don't have access to it and Power Bi experts will be better equipped to help you out.

Please share the link of the forum post they will make so that community members can follow the issue there.
amien 0 Reputation points

2024-08-27T21:27:38.0666667+00:00

Thanks .. i will place a topic there. Thanks alot for the info!

Share via

How to setup private link for multiple VNETs in different Azure tentants

Your answer