azure-pl-pls-cross-tenant
A Private Link Service configured to accept connections from other tenants (via properties.autoApproval or explicit allowedSubscriptions from cross-tenant subscriptions) records a cross-tenant network trust. A PE from a different tenant connecting to this PLS extends network reachability and access across the tenant boundary.
where
Microsoft.Network/privateLinkServices resource with properties.autoApproval.subscriptions containing subscription IDs from different Entra tenants
OR properties.visibility.subscriptions includes external-tenant subscriptions
emit
| source type | ApplicationIdentity |
|---|---|
| target type | Tenant |
| source | <Private Link Service (records the cross-tenant authorization)> |
| target | <external Entra tenant whose subscription can connect to this PLS> |
| state logic | ACTIVE: if the PLS properties explicitly list auto-approval or visibility settings allowing subscriptions from a different tenant, the cross-tenant trust is in effect. A PE from that tenant's subscription can connect to the PLS immediately (auto-approval) or after PLS owner approval (still cross-tenant). |
Narrative
Private Link Service {pls.name} allows automatic or approved connections from subscriptions in external Entra tenant {consumerTenant.name}. This records a cross-tenant network trust enabling PE-based access to the PLS backend from that external tenant.
Raw rule rules/derived/azure/privatelink.yaml
id: azure-pl-pls-cross-tenant
emits: CrossTenantTrust
description: A Private Link Service configured to accept connections from other tenants (via properties.autoApproval
or explicit allowedSubscriptions from cross-tenant subscriptions) records a cross-tenant network trust.
A PE from a different tenant connecting to this PLS extends network reachability and access across the
tenant boundary.
where:
- Microsoft.Network/privateLinkServices resource with properties.autoApproval.subscriptions containing
subscription IDs from different Entra tenants
- OR properties.visibility.subscriptions includes external-tenant subscriptions
emit:
source_type: ApplicationIdentity
target_type: Tenant
source: <Private Link Service (records the cross-tenant authorization)>
target: <external Entra tenant whose subscription can connect to this PLS>
permissions: []
properties:
cross_tenant: true
pls_tenant: <Entra tenant owning the PLS>
consumer_tenant: <external Entra tenant of the PE-creating subscription>
state_logic: 'ACTIVE: if the PLS properties explicitly list auto-approval or visibility settings allowing
subscriptions from a different tenant, the cross-tenant trust is in effect. A PE from that tenant''s
subscription can connect to the PLS immediately (auto-approval) or after PLS owner approval (still
cross-tenant).'
derived_from:
- '<PLS properties: autoApproval.subscriptions or visibility.subscriptions>'
false_positive_note: The PLS must explicitly allow subscriptions from external tenants via autoApproval
or visibility configuration. If the PLS allows "*" (any subscription), this is effectively a cross-tenant
trust to all external tenants. If the PLS restricts to internal tenants only, no cross-tenant edge.
Clarify the tenant ownership via subscription ID lookup.
narrative: Private Link Service {pls.name} allows automatic or approved connections from subscriptions
in external Entra tenant {consumerTenant.name}. This records a cross-tenant network trust enabling
PE-based access to the PLS backend from that external tenant.