Allow communication between vnets in different subscription

would appreciate some assistance.

I have an single enrolment with two subscriptions

• Subscription A (with several vents e.g. A1, A2, A3)
• Subscription B (with several vents e.g. B1, B2, B3)

I am avoiding the VPNs and VNET peering due to company policies (treat each subscription like a separate entity)

In Subscription B, Azure Files and SQL will be used which Subscription A (A1, A2, A3) need to access and vice versa

We are looking into using public endpoints for Azure SQL and Azure Files (SMB), then locking down the access via firewall rules. This does cause issues with the public endpoints and I will looking at other options other then VPN and VNET peering about securing this communication.

I do appreciate that data between Subscription A and Subscription B will be via the Azure backbone as all service are in the same region.

Could Private Links be used there?

thanks

Could Private Links be used there?

As per the Microsoft official document:

In Azure, Private Link allows you to access Azure PaaS Services like Azure Storage, SQL Database and Azure hosted customer-owned/partner services over a private endpoint in your virtual network.

So, as per the above statement, the Private Links also work in the Virtual Network only.

To make a secure connection between two Azure services which are either in same or different subscription, you can use combination of VNet and Firewall settings.

The VNet doesn’t combine the services but only allows us to communicate with each other. Your resources will be considered as a separate entity only.

In the File share side, you can use Firewall for specific client IP address along with Allow Azure services on the trusted services list to access this storage account feature. You can also route specific endpoints. Refer below image.

On the SQL side, to access public networks, you can choose Public network access option and allow only selected networks to access the server. Along with that, you should also opt for Allow Azure services and resources to access this server.