Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Yes—Azure virtual networks can communicate across subscriptions. The usual approach is to create a separate VNet in each subscription and connect them with virtual network peering. That connects the networks; it does not turn one VNet into a shared resource or merge their ownership, security, or administration.
For a small number of VNets, direct peering is often the simplest choice. If you need shared gateways, centralized inspection, or connectivity across many subscriptions, consider a hub-and-spoke design, Azure Virtual Network Manager, or Azure Virtual WAN instead.
What “sharing a VNet” means in Azure
The phrase can describe several different needs, and they do not all call for the same architecture:
- Connect workloads in separate subscriptions: Peer a VNet in each subscription, or connect them through a transit design.
- Use a central VPN or ExpressRoute gateway: Peer a spoke VNet with a hub and configure gateway transit.
- Manage connectivity across many subscriptions: Use Azure Virtual Network Manager to define and distribute connectivity configurations.
- Build managed, large-scale transit: Evaluate Azure Virtual WAN, especially where branches, remote users, multiple regions, or inter-hub routing are involved.
In the common peering design, each subscription owns its own VNet:
#1 Best Overall
Subscription A Subscription B
┌────────────────┐ ┌────────────────┐
│ VNet A │◄── peering ──►│ VNet B │
│ app workloads │ │ shared tools │
└────────────────┘ └────────────────┘Peering provides private IP connectivity between the networks when both peering links are configured and connected. It does not combine the VNets into one administrative or security boundary. Azure supports peering across subscriptions, including subscriptions in different Microsoft Entra tenants in documented Azure scenarios. See Microsoft’s cross-subscription peering guide and Virtual Network FAQ.
Why keep networks in separate subscriptions?
Organizations commonly separate subscriptions for billing and chargeback, production versus development, business-unit ownership, policy and RBAC scopes, quotas, lifecycle management, or regulatory and operational separation. A dedicated networking subscription can hold shared services while application teams retain control of their own subscriptions.
That separation does not inherently prevent private connectivity. It does mean teams must agree on who can approve peerings, which address ranges are permitted, how traffic is routed and filtered, and which subscription pays for shared networking. Subscription boundaries are useful governance boundaries, but a peering connection still creates network reachability that must be designed and secured deliberately. Microsoft’s Azure infrastructure security guidance discusses multi-subscription organization and centralized controls.
Choose the right connection pattern
| Option | Best suited to | Important trade-off |
|---|---|---|
| Direct VNet peering | A few VNets with stable, direct private connectivity needs. | Simple and low overhead, but peering relationships and exceptions become harder to govern as the network grows. Peering is not transitive. |
| Hub-and-spoke | Several application subscriptions that need shared firewall, DNS, Bastion, VPN, or ExpressRoute services. | Central control and reuse, in exchange for hub dependency, routing complexity, and gateway or appliance costs. |
| Azure Virtual Network Manager | Many VNets or subscriptions where connectivity configurations need centralized definition and distribution. | Adds a management layer and cost; it does not remove underlying data-transfer, peering, gateway, or firewall charges. |
| Azure Virtual WAN | Global or branch-connected environments needing managed hubs, transit, VPN or ExpressRoute integration, or inter-hub routing. | More infrastructure and cost than a simple peering design. Standard is the relevant tier for capabilities such as VNet-to-VNet transit and inter-hub transit. |
| VPN Gateway | Gateway-based encrypted connectivity, including on-premises access or cases where peering is not appropriate. | Gateway capacity, throughput, latency, and operating costs must be considered. |
| ExpressRoute | Dedicated private connectivity between Azure and customer networks through a provider. | Greater provisioning and cost complexity; usually unnecessary just to connect two Azure VNets. |
| Subnet peering | Advanced designs seeking more selective subnet-level connectivity. | Not the default: availability and limitations apply. Check the current subnet peering documentation before designing around it. |
For two straightforward VNets, begin by evaluating direct peering. Choose a hub-and-spoke model when shared security or gateways are requirements, not merely because subscriptions differ. For large or frequently changing topologies, compare Virtual Network Manager and Virtual WAN against the operational burden and costs of managing connections yourself. Neither product is automatically cheaper at scale.
More detail on managed transit options is available in Microsoft’s Virtual Network Manager FAQ, Virtual WAN topology guide, and Virtual WAN overview.
Before you create a peering
Check these items before changing either VNet:
- Non-overlapping address spaces: Azure does not permit peering VNets whose address spaces overlap. Plan future growth as well as current ranges.
- Permissions on both VNets: The operator needs appropriate network permissions in both subscriptions and must be able to identify the remote VNet by its full resource ID.
- Correct tenant and subscription context: Confirm which account, tenant, and subscription each command or portal action targets.
- Supported deployment and region: Both VNets must be Azure Resource Manager VNets. Same-region peering is local; peering across supported regions is global. Verify region and cloud compatibility for the specific deployment.
- Routing and security plan: Decide which sources, destinations, and ports should communicate, and whether traffic must pass through a firewall or other appliance.
- DNS plan: Decide how workloads will resolve private names across the VNet boundary.
Different Microsoft Entra tenants add administrative work. Depending on the setup, an operator may need guest access and permissions in both tenants. For unattended automation, Microsoft documents a service-principal workflow using Azure CLI or PowerShell; that workflow is not provided by the portal. See the cross-tenant peering guide and service-principal instructions.
Rank #2
Create cross-subscription peering with Azure CLI
This example assumes you can authenticate and have permissions on both VNets. Replace the sample subscription names, resource groups, VNet names, and resource IDs with your own. Create one peering from each VNet to the other: a single link is not enough.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute1. Sign in and select the first subscription
az login
az account set --subscription "subscription-1"2. Get the remote VNet’s resource ID
vnetidB=$(az network vnet show
--name vnet-2
--resource-group test-rg-2
--subscription "subscription-2"
--query id
--output tsv)
echo "$vnetidB"The result should resemble /subscriptions/<subscription-2-id>/resourceGroups/test-rg-2/providers/Microsoft.Network/virtualNetworks/vnet-2.
3. Create the first peering link
az network vnet peering create
--name vnet-1-to-vnet-2
--resource-group test-rg
--vnet-name vnet-1
--subscription "subscription-1"
--remote-vnet "$vnetidB"
--allow-vnet-access4. Create the reverse link
Use the full resource ID of VNet 1 in the command below:
az network vnet peering create
--name vnet-2-to-vnet-1
--resource-group test-rg-2
--vnet-name vnet-2
--subscription "subscription-2"
--remote-vnet "/subscriptions/<subscription-1-id>/resourceGroups/test-rg/providers/Microsoft.Network/virtualNetworks/vnet-1"
--allow-vnet-access5. Check both peering states
az network vnet peering list
--resource-group test-rg
--vnet-name vnet-1
--subscription "subscription-1"
--output table
az network vnet peering list
--resource-group test-rg-2
--vnet-name vnet-2
--subscription "subscription-2"
--output tableBoth directions should show Connected. For repeatable production deployments, use your infrastructure-as-code process and make sure it manages both links and their configuration. Microsoft’s peering tutorial also documents a PowerShell approach using separate subscription contexts and each remote VNet’s resource ID.
Use the Azure portal
For user-based administration, the general portal workflow is:
- Open Virtual networks and select the first VNet.
- Open Peerings, then select + Add.
- Enter a peering name and select the remote subscription, resource group, and VNet.
- Leave Allow virtual network access enabled for ordinary VNet-to-VNet communication unless your design requires otherwise.
- Configure forwarded traffic or gateway options only when the routing design calls for them.
- Create the reverse peering from the remote VNet, then check that both sides show
Connected.
Portal labels can change, and cross-tenant automation may require a different workflow. CLI, PowerShell, or infrastructure as code is generally easier to repeat and review.
Understand the peering settings
- Allow virtual network access: Enables traffic between the peered VNets. It does not override NSGs, route tables, firewalls, or application-level controls.
- Allow forwarded traffic: Relevant when traffic is forwarded through an NVA or firewall rather than originating from a resource in the peered VNet. Hub-and-spoke designs often need this set appropriately on the peerings involved in appliance transit.
- Allow gateway transit: Set on the hub-side peering when spokes should use the hub’s VPN or ExpressRoute gateway.
- Use remote gateways: Set on the spoke-side peering to use that remote hub gateway. A VNet with its own gateway cannot use a remote gateway at the same time, and a VNet can use only one remote gateway relationship.
For gateway transit, make the configuration intentionally asymmetric: the hub allows gateway transit and the spoke uses the remote gateway. Confirm route propagation and user-defined routes as well; enabling the peering options alone does not guarantee the intended path. See Microsoft’s peering and gateway transit training and Virtual Network FAQ.
Peering does not provide transitive connectivity
If VNet A is peered with VNet B, and VNet B is peered with VNet C, A does not automatically communicate with C:
VNet A ↔ VNet B ↔ VNet C
No automatic A-to-C transitTo provide transit, explicitly design a supported path through a hub appliance, gateway, or managed transit service such as Virtual WAN. Peering by itself also does not force traffic through a firewall. If centralized inspection is mandatory, configure routes and appliance forwarding so the actual path passes through the inspection point, and verify the return path.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallDNS: private IP access does not guarantee name resolution
A common surprise is that an application can reach a remote private IP address while its hostname fails to resolve. VNet peering does not automatically make Azure-provided VNet name resolution work across the peering boundary.
Common approaches to cross-VNet name resolution include:
- Linking the relevant VNets to Azure Private DNS zones.
- Using Azure DNS Private Resolver for managed forwarding.
- Running or reusing central DNS forwarders, with appropriate conditional forwarding and routes.
- Using application-specific service discovery where suitable.
Check VNet DNS settings, zone links, forwarding rules, and firewall access to DNS. Microsoft’s cross-subscription tutorial notes the need for a deliberate cross-VNet name-resolution solution. A DNS Private Resolver is one managed option; whether it fits depends on the existing DNS design.
Secure the connection and verify the traffic path
“Private” describes the network path, not the authorization policy. A peering connection does not authenticate users or applications, encrypt application traffic, or automatically inspect packets. Apply least-privilege rules using:
- Network security groups (NSGs) that permit only required source ranges, destinations, and ports.
- Azure Firewall or a supported network virtual appliance when centralized inspection or filtering is required.
- User-defined routes (UDRs) where traffic must use a specific firewall or appliance path.
- Service-level firewalls, private endpoint configuration, operating-system firewalls, and application identity controls.
After a peering reports Connected, inspect effective routes on the affected network interface. Confirm the destination prefix and next hop, check whether a UDR or security administrator rule changes the path, and verify return routing. A connected peering proves that the link exists; it does not prove that the intended packet path, security policy, or application is working.
For a VNet using an NVA, verify forwarded-traffic settings and appliance routes on the relevant links. If address spaces change after peering, check whether the peering needs resynchronization to pick up the updated prefixes. Plan changes carefully: Microsoft’s FAQ also notes that a VNet cannot be moved while an existing peering remains; remove the peering before a move and recreate it afterward.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Costs and ownership
Creating the peering object does not by itself incur a separate connection-creation fee, but data transferred across peered VNets is billable. Rates depend on factors such as region and traffic direction; do not assume that “same subscription” or “same tenant” makes data transfer free. Gateway-transit traffic can also incur peering charges on the spoke or non-gateway VNet.
Model the whole design, not only peering: firewall or NVA processing, VPN or ExpressRoute gateways, Virtual WAN hubs and data processing, and management services can all add cost. Azure Virtual Network Manager pricing can depend in part on managed subscriptions, while underlying peering traffic charges still apply. Set expectations for who owns peering traffic, shared firewall and DNS costs, gateways, monitoring, and chargeback when subscriptions belong to different teams.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Prices vary by region, service tier, direction, and configuration. Use the current Azure Virtual Network pricing, Virtual Network Manager pricing, and Virtual WAN pricing pages or the Azure pricing calculator to model the specific design.
Best Value
Troubleshooting by symptom
Peering is Initiated
Usually, only one direction has been created. Create the reverse link and check both VNets again. Each side needs its own peering object.
Peering is Disconnected
This commonly means one side was deleted. Remove the remaining stale link and recreate both directions, then verify their states.
Peering creation fails
Check for overlapping address ranges, an incorrect remote resource ID, insufficient permissions in one subscription, the wrong tenant or subscription context, or an unsupported region/cloud combination. Also check gateway constraints if remote gateway use is involved.
Recommended Free Tools
Ping fails
Ping is not a reliable verdict on peering. ICMP may be blocked by NSGs, a guest operating-system firewall, Azure Firewall, an NVA policy, or the workload configuration. Test the actual application port with an appropriate TCP test or Network Watcher connection troubleshooting.
Private IP works but a hostname fails
Investigate DNS rather than assuming the peering is broken. Validate the VNet DNS settings, Private DNS zone links, forwarding rules, DNS reachability through firewalls, and return routes from DNS forwarders.
Traffic bypasses the firewall or takes an unexpected route
Inspect effective routes and next hops on both ends. Check UDR associations, forwarded-traffic settings, route propagation, appliance configuration, and the return path. Peering alone does not impose inspection.
Gateway transit does not work
Confirm the hub has a VPN or ExpressRoute gateway, its peering allows gateway transit, the spoke peering uses the remote gateway, and the spoke does not have its own gateway. Then check route propagation and UDRs for conflicting paths.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →One Azure service is still unreachable
Do not assume every Azure service or service-endpoint ACL scenario supports every cross-subscription or cross-tenant combination. Check that service’s network-access requirements separately; VNet peering does not remove service-specific restrictions.
Edge cases worth checking
- Different Azure clouds: Public Azure regions cannot be globally peered with national-cloud regions. Check the current compatibility guidance for your specific cloud.
- Global peering and Basic Load Balancer: Microsoft documents limitations for resources behind a Basic Load Balancer when accessed through its frontend IP over global peering. Validate the applicable load-balancer behavior and consider direct private IP access or another design.
- VNet moves: Existing peering must be removed before moving a VNet. Include recreation and cutover in the lifecycle plan.
- Subnet peering: Treat it as an advanced option. Current feature availability and limitations—including address-space uniqueness, delegated subnet behavior, subnet counts, and interactions with Virtual Network Manager—need to be checked in the current documentation.
Practical decision guide
- Two VNets, straightforward traffic: Use direct peering if the address spaces do not overlap and direct connectivity is acceptable.
- Several subscriptions need shared security or gateways: Use hub-and-spoke, with explicit routing, firewall, and DNS design.
- Many VNets change often: Evaluate Azure Virtual Network Manager to centrally define connectivity.
- Global regions, branches, or managed transit: Evaluate Azure Virtual WAN, including the tier and services the design requires.
- Dedicated private connection to on-premises: Evaluate ExpressRoute; use VPN Gateway when an encrypted gateway-based tunnel better fits the requirement.
Whichever pattern you choose, treat permissions, routes, DNS, security policy, cost ownership, and lifecycle changes as part of the network design—not as details that peering automatically handles.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
