Transfer an Azure subscription to a different Azure AD directory

Organizations might have several Azure subscriptions. Each subscription is associated with a particular Azure Active Directory (Azure AD) directory. To make management easier, you might want to transfer a subscription to a different Azure AD directory. When you transfer a subscription to a different Azure AD directory, some resources are not transferred to the target directory. For example, all role assignments and custom roles in Azure role-based access control (Azure RBAC) are permanently deleted from the source directory and are not be transferred to the target directory.

This article describes the basic steps you can follow to transfer a subscription to a different Azure AD directory and re-create some of the resources after the transfer.

If you want to instead block the transfer of subscriptions to different directories in your organization, you can configure a subscription policy. For more information, see Manage Azure subscription policies.

Note

For Azure Cloud Solution Providers (CSP) subscriptions, changing the Azure AD directory for the subscription isn't supported.

Overview

Transferring an Azure subscription to a different Azure AD directory is a complex process that must be carefully planned and executed. Many Azure services require security principals (identities) to operate normally or even manage other Azure resources. This article tries to cover most of the Azure services that depend heavily on security principals, but is not comprehensive.

Important

In some scenarios, transferring a subscription might require downtime to complete the process. Careful planning is required to assess whether downtime will be required for your transfer.

The following diagram shows the basic steps you must follow when you transfer a subscription to a different directory.

  1. Prepare for the transfer

  2. Transfer the Azure subscription to a different directory

  3. Re-create resources in the target directory such as role assignments, custom roles, and managed identities

    Transfer subscription diagram

Deciding whether to transfer a subscription to a different directory

The following are some reasons why you might want to transfer a subscription:

  • Because of a company merger or acquisition, you want to manage an acquired subscription in your primary Azure AD directory.
  • Someone in your organization created a subscription and you want to consolidate management to a particular Azure AD directory.
  • You have applications that depend on a particular subscription ID or URL and it isn't easy to modify the application configuration or code.
  • A portion of your business has been split into a separate company and you need to move some of your resources into a different Azure AD directory.
  • You want to manage some of your resources in a different Azure AD directory for security isolation purposes.

Alternate approaches

Transferring a subscription requires downtime to complete the process. Depending on your scenario, you can consider the following alternate approaches:

  • Re-create the resources and copy data to the target directory and subscription.
  • Adopt a multi-directory architecture and leave the subscription in the source directory. Use Azure Lighthouse to delegate resources so that users in the target directory can access the subscription in the source directory. For more information, see Azure Lighthouse in enterprise scenarios.

Understand the impact of transferring a subscription

Several Azure resources have a dependency on a subscription or a directory. Depending on your situation, the following table lists the known impact of transferring a subscription. By performing the steps in this article, you can re-create some of the resources that existed prior to the subscription transfer.

Important

This section lists the known Azure services or resources that depend on your subscription. Because resource types in Azure are constantly evolving, there might be additional dependencies not listed here that can cause a breaking change to your environment.

Service or resource Impacted Recoverable Are you impacted? What you can do
Role assignments Yes Yes List role assignments All role assignments are permanently deleted. You must map users, groups, and service principals to corresponding objects in the target directory. You must re-create the role assignments.
Custom roles Yes Yes List custom roles All custom roles are permanently deleted. You must re-create the custom roles and any role assignments.
System-assigned managed identities Yes Yes List managed identities You must disable and re-enable the managed identities. You must re-create the role assignments.
User-assigned managed identities Yes Yes List managed identities You must delete, re-create, and attach the managed identities to the appropriate resource. You must re-create the role assignments.
Azure Key Vault Yes Yes List Key Vault access policies You must update the tenant ID associated with the key vaults. You must remove and add new access policies.
Azure SQL databases with Azure AD authentication integration enabled Yes No Check Azure SQL databases with Azure AD authentication You cannot transfer an Azure SQL database with Azure AD authentication enabled to a different directory. For more information, see Use Azure Active Directory authentication.
Azure Storage and Azure Data Lake Storage Gen2 Yes Yes You must re-create any ACLs.
Azure Data Lake Storage Gen1 Yes Yes You must re-create any ACLs.
Azure Files Yes Yes You must re-create any ACLs.
Azure File Sync Yes Yes The storage sync service and/or storage account can be moved to a different directory. For more information, see Frequently asked questions (FAQ) about Azure Files
Azure Managed Disks Yes Yes If you are using Disk Encryption Sets to encrypt Managed Disks with customer-managed keys, you must disable and re-enable the system-assigned identities associated with Disk Encryption Sets. And you must re-create the role assignments i.e. again grant required permissions to Disk Encryption Sets in the Key Vaults.
Azure Kubernetes Service Yes No You cannot transfer your AKS cluster and its associated resources to a different directory. For more information, see Frequently asked questions about Azure Kubernetes Service (AKS)
Azure Policy Yes No All Azure Policy objects, including custom definitions, assignments, exemptions, and compliance data. You must export, import, and re-assign definitions. Then, create new policy assignments and any needed policy exemptions.
Azure Active Directory Domain Services Yes No You cannot transfer an Azure AD Domain Services managed domain to a different directory. For more information, see Frequently asked questions (FAQs) about Azure Active Directory (AD) Domain Services
App registrations Yes Yes

Warning

If you are using encryption at rest for a resource, such as a storage account or SQL database, that has a dependency on a key vault that is not in the same subscription that is being transferred, it can lead to an unrecoverable scenario. If you have this situation, you should take steps to use a different key vault or temporarily disable customer-managed keys to avoid this unrecoverable scenario.

To get a list of some of the Azure resources that are impacted when you transfer a subscription, you can also run a query in Azure Resource Graph. For a sample query, see List impacted resources when transferring an Azure subscription.

Prerequisites

To complete these steps, you will need:

  • Bash in Azure Cloud Shell or Azure CLI
  • Account Administrator of the subscription you want to transfer in the source directory
  • A user account in both the source and target directory for the user making the directory change

Step 1: Prepare for the transfer

Sign in to source directory

  1. Sign in to Azure as an administrator.

  2. Get a list of your subscriptions with the az account list command.

    az account list --output table
    
  3. Use az account set to set the active subscription you want to transfer.

    az account set --subscription "Marketing"
    

Install the Azure Resource Graph extension

The Azure CLI extension for Azure Resource Graph, resource-graph, enables you to use the az graph command to query resources managed by Azure Resource Manager. You'll use this command in later steps.

  1. Use az extension list to see if you have the resource-graph extension installed.

    az extension list
    
  2. If not, install the resource-graph extension.

    az extension add --name resource-graph
    

Save all role assignments

  1. Use az role assignment list to list all the role assignments (including inherited role assignments).

    To make it easier to review the list, you can export the output as JSON, TSV, or a table. For more information, see List role assignments using Azure RBAC and Azure CLI.

    az role assignment list --all --include-inherited --output json > roleassignments.json
    az role assignment list --all --include-inherited --output tsv > roleassignments.tsv
    az role assignment list --all --include-inherited --output table > roleassignments.txt
    
  2. Save the list of role assignments.

    When you transfer a subscription, all of the role assignments are permanently deleted so it is important to save a copy.

  3. Review the list of role assignments. There might be role assignments you won't need in the target directory.

Save custom roles

  1. Use the az role definition list to list your custom roles. For more information, see Create or update Azure custom roles using Azure CLI.

    az role definition list --custom-role-only true --output json --query '[].{roleName:roleName, roleType:roleType}'
    
  2. Save each custom role that you will need in the target directory as a separate JSON file.

    az role definition list --name <custom_role_name> > customrolename.json
    
  3. Make copies of the custom role files.

  4. Modify each copy to use the following format.

    You'll use these files later to re-create the custom roles in the target directory.

    {
      "Name": "",
      "Description": "",
      "Actions": [],
      "NotActions": [],
      "DataActions": [],
      "NotDataActions": [],
      "AssignableScopes": []
    }
    

Determine user, group, and service principal mappings

  1. Based on your list of role assignments, determine the users, groups, and service principals you will map to in the target directory.

    You can identify the type of principal by looking at the principalType property in each role assignment.

  2. If necessary, in the target directory, create any users, groups, or service principals you will need.

List role assignments for managed identities

Managed identities do not get updated when a subscription is transferred to another directory. As a result, any existing system-assigned or user-assigned managed identities will be broken. After the transfer, you can re-enable any system-assigned managed identities. For user-assigned managed identities, you will have to re-create and attach them in the target directory.

  1. Review the list of Azure services that support managed identities to note where you might be using managed identities.

  2. Use az ad sp list to list your system-assigned and user-assigned managed identities.

    az ad sp list --all --filter "servicePrincipalType eq 'ManagedIdentity'"
    
  3. In the list of managed identities, determine which are system-assigned and which are user-assigned. You can use the following criteria to determine the type.

    Criteria Managed identity type
    alternativeNames property includes isExplicit=False System-assigned
    alternativeNames property does not include isExplicit System-assigned
    alternativeNames property includes isExplicit=True User-assigned

    You can also use az identity list to just list user-assigned managed identities. For more information, see Create, list, or delete a user-assigned managed identity using the Azure CLI.

    az identity list
    
  4. Get a list of the objectId values for your managed identities.

  5. Search your list of role assignments to see if there are any role assignments for your managed identities.

List key vaults

When you create a key vault, it is automatically tied to the default Azure Active Directory tenant ID for the subscription in which it is created. All access policy entries are also tied to this tenant ID. For more information, see Moving an Azure Key Vault to another subscription.

Warning

If you are using encryption at rest for a resource, such as a storage account or SQL database, that has a dependency on a key vault that is not in the same subscription that is being transferred, it can lead to an unrecoverable scenario. If you have this situation, you should take steps to use a different key vault or temporarily disable customer-managed keys to avoid this unrecoverable scenario.

List Azure SQL databases with Azure AD authentication

List ACLs

  1. If you are using Azure Data Lake Storage Gen1, list the ACLs that are applied to any file by using the Azure portal or PowerShell.

  2. If you are using Azure Data Lake Storage Gen2, list the ACLs that are applied to any file by using the Azure portal or PowerShell.

  3. If you are using Azure Files, list the ACLs that are applied to any file.

List other known resources

  1. Use az account show to get your subscription ID (in bash).

    subscriptionId=$(az account show --query id | sed -e 's/^"//' -e 's/"//' -e 's/\r$//')
    
  2. Use the az graph extension to list other Azure resources with known Azure AD directory dependencies (in bash).

    az graph query -q 'resources 
        | where type != "microsoft.azureactivedirectory/b2cdirectories" 
        | where  identity <> "" or properties.tenantId <> "" or properties.encryptionSettingsCollection.enabled == true 
        | project name, type, kind, identity, tenantId, properties.tenantId' --subscriptions $subscriptionId --output yaml
    

Step 2: Transfer the subscription

In this step, you transfer the subscription from the source directory to the target directory. The steps will be different depending on whether you want to also transfer the billing ownership.

Warning

When you transfer the subscription, all role assignments in the source directory are permanently deleted and cannot be restored. You cannot go back once you transfer the subscription. Be sure you complete the previous steps before performing this step.

  1. Determine whether you want to also transfer the billing ownership to another account.

  2. Transfer the subscription to a different directory.

  3. Once you finish transferring the subscription, return back to this article to re-create the resources in the target directory.

Step 3: Re-create resources

Sign in to target directory

  1. In the target directory, sign in as the user that accepted the transfer request.

    Only the user in the new account who accepted the transfer request will have access to manage the resources.

  2. Get a list of your subscriptions with the az account list command.

    az account list --output table
    
  3. Use az account set to set the active subscription you want to use.

    az account set --subscription "Contoso"
    

Create custom roles

Assign roles

Update system-assigned managed identities

  1. Disable and re-enable system-assigned managed identities.

    Azure service More information
    Virtual machines Configure managed identities for Azure resources on an Azure VM using Azure CLI
    Virtual machine scale sets Configure managed identities for Azure resources on a virtual machine scale set using Azure CLI
    Other services Services that support managed identities for Azure resources
  2. Use az role assignment create to assign roles to system-assigned managed identities. For more information, see Assign a managed identity access to a resource using Azure CLI.

    az role assignment create --assignee <objectid> --role '<role_name_or_id>' --scope <scope>
    

Update user-assigned managed identities

  1. Delete, re-create, and attach user-assigned managed identities.

    Azure service More information
    Virtual machines Configure managed identities for Azure resources on an Azure VM using Azure CLI
    Virtual machine scale sets Configure managed identities for Azure resources on a virtual machine scale set using Azure CLI
    Other services Services that support managed identities for Azure resources
    Create, list, or delete a user-assigned managed identity using the Azure CLI
  2. Use az role assignment create to assign roles to user-assigned managed identities. For more information, see Assign a managed identity access to a resource using Azure CLI.

    az role assignment create --assignee <objectid> --role '<role_name_or_id>' --scope <scope>
    

Update key vaults

This section describes the basic steps to update your key vaults. For more information, see Moving an Azure Key Vault to another subscription.

  1. Update the tenant ID associated with all existing key vaults in the subscription to the target directory.

  2. Remove all existing access policy entries.

  3. Add new access policy entries associated with the target directory.

Update ACLs

  1. If you are using Azure Data Lake Storage Gen1, assign the appropriate ACLs. For more information, see Securing data stored in Azure Data Lake Storage Gen1.

  2. If you are using Azure Data Lake Storage Gen2, assign the appropriate ACLs. For more information, see Access control in Azure Data Lake Storage Gen2.

  3. If you are using Azure Files, assign the appropriate ACLs.

Review other security methods

Even though role assignments are removed during the transfer, users in the original owner account might continue to have access to the subscription through other security methods, including:

  • Access keys for services like Storage.
  • Management certificates that grant the user administrator access to subscription resources.
  • Remote Access credentials for services like Azure Virtual Machines.

If your intent is to remove access from users in the source directory so that they don't have access in the target directory, you should consider rotating any credentials. Until the credentials are updated, users will continue to have access after the transfer.

  1. Rotate storage account access keys. For more information, see Manage storage account access keys.

  2. If you are using access keys for other services such as Azure SQL Database or Azure Service Bus Messaging, rotate access keys.

  3. For resources that use secrets, open the settings for the resource and update the secret.

  4. For resources that use certificates, update the certificate.

Next steps