How to simply share an image I made in my Azure compute gallery with another tenant?

Yogev Chaimovich 45

I'm trying to share an image I made and have in my Azure compute gallery in the simplest way.

1'st, I see I cannot use the direct share even if I don't want to share in "public preview".
I am the owner of this subscription tenant, I have Microsoft.Compute registered.
And Microsoft.Compute/DirectSharedGalleries does not exist.

User's image

After that failed, I saw the app registration way but I thought it seems too complicated. So I went with the RBAC way which says it can also share to different tenants, AFAIU:

User's image

I followed the "Portal" instruction and got to a dead end when I couldn't add an email of a tenant which is outside of my organization. Even though they say it should be possible and I'll get a message "This user will be sent an email that enables them to collaborate with Microsoft"

User's image

When I search for an email which is outside of my organization it just filters out all users and I have no users to choose.

I tried running the CLI commands and got an error

User's image

Cannot find user or service principal in graph database for 'a-user@hotmail.com'. If the assignee is an appId, make sure the corresponding service principal is created with 'az ad sp create --id a-user@hotmail.com'.

This user is not an appId.

I can't understand how to simply share an image with another tenant?

Please help.

Srinud 2,235 Reputation points Microsoft Vendor

2024-08-27T15:13:51.3033333+00:00
Hi Yogev Chaimovich,

Based on your issue i have verified from my end the IAM role assignment blade in my directory and received the prompt, the user will be sent an email that enables them to collaborate with Contoso. Please refer to the attached screenshot for reference.

Kindly verify if you can invite guest users from Microsoft Entra ID by following the instructions in the document below.

Add guest users to the directory

This will confirm whether you have the necessary permissions to invite guest users to your directory.

If the information is helpful, please consider by clicking the "Upvote" on the post.

Yogev Chaimovich 45

Thanks, looks like it was the issue!
Now I have another problem. In the person I've shared my gallery with. He was able to get the image, but he doesn't have the authorization to access linked subscriptions from his side. I can't find how he should enable it. This is his error message after tying to use my image:

(main issue: "however the current tenant 'sub1' is not authorized to access linked subscription 'sub3'")

{"status":"Failed","error":{"code":"DeploymentFailed","target":"/subscriptions/sub2/resourceGroups/group-test/providers/Microsoft.Resources/deployments/demo","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"LinkedAuthorizationFailed","message":"The client has permission to perform action 'Microsoft.Compute/galleries/images/versions/read' on scope '/subscriptions/sub2/resourcegroups/group-test/providers/Microsoft.Compute/virtualMachines/group-test-vvv', however the current tenant 'sub1' is not authorized to access linked subscription 'sub3'."}]}}

Srinud 2,235 Reputation points Microsoft Vendor

2024-08-28T14:56:41.9033333+00:00
Hi Yogev Chaimovich,

To resolve the issue with accessing resources across subscriptions.

Here are some below troubleshoot steps to follow:

Verify that any linked resources or services in subscription sub3 are configured to allow access from tenant sub1.

Make sure there are no Azure policies or specific restrictions in subscription sub3 that might be blocking access from tenant sub1.

Confirm that the user or service principal from tenant sub1 has the appropriate permissions in subscription sub3.

Check and assign the necessary roles at both the subscription and resource group levels to ensure that the user from tenant sub1 has adequate access.

Please find the below document for your reference:

Assign Azure roles using the Azure portal

If the information is helpful, please consider by clicking the "Upvote" on the post.

Thank you.
Yogev Chaimovich 45 Reputation points

2024-08-28T17:30:50.3866667+00:00

I'm not sure I understand.
I gave another user a read role for this gallery.

Now this user doesn't really have this permission - he cannot start a VM based on my image.

But I see now, this user have 2 directories. He can "Switch directory" to my directory.
In case he switch, he does see my shared image, but of course, he has no other permissions to do anything.

The whole point was to let him start a VM on his environment (his tenant/subscription) not mine, based on my image.

So I'm not sure what this RBAC sharing actually did.
Yogev Chaimovich 45 Reputation points

2024-08-28T18:34:16.3533333+00:00

Looks like I solved it. I have to add the --aux-tenants to the az deployment group create command.

Accepted answer

Srinud 2,235 Reputation points Microsoft Vendor

2024-08-29T11:33:09.7566667+00:00

Hi Yogev Chaimovich,

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

Issue:

sharing compute gallery image to another tenant using RBAC.

Solution:

By adding --aux-tenants parameter to az deployment group create command.

If you have any other questions or are still running into more issues, please let me know. Thank you again for your time and patience throughout this issue.

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Thank you.
Please sign in to rate this answer.

1 person found this answer helpful.
Yogev Chaimovich 45 Reputation points

2024-09-10T05:41:40.2133333+00:00

I realized also this need to be done, from https://learn.microsoft.com/en-us/azure/virtual-machines/share-using-app-registration?tabs=cli

az login --tenant <tenant1> az account get-access-token az login --tenant <tenant2> az account get-access-token
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to simply share an image I made in my Azure compute gallery with another tenant?

0 additional answers

Your answer