Azure Load Balancer supports cross-subscription load balancing, where the frontend IP and/or the backend pool instances can be in a different subscription than the Azure Load Balancer.
This article provides an overview of cross-subscription load balancing with Azure Load Balancer, and the scenarios it supports.
What is cross-subscription load balancing?
Cross-subscription load balancing allows you to deploy Azure Load Balancer resources across multiple subscriptions. This feature enables you to deploy a load balancer in one subscription and have the frontend IP and backend pool instances in a different subscription. This capability is useful for organizations that have separate subscriptions for networking and application resources.
This table illustrates some of the possible scenarios cross-subscription load balancing supports.
Subscription 1
Subscription 2
Load Balancer
Backend pool resources and Frontend IP address
Load Balancer and Backend pool resources
Frontend IP address
Load Balancer and Frontend IP address
Backend pool resources
Cross-subscription frontend IP configurations
Cross-subscription frontends allow the frontend IP configuration to reside in a different subscription other than the load balancer’s subscription. To enable cross-subscription frontend IP configurations, the following tag needs to be set to true: IsRemoteFrontend: True, and the SyncMode property needs to be enabled on the backend pool.
Public frontend IP configurations
Public IP addresses utilized by an Azure Load Balancer can reside in different subscription than the load balancer. If multiple public IP addresses are attached to a load balancer, each IP address can come from a different subscription. For example, if we have a Load Balancer (deployed in subscription C) with two frontend IPs, the first IP address can reside in subscription B and the second IP address can reside in subscription A.
An important note is that once a frontend IP configuration is set, its subscription can’t be modified. However, the frontend IP configuration can be updated with a different IP address within the same subscription. For example, if a frontend IP configuration is attached to IP address A in subscription 1, it can be updated to IP address B also in subscription 1.
Cross-subscription public IP addresses are only supported on the regional tier standard load balancer
Internal frontend IP configurations
Like public load balancers, internal load balancers can also have cross-subscription frontend IP configurations. In this case, the subnet/virtual network can reside in a different subscription than the load balancer. However, unlike public frontends, all internal frontend configurations must come from the same subnet/virtual network. Furthermore, all backend pools must be configured to the same virtual network as the frontend IP configurations.
Cross-subscription backend pools
Cross-subscription backends allow backend instances to reside in a different subscription other than the load balancer’s subscription. For example, the load balancer could be in subscription 1 and my backend VMs could be located in subscription 2.
The backend instances and the virtual network they refer to can be located in a different subscription. Cross-subscription backend pools must utilize a new property known as SyncMode.
What is SyncMode
The SyncMode property is a parameter that you can specify when you create a backend pool by using IP addresses and virtual network IDs. This property must be set when using cross-subscription frontends or backends. It has two possible values: Automatic or Manual.
In addition, this property replaces the concept of NIC-based or IP-based backend pools. As a result, backend pools with the SyncMode property configured are a distinct type of backend pool, separate from NIC or IP-based backend pools. Backend pools can either be exclusively NIC-based, IP-based, or SyncMode enabled.
When should I use Automatic SyncMode
With SyncMode configured as Automatic, backend pool instances are synchronized with the load balancer configuration. As a result, changes to the backend pool instances are automatically reflected in the load balancer’s backend pool configuration. This change is relevant when using virtual machine scale sets in the backend pool. When the scale set scales in/out, the backend pool members are automatically added or removed from the pool accordingly.
Like NIC (network interface cards) based backend pools, if SyncMode is set to Automatic, then each backend instance’s NIC must also reference the load balancer backend pool. As a result, backend instances are added to Automatic SyncMode backend pools by updating the NIC resource’s reference to the load balancer.
When should I use Manual SyncMode
With SyncMode configured as Manual, backend pool instances aren't synchronized with the load balancer configuration. This mode allows you to create a backend pool with pre-provisioned private IP addresses that can be used for scenarios such as disaster recovery, active-passive, or dynamic provisioning. When using Manual SyncMode backend pools, you're responsible for updating the backend pool when any changes to your backend instances occur, such as with a scale set autoscaling.
Cross-subscription Global Load Balancer
In addition, cross-subscription load balancing is supported for Azure global Load Balancer. With cross-subscription global load balancer, backend regional load balancers can each be located in different subscriptions. Cross-subscription backends on a global load balancer don't need other parameters or changes to the backend pool.
Note
Cross-subscription frontends aren't supported on Azure global Load Balancer today.
Authorization
To enable cross-subscription load balancing, a user must be assigned to the Network Contributor role or to a custom role that is assigned the appropriate actions listed in the following table on both subscriptions:
When working cross-tenant, a user must be assigned to the Network Contributor role or to a custom role that is assigned the appropriate actions for cross-subscription frontends in both subscriptions. More information on cross-tenant linkage, see Authenticate requests across tenants.
Limitations
SyncMode can only be set on new backend pools
The SyncMode property must be explicitly set – by default, the SyncMode property is unspecified
API version 2023-04-01 and above needs to be used to when deploying/updating the load balancers
Once configured, the SyncMode property can't be changed on a backend pool
A virtual network must be specified when the SyncMode property is configured. Once a virtual network is configured, it can’t be updated on the backend pool
Use an Azure Resource Manager template to move an external or internal load balancer from one Azure region to another using the Azure portal or Azure PowerShell.