Question

Contoso hosts a multi-tenant SaaS application behind a Private Link service in their Azure subscription. A customer, Fabrikam, creates a private endpoint in their own subscription (a different Entra ID tenant) that targets Contoso's Private Link service using the service's alias. After Fabrikam deploys the private endpoint, its connection status shows 'Pending' and traffic does not flow. What must be done to establish connectivity?

Accepted Answer

Contoso must approve the pending private endpoint connection on the Private Link service, or configure the service for auto-approval by adding Fabrikam's subscription to the visibility/auto-approval list.

Answer

Fabrikam must create a virtual network peering between their VNet and Contoso's VNet so the private endpoint can resolve the backend.

Answer

Contoso must create a service endpoint policy that allows Fabrikam's subscription ID to access the Private Link service.

Answer

Fabrikam must add their subscription to a shared Private DNS zone linked to Contoso's virtual network before the connection can complete.