Transfer an Azure subscription to a different Microsoft Entra directory

Organizations might have several Azure subscriptions. Each subscription is associated with a particular Microsoft Entra directory. To make management easier, you might want to transfer a subscription to a different Microsoft Entra directory. When you transfer a subscription to a different Microsoft Entra directory, some resources are not transferred to the target directory. For example, all role assignments and custom roles in Azure role-based access control (Azure RBAC) are permanently deleted from the source directory and are not transferred to the target directory.

This article describes the basic steps you can follow to transfer a subscription to a different Microsoft Entra directory and re-create some of the resources after the transfer.

If you want to instead block the transfer of subscriptions to different directories in your organization, you can configure a subscription policy. For more information, see Manage Azure subscription policies.

Overview

Transferring an Azure subscription to a different Microsoft Entra directory is a complex process that must be carefully planned and executed. Many Azure services require security principals (identities) to operate normally or even manage other Azure resources. This article tries to cover most of the Azure services that depend heavily on security principals, but is not comprehensive.

The following diagram shows the basic steps you must follow when you transfer a subscription to a different directory.

1. Prepare for the transfer

2. Transfer the Azure subscription to a different directory

3. Re-create resources in the target directory such as role assignments, custom roles, and managed identities

   

Deciding whether to transfer a subscription to a different directory

The following are some reasons why you might want to transfer a subscription:

• Because of a company merger or acquisition, you want to manage an acquired subscription in your primary Microsoft Entra directory.
• Someone in your organization created a subscription and you want to consolidate management to a particular Microsoft Entra directory.
• You have applications that depend on a particular subscription ID or URL and it isn't easy to modify the application configuration or code.
• A portion of your business has been split into a separate company and you need to move some of your resources into a different Microsoft Entra directory.
• You want to manage some of your resources in a different Microsoft Entra directory for security isolation purposes.

Alternate approaches

Transferring a subscription requires downtime to complete the process. Depending on your scenario, you can consider the following alternate approaches:

• Re-create the resources and copy data to the target directory and subscription.
• Adopt a multi-directory architecture and leave the subscription in the source directory. Use Azure Lighthouse to delegate resources so that users in the target directory can access the subscription in the source directory. For more information, see Azure Lighthouse in enterprise scenarios.

Understand the impact of transferring a subscription

Several Azure resources have a dependency on a subscription or a directory. Depending on your situation, the following table lists the known impact of transferring a subscription. By performing the steps in this article, you can re-create some of the resources that existed prior to the subscription transfer.

To get a list of some of the Azure resources that are impacted when you transfer a subscription, you can also run a query in Azure Resource Graph. For a sample query, see List impacted resources when transferring an Azure subscription.

Prerequisites

To complete these steps, you will need:

• Bash in Azure Cloud Shell or Azure CLI
• Billing account owner of the subscription you want to transfer in the source directory
• A user account in both the source and target directory for the user making the directory change

Step 1: Prepare for the transfer

Sign in to source directory

1. Sign in to Azure as an administrator.

2. Get a list of your subscriptions with the az account list command.

   az account list --output table
   

3. Use az account set to set the active subscription you want to transfer.

   az account set --subscription "Marketing"
   

Install the Azure Resource Graph extension

The Azure CLI extension for Azure Resource Graph, resource-graph, enables you to use the az graph command to query resources managed by Azure Resource Manager. You'll use this command in later steps.

1. Use az extension list to see if you have the resource-graph extension installed.

   az extension list
   

2. If you are using a preview version or an older version of the resource-graph extension, use az extension update to update the extension.

   az extension update --name resource-graph
   

3. If the resource-graph extension is not installed, use az extension add to install the extension.

   az extension add --name resource-graph
   

Save all role assignments

1. Use az role assignment list to list all the role assignments (including inherited role assignments).

   To make it easier to review the list, you can export the output as JSON, TSV, or a table. For more information, see List role assignments using Azure RBAC and Azure CLI.

   az role assignment list --all --include-inherited --output json > roleassignments.json
   az role assignment list --all --include-inherited --output tsv > roleassignments.tsv
   az role assignment list --all --include-inherited --output table > roleassignments.txt
   

2. Save the list of role assignments.

   When you transfer a subscription, all of the role assignments are permanently deleted so it is important to save a copy.

3. Review the list of role assignments. There might be role assignments you won't need in the target directory.

Save custom roles

1. Use the az role definition list to list your custom roles. For more information, see Create or update Azure custom roles using Azure CLI.

   az role definition list --custom-role-only true --output json --query '[].{roleName:roleName, roleType:roleType}'
   

2. Save each custom role that you will need in the target directory as a separate JSON file.

   az role definition list --name <custom_role_name> > customrolename.json
   

3. Make copies of the custom role files.

4. Modify each copy to use the following format.

   You'll use these files later to re-create the custom roles in the target directory.

   {
     "Name": "",
     "Description": "",
     "Actions": [],
     "NotActions": [],
     "DataActions": [],
     "NotDataActions": [],
     "AssignableScopes": []
   }
   

Determine user, group, and service principal mappings

1. Based on your list of role assignments, determine the users, groups, and service principals you will map to in the target directory.

   You can identify the type of principal by looking at the principalType property in each role assignment.

2. If necessary, in the target directory, create any users, groups, or service principals you will need.

List role assignments for managed identities

Managed identities do not get updated when a subscription is transferred to another directory. As a result, any existing system-assigned or user-assigned managed identities will be broken. After the transfer, you can re-enable any system-assigned managed identities. For user-assigned managed identities, you will have to re-create and attach them in the target directory.

1. Review the list of Azure services that support managed identities to note where you might be using managed identities.

2. Use az ad sp list to list your system-assigned and user-assigned managed identities.

   az ad sp list --all --filter "servicePrincipalType eq 'ManagedIdentity'"
   

3. In the list of managed identities, determine which are system-assigned and which are user-assigned. You can use the following criteria to determine the type.

   Criteria	Managed identity type
   alternativeNames property includes isExplicit=False	System-assigned
   alternativeNames property does not include isExplicit	System-assigned
   alternativeNames property includes isExplicit=True	User-assigned

   You can also use az identity list to just list user-assigned managed identities. For more information, see Create, list, or delete a user-assigned managed identity using the Azure CLI.

   az identity list
   

4. Get a list of the objectId values for your managed identities.

5. Search your list of role assignments to see if there are any role assignments for your managed identities.

List key vaults

When you create a key vault, it is automatically tied to the default Microsoft Entra tenant ID for the subscription in which it is created. All access policy entries are also tied to this tenant ID. For more information, see Moving an Azure Key Vault to another subscription.

• If you have a key vault, use az keyvault show to list the access policies. For more information, see Assign a Key Vault access policy.

  az keyvault show --name MyKeyVault
  

List Azure SQL databases with Microsoft Entra authentication

• Use az sql server ad-admin list and the az graph extension to see if you are using Azure SQL databases with Microsoft Entra authentication integration enabled. For more information, see Configure and manage Microsoft Entra authentication with SQL.

  az sql server ad-admin list --ids $(az graph query -q "resources | where type == 'microsoft.sql/servers' | project id" --query data[*].[id] -o tsv)
  

List ACLs

1. If you are using Azure Data Lake Storage Gen2, list the ACLs that are applied to any file by using the Azure portal or PowerShell.

2. If you are using Azure Files, list the ACLs that are applied to any file.

List other known resources

1. Use az account show to get your subscription ID (in bash).

   subscriptionId=$(az account show --output tsv --query id)
   

2. Use the az graph extension to list other Azure resources with known Microsoft Entra directory dependencies (in bash).

   az graph query -q 'resources 
       | where type != "microsoft.azureactivedirectory/b2cdirectories" 
       | where  identity <> "" or properties.tenantId <> "" or properties.encryptionSettingsCollection.enabled == true 
       | project name, type, kind, identity, tenantId, properties.tenantId' --subscriptions $subscriptionId --output yaml
   

Step 2: Transfer the subscription

In this step, you transfer the subscription from the source directory to the target directory. The steps will be different depending on whether you want to also transfer the billing ownership.

1. Determine whether you want to also transfer the billing ownership to another account.

2. Transfer the subscription to a different directory.

   • If you want to keep the current billing ownership, follow the steps in Associate or add an Azure subscription to your Microsoft Entra tenant.
   • If you want to also transfer the billing ownership, follow the steps in Transfer billing ownership of an Azure subscription to another account. To transfer the subscription to a different directory, you must check the Subscription Microsoft Entra tenant check box.

3. Once you finish transferring the subscription, return back to this article to re-create the resources in the target directory.

Step 3: Re-create resources

Sign in to target directory

1. In the target directory, sign in as the user that accepted the transfer request.

   Only the user in the new account who accepted the transfer request will have access to manage the resources.

2. Get a list of your subscriptions with the az account list command.

   az account list --output table
   

3. Use az account set to set the active subscription you want to use.

   az account set --subscription "Contoso"
   

Create custom roles

• Use az role definition create to create each custom role from the files you created earlier. For more information, see Create or update Azure custom roles using Azure CLI.

  az role definition create --role-definition <role_definition>
  

Assign roles

• Use az role assignment create to assign roles to users, groups, and service principals. For more information, see Assign Azure roles using Azure CLI.

  az role assignment create --role <role_name_or_id> --assignee <assignee> --scope "/subscriptions/<subscriptionId>/resourceGroups/<resource_group>"
  

Update system-assigned managed identities

1. Disable and re-enable system-assigned managed identities.

   Azure service	More information
   Virtual machines	Configure managed identities for Azure resources on an Azure VM using Azure CLI
   Virtual machine scale sets	Configure managed identities for Azure resources on a virtual machine scale set using Azure CLI
   Other services	Services that support managed identities for Azure resources

2. Use az role assignment create to assign roles to system-assigned managed identities. For more information, see Assign a managed identity access to a resource using Azure CLI.

   az role assignment create --assignee <objectid> --role '<role_name_or_id>' --scope "/subscriptions/<subscriptionId>/resourceGroups/<resource_group>"
   

Update user-assigned managed identities

1. Delete, re-create, and attach user-assigned managed identities.

   Azure service	More information
   Virtual machines	Configure managed identities for Azure resources on an Azure VM using Azure CLI
   Virtual machine scale sets	Configure managed identities for Azure resources on a virtual machine scale set using Azure CLI
   Other services	Services that support managed identities for Azure resources Create, list, or delete a user-assigned managed identity using the Azure CLI

2. Use az role assignment create to assign roles to user-assigned managed identities. For more information, see Assign a managed identity access to a resource using Azure CLI.

   az role assignment create --assignee <objectid> --role '<role_name_or_id>' --scope "/subscriptions/<subscriptionId>/resourceGroups/<resource_group>"
   

Update key vaults

This section describes the basic steps to update your key vaults. For more information, see Moving an Azure Key Vault to another subscription.

1. Update the tenant ID associated with all existing key vaults in the subscription to the target directory.

2. Remove all existing access policy entries.

3. Add new access policy entries associated with the target directory.

Update ACLs

1. If you are using Azure Data Lake Storage Gen2, assign the appropriate ACLs. For more information, see Access control in Azure Data Lake Storage Gen2.

2. If you are using Azure Files, assign the appropriate ACLs.

Review other security methods

Even though role assignments are removed during the transfer, users in the original owner account might continue to have access to the subscription through other security methods, including:

• Access keys for services like Storage.
• Management certificates that grant the user administrator access to subscription resources.
• Remote Access credentials for services like Azure Virtual Machines.

If your intent is to remove access from users in the source directory so that they don't have access in the target directory, you should consider rotating any credentials. Until the credentials are updated, users will continue to have access after the transfer.

1. Rotate storage account access keys. For more information, see Manage storage account access keys.

2. If you are using access keys for other services such as Azure SQL Database or Azure Service Bus Messaging, rotate access keys.

3. For resources that use secrets, open the settings for the resource and update the secret.

4. For resources that use certificates, update the certificate.

Next steps

• Transfer billing ownership of an Azure subscription to another account
• Transfer Azure subscriptions between subscribers and CSPs
• Associate or add an Azure subscription to your Microsoft Entra tenant
• Azure Lighthouse in enterprise scenarios