diff --git a/internal/provider/provider.go b/internal/provider/provider.go
index 50fd34f0f4b5..e669474b9ed2 100644
--- a/internal/provider/provider.go
+++ b/internal/provider/provider.go
@@ -373,7 +373,7 @@ func providerConfigure(p *schema.Provider) schema.ConfigureContextFunc {
 		}
 
 		if len(auxTenants) > 3 {
-			return nil, diag.Errorf("the provider only supports 3 auxiliary tenant IDs")
+			return nil, diag.Errorf("the provider only supports up to 3 auxiliary tenant IDs")
 		}
 
 		var clientCertificateData []byte
diff --git a/internal/services/privatedns/private_dns_zone_virtual_network_link_resource_test.go b/internal/services/privatedns/private_dns_zone_virtual_network_link_resource_test.go
index d5cf5ee1bdc9..2ea21655403c 100644
--- a/internal/services/privatedns/private_dns_zone_virtual_network_link_resource_test.go
+++ b/internal/services/privatedns/private_dns_zone_virtual_network_link_resource_test.go
@@ -6,6 +6,7 @@ package privatedns_test
 import (
 	"context"
 	"fmt"
+	"os"
 	"testing"
 
 	"github.com/hashicorp/go-azure-sdk/resource-manager/privatedns/2020-06-01/virtualnetworklinks"
@@ -46,6 +47,28 @@ func TestAccPrivateDnsZoneVirtualNetworkLink_complete(t *testing.T) {
 	})
 }
 
+func TestAccPrivateDnsZoneVirtualNetworkLink_crossTenant(t *testing.T) {
+	// Multiple tenants are needed for this test
+	altTenantId := os.Getenv("ARM_TENANT_ID_ALT")
+	subscriptionIdAltTenant := os.Getenv("ARM_SUBSCRIPTION_ID_ALT_TENANT")
+
+	if altTenantId == "" || subscriptionIdAltTenant == "" {
+		t.Skip("One of ARM_TENANT_ID_ALT, ARM_SUBSCRIPTION_ID_ALT_TENANT are not specified")
+	}
+
+	data := acceptance.BuildTestData(t, "azurerm_private_dns_zone_virtual_network_link", "test")
+	r := PrivateDnsZoneVirtualNetworkLinkResource{}
+	data.ResourceTest(t, r, []acceptance.TestStep{
+		{
+			Config: r.crossTenant(data, altTenantId, subscriptionIdAltTenant),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+			),
+		},
+		data.ImportStep(),
+	})
+}
+
 func TestAccPrivateDnsZoneVirtualNetworkLink_requiresImport(t *testing.T) {
 	data := acceptance.BuildTestData(t, "azurerm_private_dns_zone_virtual_network_link", "test")
 	r := PrivateDnsZoneVirtualNetworkLinkResource{}
@@ -171,6 +194,61 @@ resource "azurerm_private_dns_zone_virtual_network_link" "test" {
 `, data.RandomInteger, data.Locations.Primary, data.RandomInteger, data.RandomInteger, data.RandomInteger)
 }
 
+func (PrivateDnsZoneVirtualNetworkLinkResource) crossTenant(data acceptance.TestData, altTenantId, subscriptionIdAltTenant string) string {
+	return fmt.Sprintf(`
+provider "azurerm" {
+  auxiliary_tenant_ids = ["%[1]s"]
+
+  features {}
+}
+
+provider "azurerm-alt" {
+  tenant_id       = "%[1]s"
+  subscription_id = "%[2]s"
+
+  features {}
+}
+
+resource "azurerm_resource_group" "test_alt" {
+  provider = azurerm-alt
+
+  name     = "acctestRG-%[3]d"
+  location = "%[4]s"
+}
+
+resource "azurerm_virtual_network" "test_alt" {
+  provider = azurerm-alt
+
+  name                = "vnet%[3]d"
+  location            = azurerm_resource_group.test_alt.location
+  resource_group_name = azurerm_resource_group.test_alt.name
+  address_space       = ["10.0.0.0/16"]
+
+  subnet {
+    name           = "subnet1"
+    address_prefix = "10.0.1.0/24"
+  }
+}
+
+resource "azurerm_resource_group" "test" {
+  name     = "acctestRG-%[3]d"
+  location = "%[4]s"
+}
+
+resource "azurerm_private_dns_zone" "test" {
+  name                = "acctestzone%[3]d.com"
+  resource_group_name = azurerm_resource_group.test.name
+}
+
+resource "azurerm_private_dns_zone_virtual_network_link" "test" {
+  name                  = "acctestVnetZone%[3]d.com"
+  resource_group_name   = azurerm_resource_group.test.name
+  private_dns_zone_name = azurerm_private_dns_zone.test.name
+  virtual_network_id    = azurerm_virtual_network.test_alt.id
+}
+`, altTenantId, subscriptionIdAltTenant, data.RandomInteger, data.Locations.Primary)
+}
+
 func (r PrivateDnsZoneVirtualNetworkLinkResource) requiresImport(data acceptance.TestData) string {
 	return fmt.Sprintf(`
 %s