I have an Azure subscription with 2 different resource groups, `Test` and `Prod`. Each resource group has a VNET with a bunch of VMs in it.

There is a VM in `Prod` that acts as a license server, and services in both `Test` *and* `Prod` need to be able to access it. Let's call it `LICENSE-VM`.

```
+------------------------------+            +-------------------------------------+
|     Test Resource Group      |            |          Prod Resource Group        |
|                              |            |                                     |
|   +----------------------+   |            |   +-----------------------------+   |
|   |       Test VNET      |   |            |   |          Prod VNET          |   |
|   |                      |   |            |   |                             |   |
|   |   +----+    +----+   |   |            |   |   +----------+    +----+    |   |
|   |   |VM-1|    |VM-2|   +----------------------> |LICENSE-VM| <--+VM-3|    |   |
|   |   +----+    +----+   |   |            |   |   +----------+    +----+    |   |
|   |                      |   |            |   |                             |   |
|   +----------------------+   |            |   +-----------------------------+   |
|                              |            |                                     |
+------------------------------+            +-------------------------------------+

```

Of course, this isn't an issue within the `Prod` VNET, but I'm struggling to find a secure way of allowing communication with `LICENSE-VM` from `Test`.

1. I thought of adding a public IP to `LICENSE-VM`, and using an NSG (Network Security Group) attached to the NIC to lock it down - but if I use a source IP rule that specifies the CIDR range of the `TEST` VNET, it doesn't work (can't connect)
2. I then thought of adding a public load balancer, but this seems to have the same problem as (1), in that I can't lock it down to a VNET in a diferent resource group
3. We could setup VNET peering, but it seems overkill when we only want access to a single port on a single VM. I'm also unsure if we could lock that down using Network Security Groups?

Any idea how I can lock down a public IP such that a VNET in a different resource group can access it? Alternatively, is there some other way I can approach this?

I feel like this must be a relatively common scenario, and I'm missing something obvious!