https://learn.microsoft.com/en-us/azure/cognitive-services/cognitive-services-virtual- networks?tabs=portal#grant-access-from-a-virtual-network You can configure Cognitive Services resources to allow access only from specific subnets. The allowed subnets may belong to a VNet in the same subscription, or in a different subscription, including subscriptions belonging to a different Azure Active Directory tenant.