How to lock the Vnet peerings like we lock the the resources in resource group once after we create them?

Question

To prevent unauthorized peerings to other Vnets after creation, it's essential to lock the peerings to restrict access for other users from creating unnecessary peerings. How to do that?
Can anyone help me out with this?

Thanks.

Answer 1

@Priyanka Varma ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to restrict users from creating unauthorized VNET Peerings.

You can do this in a couple of ways:

Use RBAC least privilege custom roles:

• See : Only grant the access users need
• The required permissions for updating a Peering are : See here
• or a Network Contributor role.
• Make sure the unauthorized users are not presented with the above role or a custom role with the above listed permissions.

Use VNET Read-only Lock:

• To create or delete management locks, you need access to Microsoft.Authorization/* or Microsoft.Authorization/locks/* actions.
• Users assigned to the Owner and the User Access Administrator roles have the required access to create or delete the Lock of the VNET.
• ReadOnly means authorized users can read a resource, but they can't delete or update it. Applying this lock is similar to restricting all authorized users to the permissions that the Reader role provides

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

---

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.