Include image and publisher-tenant identifiers in an RBAC gallery handoff

Source facts

Azure Compute Gallery RBAC recipients need the supplied imageID to deploy a VM or scale set; Microsoft says they cannot list images shared through that method. A recipient outside the publisher’s tenant also needs its tenantID for access verification and cannot independently query that value. Gallery-level sharing includes definitions and versions, whereas definition-level sharing does not expose the gallery itself. Microsoft Learn.

Applicability

Apply this handoff to named users, groups, or service principals receiving RBAC access. Identify both the publishing tenant and the tenant where deployment is intended. Do not mistake a missing discovery experience for proof that the role assignment failed or that a wider sharing mode is required.

DSE recommendation

Deliver the intended image resource ID and publisher tenant ID alongside the approved access scope. Have the publisher and recipient confirm the target image version and account context together. Record who owns updating that handoff when the image changes. Review the granted scope deliberately rather than broadening access merely to make a catalog appear.

Verification

Using an authorized recipient account, follow the cross-tenant sign-in and image-consumption procedure with the supplied identifiers. Compare a failed attempt’s tenant and resource IDs with the approved record before changing permissions. Demonstrate deployment from the intended version in a bounded test and retain the resulting provenance. Keep publisher access, recipient identity, and destination deployment rights distinguishable when documenting the outcome.

Official references

Microsoft Learn: Share gallery resources using RBAC. Source reviewed September 9, 2026.