Cannot move Azure resources by Azure CLI

Question

I would like to move Azure resources from resourceGroupA to resourceGroupB. ResourceGroupB is in another subscription, but in the same tenant.

az login --service-principal --username 'someGUID' --password 'someSecret' --tenant 'tenantGuid'
az account set --subscription 'sourceSubscriptionGUID'
az resource move --destination-group 'destinationResourceGroupName' --destination-subscription-id 'destinationSubscriptionGUID' --ids $(az resource list --resource-group 'sourceResourceGroupName' --query "[].id" -o tsv)

I try this code below but get the error

(ResourceMoveProviderValidationFailed) Resource move validation failed. Please see details. Diagnostic information: timestamp '20250613T070541Z', subscription id 'someGUID', tracking id 'someGUID', request correlation id 'someResourceGroup'. Code: ResourceMoveProviderValidationFailed
Message: Resource move validation failed. Please see details. Diagnostic information: timestamp '20250613T070541Z', subscription id 'someGUID', tracking id 'someGUID', request correlation id 'someGUID'. Exception Details:      (ResourceMoveProviderValidationFailed) {"Code":"BadRequest","Message":"Please select all the Microsoft.Web resources from 'someResourceGroup' resource group for cross-subscription migration. Also, please ensure destination resource group 'someResourceGroup' doesn't have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together: az-func-app-alz-test (Microsoft.Web/sites)\r\n az-logic-app-alz-test (Microsoft.Web/sites). This resource is located in resource group 'someResourceGroup', but hosted in the resource group 'someResourceGroup'. This may be a result of prior move operations. Move it back to respective hosting resource group\r\n ASP-rgm365spazltest-ba8b (Microsoft.Web/serverFarms)\r\n. 

Answer 1

Hello , Welcome to MS Q&A

• The error occurs because when moving Microsoft.Web resources (such as App Services, Function Apps, Logic Apps, and App Service Plans) across subscriptions, you must:
  • Move all related Microsoft.Web resources (sites and serverFarms) from the source resource group together in a single operation.
  • Ensure the destination resource group does not already contain any Microsoft.Web resources before the move.
  • If a resource (like a site) is hosted in a different resource group than where it resides, you must first move it back to its hosting resource group before attempting the cross-subscription move.
• To resolve:
  • Identify all Microsoft.Web resources (sites and serverFarms) in the source group and move them together.
  • Make sure the destination group is empty of Microsoft.Web resources.
  • If any resource is split across groups due to previous moves, move it back to its original hosting group first.
• For more details and step-by-step guidance, see Move resources to a new resource group or subscription and Troubleshoot moving Azure resources.

Please check and let us know if any further ques

Kindly accept answer if it helps

Thanks
Deepanshu

Answer 2

Hi Khalid Hajjouji

The error you're encountering during the move operation is related to a constraint on Microsoft.Web resources, specifically the fact that some of your resources (like Microsoft.Web/sites and Microsoft.Web/serverFarms) need to be moved together as a group.

You have resources like az-func-app-alz-test, az-logic-app-alz-test, and ASP-rgm365spazltest-ba8b in the resource group, which are tied together. To resolve this, you need to ensure that all these resources are selected for the move operation and that they stay together when moved to the destination.

Could you please follow the below steps to resolve this issue:

1. Identify All Required Microsoft.Web Resources. Use the below command to list all Microsoft.Web resources in the source group:

      az resource list --resource-group sourceResourceGroupName --resource-type Microsoft.Web/sites --query "[].id" -o tsv
      az resource list --resource-group sourceResourceGroupName --resource-type Microsoft.Web/serverFarms --query "[].id" -o tsv
   

2. Check that destinationResourceGroupName doesn't already have Microsoft.Web resources:

      az resource list --resource-group destinationResourceGroupName --query "[?type=='Microsoft.Web/sites' || type=='Microsoft.Web/serverFarms'].name" -o tsv
   

   If it does, you must either remove them or choose a different empty destination group for this operation.
3. Once you’ve gathered all the required resource IDs:

      az resource move \
        --destination-group destinationResourceGroupName \
        --destination-subscription-id destinationSubscriptionGUID \
        --ids <id1> <id2> <id3> ...
   

Alternatively, you can try the below command

# Log in to Azure using service principal
az login --service-principal --username 'someGUID' --password 'someSecret' --tenant 'tenantGuid'
# Set the source subscription
az account set --subscription 'sourceSubscriptionGUID'
# List all resource IDs in the source group, including Microsoft.Web resources
resource_ids=$(az resource list --resource-group 'sourceResourceGroupName' --query "[].id" -o tsv)
# Move resources to the destination group and subscription
az resource move \
  --destination-group 'destinationResourceGroupName' \
  --destination-subscription-id 'destinationSubscriptionGUID' \
  --ids $resource_ids

Hope this helps!

Please Let me know if you have any queries.

If you found the information helpful, please click "Upvote" on the post to let us know and consider accepting the answer as the token of appreciation. Thank You.

Answer 3

I still get this error. I created a support ticket at Microsoft. They say I need to remove the certificate bindings. I removed the certificates from the function app, but the error is still the same.

Answer 4

Hi Khalid Hajjouji

If Microsoft support has indicated that you need to remove certificate bindings from your Azure Function App and you've already removed the certificates but are still encountering the same error, here are some steps you can take to ensure that all bindings are properly removed:

1. Ensure that there are no SSL bindings still associated with your Function App. Navigate to your Function App in the Azure Portal -> Go to the "TLS/SSL settings" section -> Check the "Private Key Certificates (.pfx)" and "Public Key Certificates (.cer)" sections to ensure that no certificates are listed.
2. If you have custom domains associated with your Function App, ensure that they are not still bound to the certificates. You can remove custom domains from the "Custom domains" section in the Azure Portal.
3. Sometimes, application settings may reference certificates or bindings. Check the "Configuration" section of your Function App to ensure there are no settings related to the removed certificates.
4. After making changes, restart your Function App to ensure that all settings are refreshed. After confirming that all certificate bindings and related settings have been removed, try the move operation again.

Hope this helps!

Please Let me know if you have any queries.

If you found the information helpful, please click "Upvote" on the post to let us know and consider accepting the answer as the token of appreciation. Thank You.