Communicating between two Resource Groups

 Hi,

I have a resource group which has a VM which runs a web app. In this resource groups we do have VNETs, public Ips and other resources. Recently we've purchased a palo alto network appliance on Azure and it provisioned in a different resource group. My requirement is Branch office users (5 Branches) can connect to Palo Alto firewall and from that firewall they should be able to access the WebApp in the VM.

How can achieve this? Can we create same subnet in other resource  groups? Please advise.,

Thanks

Kavindu