Move resources to new resource group or subscription

This article shows you how to move resources to either a new subscription or a new resource group in the same subscription. You can use the portal, PowerShell, Azure CLI, or the REST API to move resource. The move operations in this article are available to you without any assistance from Azure support.

When moving resources, both the source group and the target group are locked during the operation. Write and delete operations are blocked on the resource groups until the move completes. This lock means you cannot add, update, or delete resources in the resource groups, but it does not mean the resources are frozen. For example, if you move a SQL Server and its database to a new resource group, an application that uses the database experiences no downtime. It can still read and write to the database.

You cannot change the location of the resource. Moving a resource only moves it to a new resource group. The new resource group may have a different location, but that does not change the location of the resource.


This article describes how to move resources within an existing Azure account offering. If you actually want to change your Azure account offering (such as upgrading from pay-as-you-go to pre-pay) while continuing to work with your existing resources, see Switch your Azure subscription to another offer.

Checklist before moving resources

There are some important steps to perform before moving a resource. By verifying these conditions, you can avoid errors.

  1. The source and destination subscriptions must exist within the same Azure Active Directory tenant. To check that both subscriptions have the same tenant ID, use Azure PowerShell or Azure CLI.

    For Azure PowerShell, use:

    (Get-AzureRmSubscription -SubscriptionName <your-source-subscription>).TenantId
    (Get-AzureRmSubscription -SubscriptionName <your-destination-subscription>).TenantId

    For Azure CLI, use:

    az account show --subscription <your-source-subscription> --query tenantId
    az account show --subscription <your-destination-subscription> --query tenantId

    If the tenant IDs for the source and destination subscriptions are not the same, use the following methods to reconcile the tenant IDs:

  2. The service must enable the ability to move resources. This article lists which services enable moving resources and which services do not enable moving resources.

  3. The destination subscription must be registered for the resource provider of the resource being moved. If not, you receive an error stating that the subscription is not registered for a resource type. You might encounter this problem when moving a resource to a new subscription, but that subscription has never been used with that resource type.

    For PowerShell, use the following commands to get the registration status:

    Set-AzureRmContext -Subscription <destination-subscription-name-or-id>
    Get-AzureRmResourceProvider -ListAvailable | Select-Object ProviderNamespace, RegistrationState

    To register a resource provider, use:

    Register-AzureRmResourceProvider -ProviderNamespace Microsoft.Batch

    For Azure CLI, use the following commands to get the registration status:

    az account set -s <destination-subscription-name-or-id>
    az provider list --query "[].{Provider:namespace, Status:registrationState}" --out table

    To register a resource provider, use:

    az provider register --namespace Microsoft.Batch

When to call support

You can move most resources through the self-service operations shown in this article. Use the self-service operations to:

Contact support when you need to:

  • Move your resources to a new Azure account (and Azure Active Directory tenant) and you need help with the instructions in the preceding section.
  • Move classic resources but are having trouble with the limitations.

Services that enable move

The services that enable moving to both a new resource group and subscription are:

  • API Management
  • App Service apps (web apps) - see App Service limitations
  • Application Insights
  • Automation
  • Azure Cosmos DB
  • Batch
  • Bing Maps
  • CDN
  • Cloud Services - see Classic deployment limitations
  • Cognitive Services
  • Content Moderator
  • Data Catalog
  • Data Factory
  • Data Lake Analytics
  • Data Lake Store
  • DNS
  • Event Hubs
  • HDInsight clusters - see HDInsight limitations
  • IoT Hubs
  • Key Vault
  • Load Balancers
  • Logic Apps
  • Machine Learning
  • Media Services
  • Mobile Engagement
  • Notification Hubs
  • Operational Insights
  • Operations Management
  • Power BI
  • Redis Cache
  • Scheduler
  • Search
  • Server Management
  • Service Bus
  • Service Fabric
  • Storage
  • Storage (classic) - see Classic deployment limitations
  • Stream Analytics - Stream Analytics jobs cannot be moved when in running state.
  • SQL Database server - database and server must reside in the same resource group. When you move a SQL server, all its databases are also moved.
  • Traffic Manager
  • Virtual Machines - VMs with managed disks cannot be moved. See Virtual Machines limitations
  • Virtual Machines (classic) - see Classic deployment limitations
  • Virtual Machine Scale Sets - see Virtual Machines limitations
  • Virtual Networks - see Virtual Networks limitations
  • VPN Gateway

Services that do not enable move

The services that currently do not enable moving a resource are:

  • AD Domain Services
  • AD Hybrid Health Service
  • Application Gateway
  • BizTalk Services
  • Container Service
  • Express Route
  • DevTest Labs - move to new resource group in same subscription is enabled, but cross subscription move is not enabled.
  • Dynamics LCS
  • Managed Applications
  • Managed Disks - see Virtual Machines limitations
  • Recovery Services vault - also do not move the Compute, Network, and Storage resources associated with the Recovery Services vault, see Recovery Services limitations.
  • Security
  • StorSimple Device Manager
  • Virtual Networks (classic) - see Classic deployment limitations

Virtual Machines limitations

Managed disks do not support move. This restriction means that several related resources cannot be moved too. You cannot move:

  • Managed disks
  • Virtual machines with the managed disks
  • Images created from managed disks
  • Snapshots created from managed disks
  • Availability sets with virtual machines with managed disks

Virtual machines created from Marketplace resources cannot be moved across subscriptions. Deprovision the virtual machine in the current subscription, and deploy again in the new subscription.

Virtual Machines with certificate stored in Key Vault can be moved to a new resource group in the same subscription, but not across subscriptions.

Virtual Networks limitations

To move a peered virtual network, you must first disable the virtual network peering. Once disabled, you can move the virtual network. After the move, reenable the virtual network peering.

You cannot move a virtual network to a different subscription if the virtual network contains a subnet with resource navigation links. For example, if a Redis Cache resource is deployed into a subnet, that subnet has a resource navigation link.

App Service limitations

The limitations for moving App Service resources differ based on whether you are moving the resources within a subscription or to a new subscription.

Moving within the same subscription

When moving a Web App within the same subscription, you cannot move the uploaded SSL certificates. However, you can move a Web App to the new resource group without moving its uploaded SSL certificate, and your app's SSL functionality still works.

If you want to move the SSL certificate with the Web App, follow these steps:

  1. Delete the uploaded certificate from the Web App.
  2. Move the Web App.
  3. Upload the certificate to the moved Web App.

Moving across subscriptions

When moving a Web App across subscriptions, the following limitations apply:

  • The destination resource group must not have any existing App Service resources. App Service resources include:
    • Web Apps
    • App Service plans
    • Uploaded or imported SSL certificates
    • App Service Environments
  • All App Service resources in the resource group must be moved together.
  • App Service resources can only be moved from the resource group in which they were originally created. If an App Service resource is no longer in its original resource group, it must be moved back to that original resource group first, and then it can be moved across subscriptions.

Classic deployment limitations

The options for moving resources deployed through the classic model differ based on whether you are moving the resources within a subscription or to a new subscription.

Same subscription

When moving resources from one resource group to another resource group within the same subscription, the following restrictions apply:

  • Virtual networks (classic) cannot be moved.
  • Virtual machines (classic) must be moved with the cloud service.
  • Cloud service can only be moved when the move includes all its virtual machines.
  • Only one cloud service can be moved at a time.
  • Only one storage account (classic) can be moved at a time.
  • Storage account (classic) cannot be moved in the same operation with a virtual machine or a cloud service.

To move classic resources to a new resource group within the same subscription, use the standard move operations through the portal, Azure PowerShell, Azure CLI, or REST API. You use the same operations as you use for moving Resource Manager resources.

New subscription

When moving resources to a new subscription, the following restrictions apply:

  • All classic resources in the subscription must be moved in the same operation.
  • The target subscription must not contain any other classic resources.
  • The move can only be requested through a separate REST API for classic moves. The standard Resource Manager move commands do not work when moving classic resources to a new subscription.

To move classic resources to a new subscription, use the REST operations that are specific to classic resources. To use REST, perform the following steps:

  1. Check if the source subscription can participate in a cross-subscription move. Use the following operation:


    In the request body, include:

     "role": "source"

    The response for the validation operation is in the following format:

     "status": "{status}",
     "reasons": [
  2. Check if the destination subscription can participate in a cross-subscription move. Use the following operation:


    In the request body, include:

     "role": "target"

    The response is in the same format as the source subscription validation.

  3. If both subscriptions pass validation, move all classic resources from one subscription to another subscription with the following operation:


    In the request body, include:

     "target": "/subscriptions/{target-subscription-id}"

The operation may run for several minutes.

Recovery Services limitations

Move is not enabled for Storage, Network, or Compute resources used to set up disaster recovery with Azure Site Recovery.

For example, suppose you have set up replication of your on-premises machines to a storage account (Storage1) and want the protected machine to come up after failover to Azure as a virtual machine (VM1) attached to a virtual network (Network1). You cannot move any of these Azure resources - Storage1, VM1, and Network1 - across resource groups within the same subscription or across subscriptions.

To move a VM enrolled in Azure backup between resource groups:

  1. Temporarily stop backup and retain backup data
  2. Move the VM to the target resource group
  3. Re-protect it under the same/new vault Users can restore from the available restore points created before the move operation. If the user moves the backed-up VM across subscriptions, step 1 and step 2 remain the same. In step 3, user needs to protect the VM under a new vault present/ created in the target subscription. Recovery Services vault does not support cross subscription backups.

HDInsight limitations

You can move HDInsight clusters to a new subscription or resource group. However, you cannot move across subscriptions the networking resources linked to the HDInsight cluster (such as the virtual network, NIC, or load balancer). In addition, you cannot move to a new resource group a NIC that is attached to a virtual machine for the cluster.

When moving an HDInsight cluster to a new subscription, first move other resources (like the storage account). Then, move the HDInsight cluster by itself.

Search limitations

You cannot move multiple Search resources placed in different regions all at once. In such a case, you need to move them separately.

Use portal

To move resources, select the resource group containing those resources, and then select the Move button.

move resources

Select whether you are moving the resources to a new resource group or a new subscription.

Select the resources to move and the destination resource group. Acknowledge that you need to update scripts for these resources and select OK. If you selected the edit subscription icon in the previous step, you must also select the destination subscription.

select destination

In Notifications, you see that the move operation is running.

show move status

When it has completed, you are notified of the result.

show move result

Use PowerShell

To move existing resources to another resource group or subscription, use the Move-AzureRmResource command. The following example shows how to move multiple resources to a new resource group.

$webapp = Get-AzureRmResource -ResourceGroupName OldRG -ResourceName ExampleSite
$plan = Get-AzureRmResource -ResourceGroupName OldRG -ResourceName ExamplePlan
Move-AzureRmResource -DestinationResourceGroupName NewRG -ResourceId $webapp.ResourceId, $plan.ResourceId

To move to a new subscription, include a value for the DestinationSubscriptionId parameter.

Use Azure CLI

To move existing resources to another resource group or subscription, use the az resource move command. Provide the resource IDs of the resources to move. The following example shows how to move multiple resources to a new resource group. In the --ids parameter, provide a space-separated list of the resource IDs to move.

webapp=$(az resource show -g OldRG -n ExampleSite --resource-type "Microsoft.Web/sites" --query id --output tsv)
plan=$(az resource show -g OldRG -n ExamplePlan --resource-type "Microsoft.Web/serverfarms" --query id --output tsv)
az resource move --destination-group newgroup --ids $webapp $plan

To move to a new subscription, provide the --destination-subscription-id parameter.


To move existing resources to another resource group or subscription, run:


In the request body, you specify the target resource group and the resources to move. For more information about the move REST operation, see Move resources.

Next steps