Can VNET Peering across tenants be configured using Bicep?

[trylvis]

Hi all,

Can VNET Peering across Entra Tenants be configured using Bicep?

Does it exist any documentation on how to do it in Bicep? Took a look at AVM but could not see any examples there.

Working on implementing this in Bicep, we have no issues configuring VNET peering in subscriptions within the same tenant. However, when configuring this where Subscriptions are in different tenants, we get this;

_"...however the current tenant 'a' is not authorized to access linked subscription 'b' "

Thanks in advance!

[GABRIELNGBTUC]

I don't see why it wouldn't be possible. Did you make sure to use the "--aux-tenants" switch when running your azure CLI command? As this is necessary to make use of RBAC permissions on other tenants with the deployment commands https://learn.microsoft.com/en-us/cli/azure/deployment/group?view=azure-cli-latest#az-deployment-group-create

[trylvis]

Do you happen to know if that could be done at the Subscription scope as well? (az deployment sub). I see there is no "--aux-tenants" param available there though.

Or would I need to do it at the resource group level? Currently, we have our VNET stuff deployed at the subscription level and would prefer to keep it that way.

[GABRIELNGBTUC]

Unfortunately it looks like it only supports this option at the resource group level and is a limitation of the API itself Azure/azure-cli#21417