How to login and deploy resource using resource management private link?

Question

Hello. I test private connection using resource management private link and private endpoint.

How to azure login using private endpoint?

I deploy VM, resource management private link associated with private endpoint. And I add DNS information in /etc/hosts ( private endpoint IP : management.azure.com )

When i command azure login --identity --debug, i get error message below.

cli.azure.cli.core.azclierror: (PrivateLinkAccessRestricted) Request originated from private virtual network for resource '/subscriptions', but this resource can not be accessed from a private endpoint. To connect to this resource, please use the public network without a private endpoint.
Code: PrivateLinkAccessRestricted
Message: Request originated from private virtual network for resource '/subscriptions', but this resource can not be accessed from a private endpoint. To connect to this resource, please use the public network without a private endpoint.
az_command_data_logger: (PrivateLinkAccessRestricted) Request originated from private virtual network for resource '/subscriptions', but this resource can not be accessed from a private endpoint. To connect to this resource, please use the public network without a private endpoint.
Code: PrivateLinkAccessRestricted
Message: Request originated from private virtual network for resource '/subscriptions', but this resource can not be accessed from a private endpoint. To connect to this resource, please use the public network without a private endpoint.

How to solve this issue?

Is it impossible to login and deploy resource (network, vm) using resource management private link?

Answer 1

Hi Venkat.
Thank you for your apply!

I tried to Method 1.
First, VM was authenticated using public access.
Secondly, I add that private endpoint IP : management.azure.com in /etc/hosts.

Lastly, I try to create vm using azure cli but same error is still occured.

az vm restart -g mw-resource-group-2 -n testvm

(PrivateLinkAccessRestricted) Request originated from private virtual network for resource '/subscriptions/<Subscription ID>/resourceGroups/mw-resource-group-2/providers/Microsoft.Compute/virtualMachines/testvm/restart', but this resource can not be accessed from a private endpoint. To connect to this resource, please use the public network without a private endpoint.
Code: PrivateLinkAccessRestricted
Message: Request originated from private virtual network for resource '/subscriptions/
<Subscription ID>/resourceGroups/mw-resource-group-2/providers/Microsoft.Compute/virtualMachines/testvm/restart', but this resource can not be accessed from a private endpoint. To connect to this resource, please use the public network without a private endpoint.

Which commands is working correctly using private endpoint? What is resource-level operations?

Answer 2

Hi @Minwoo Jo

Even though you've configured a private endpoint for ⁣,management.azure.com Azure does not fully support all Azure CLI or SDK operations—such as over private linkaz login alone, especially for tenant- or subscription-level endpoints like /subscriptions``/tenants

Method 1: Temporary public access for login operations like az login, az account list, or ⁣ requiresaz vm create access to control plane endpoints that are not yet exposed via Private Link.

To work around this, temporarily allow internet access (either directly on the VM ) to perform login and control plane operations:

az login --identity

Once authenticated, most supported resource-level operations will work over the existing Private Endpoint.

Note: If you are using Azure VM and created the same VNet as the resource management private link, there is no need to add any host entry on VM

Method 2: Use Azure Bastion Keep the private VM fully isolated, and use a secure jump host or Azure Bastion (with internet access) for CLI authentication and initial deployment tasks.

As I tested the same in my environment without internet access, I also encountered the same error.

To resolve the issue, I created an outbound rule for internet access to the VM, as shown below.

After creating the rule, I was able to connect to the VM using the cmdlet and successfully create resources using the same identity

I hope this helps to resolve your issue. Please feel free to ask any questions if the solution provided isn't helpful.

Please provide your valuable feedback on the thread by clicking Accept the answer and upvoting wherever the information was helpful, as this can be beneficial to other community members