Can I access Oracle Database @Azure hosted on a different tenant using my Azure Data Factory pipeline hosted on my tenant using Azure PrivateLink?

@Sunil Menon

It sounds like you want to connect your Azure Data Factory (ADF) pipeline to an Oracle Database hosted on a different tenant using Azure Private Link. Let's dig into that!

Firstly, Azure Private Link enables private connectivity to services offered on Azure via a private endpoint in your virtual network. It can indeed be used to connect ADF to your desired Oracle Database, but there are a few things to keep in mind regarding cross-tenant communication.

Cross-Tenant Connectivity: Azure Private Link does support connectivity between different tenants, but both tenants need to properly configure their private endpoints and share the necessary permissions. The database in the other tenant needs to accept the private link connection.

Self-Hosted Integration Runtime: Currently, to connect with data sources in another tenant using Private Link, you would typically require a Self-Hosted Integration Runtime (IR). Since you mentioned you prefer not to use this, it's essential to note that the other tenant will need to have the appropriate configurations for the connection to work seamlessly.

Azure Documentation: The documentation you referenced provides helpful insights into using Azure Private Link with on-premises SQL Server and similar services. While it's specifically about SQL Server, the broader principles apply: You'll need to ensure that the database setup and the networking considerations are correctly handled across tenant boundaries.

Summary Points:

• You can connect your ADF pipeline to the Oracle Database using Azure Private Link; however, this requires configurations on both sides—yours and the other tenant’s.
• A Self-Hosted Integration Runtime will likely be needed for this setup.
• Ensure that the required permissions and networking setups (like the private endpoint) are configured correctly.

Follow-Up Questions:

1. Are both tenants configured to allow Azure Private Link connections?
2. What specific configurations do you already have in place for the private endpoints in both tenants?
3. Are you open to utilizing a Self-Hosted Integration Runtime despite your preference?
4. Do you have any specific security or compliance requirements we should consider?

Hope this helps. Do let us know if you any further queries.

Thanks for your response, just to iterate I would like to avoid self-hosted integration runtime as this a setup we have not done before, while integration using Azure PrivateLink is a standard & approved way of network integration

Follow-Up Questions:

1. Are both tenants configured to allow Azure Private Link connections? Yes
2. What specific configurations do you already have in place for the private endpoints in both tenants? We can setup both privatelink service and private endpoint service in respective tenants / susbcription
3. Are you open to utilizing a Self-Hosted Integration Runtime despite your preference? I would like to avoid this setup. Direct integration via Azure PrivateLink is preferred.
4. Do you have any specific security or compliance requirements we should consider? Nothing specific, would leverage Azure services so that traffic remains within Azure backbone network

Assuming the PrivateLink is setup properly on both the tenants, can we avoid self-hosted integration runtime?

Given your preference to avoid using a Self-Hosted Integration Runtime (IR) and your setup for Azure Private Link, you can indeed achieve the desired connectivity. Here are the key points to consider:

Azure Private Link Configuration: Since both tenants are configured to allow Azure Private Link connections, and you can set up both the Private Link service and private endpoint service in the respective tenants/subscriptions, you are on the right track.

Managed Virtual Network: You can leverage Azure Data Factory's managed virtual network (vNet) feature. By creating your Azure Data Factory with a managed vNet and using an Azure-managed integration runtime within that vNet, you can facilitate secure cross-tenant data ingestion without needing a Self-Hosted IR

Security and Compliance: Since you are leveraging Azure services and keeping the traffic within the Azure backbone network, your security and compliance requirements should be met.

Summary Points:

• Managed vNet: Use Azure Data Factory's managed virtual network to avoid the need for a Self-Hosted IR.
• Private Link Setup: Ensure that the Private Link service and private endpoint service are correctly configured in both tenants.
• Secure Connectivity: This setup will keep your data traffic within the Azure backbone network, maintaining security and compliance