Move resource group to different subscription

Question

Hi,
I'm trying to move an Azure VM to another subscription along with its associated resources (vnet, os-disk, network watcher). But when i follow the instructions to do so by selecting all the resources in the resource group section and clicking Move to another subscription, it fails on validating the vnet resource. The following error is produced:

{  
  "code": "ResourceMoveProviderValidationFailed",  
  "message": "Resource move validation failed. Please see details. Diagnostic information: timestamp '20220111T082602Z', subscription id 'a19102d0-24ca-42a7-a9ab-5f14ecdd8b6e', tracking id '03752290-015f-4e91-9346-2cf6fe9bc2ae', request correlation id '07202d5b-fdd2-4aa4-82b6-70834ca7b642'.",  
  "details": [  
    {  
      "code": "MissingMoveDependentResources",  
      "target": "Microsoft.Network/virtualNetworks",  
      "message": "The move resources request does not contain all the dependent resources. Please check details for missing resource Ids.",  
      "details": [  
        {  
          "code": "0",  
          "message": "/subscriptions/a19102d0-24ca-42a7-a9ab-5f14ecdd8b6e/resourceGroups//providers/Microsoft.Network/networkWatcherReferences/networkWatcher"  
        }  
      ]  
    }  
  ]  
}  

I see that it complains about something regarding the network watcher, but this should move along with the vnet, shouldn't it? From the docs that I have read all of the resources in the screenshot should be legit to move to another subscription. However, I did have a Standard public IP address resource, which could not be moved. I therefore dissociated my public IP from my network interface (and deleted it) and hoped that this would solve the problem, but alas. Note that the error above is from after I deleted the IP address resource.

Could anyone point me in the right direction as to what I am doing wrong here? At the very least, if all other attempts fail, can I move only my VM and recreate the other resources at the other subscription? Any help her would be appreciated.

Thanks

Answer 1

Hello @Østhus, Vegar

From the error above I see that you are not able to move VM to another subscription because you have Network Watcher associated with your Virtual Network.

There are scenarios where Azure VM move is not supported. One of them is:

• Virtual machines in an existing virtual network can't be moved to a new subscription when you aren't moving all resources in the virtual network.
  https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-limitations/virtual-machines-move-limitations#scenarios-not-supported

The Network Watcher resource represents the backend service for Network Watcher and is fully managed by Azure. Customers do no need to manage it. Operations like move are not supported on the resource. However, the resource can be deleted.
https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-create#delete-a-network-watcher-in-the-portal

Navigate to All Services > Networking > Network Watcher.
Select the overview tab, if you're not already there. Use the dropdown to select the subscription you want to disable network watcher in. Expand the list of regions for your chosen subscription by clicking on the arrow. For any given, use the 3 dots on the right to access the context menu. Click on "Disable network watcher" to start disabling. You will be asked to confirm this step. Click Yes to continue. On the portal, you will have to do this individually for every region in every subscription.

To delete an instance of Network Watcher, run the following example in PowerShell:

New-AzResourceGroup -Name NetworkWatcherRG -Location westcentralus  
New-AzNetworkWatcher -Name NetworkWatcher_westcentralus -ResourceGroupName NetworkWatcherRG -Location westcentralus  
Remove-AzNetworkWatcher -Name NetworkWatcher_westcentralus -ResourceGroupName NetworkWatcherRG  

https://learn.microsoft.com/en-us/azure/network-watcher/frequently-asked-questions#how-can-i-manage-the-network-watcher-resource--