Share via

Azure Resource Mover Support for Cross-Tenant and AI Resource Migration

JMN-2253 656 Reputation points
2026-01-08T14:17:43.8666667+00:00

One of our customers has a complex Azure environment consisting of seven subscriptions under a single Entra ID tenant.

The customer is planning the following changes:

  1. They will create a new Entra ID tenant and migrate users from the existing tenant to the new one.

They want to migrate most of their Azure resources (approximately 20,000 resources) to the new environment.

The resources include, but are not limited to:

Azure AI services (Vision, Translator, Document Intelligence, Language, Azure OpenAI, Azure AI Hub, Azure AI Foundry, Azure AI Search, etc.)

Private Endpoints associated with supported resources

Key Vaults

Storage Accounts

Questions

Cross-tenant support: Does Azure Resource Mover support moving resources not only between subscriptions, but also between subscriptions that belong to different Entra ID tenants?

AI resource support: The official documentation indicates that Azure Cognitive Services are supported; however, it does not explicitly list other AI services such as Azure OpenAI, Azure AI Foundry, Azure AI Hub, or related services.

Is there any official Microsoft documentation or authoritative source—other than the following link—that confirms support for moving these resources? https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources

Thank you in advance for your guidance.

Community Center | Not monitored
0 comments

Answer accepted by question author

Bharath Y P 8,850 Reputation points Microsoft External Staff Moderator
2026-01-09T11:04:18.1133333+00:00

Hello JMN-2253, You are looking for a structured breakdown of the migration process we discussed, specifically regarding moving AI Resources, VNETs, and Web Apps to a subscription in a different Entra ID Tenant.

Moving resources directly across Entra ID (formerly Azure AD) tenants is not supported. To achieve this, you must transfer the entire subscription to the new tenant or re-create the resources.

Move Azure resources across resource groups, subscriptions, or regions. - Azure Resource Manager | Azure Docs

Azure uses the Tenant ID as the security boundary.

  • AI Services: Rely on the Tenant for authentication tokens.
  • Web Apps: Often use System-Assigned Managed Identities that are unique to the source tenant's directory.
  • VNETs: While the IP structure stays, any cross-tenant peering requires a new handshake because the security context has changed.

AI Services: Azure AI resources are often tied to the tenant for authentication. You must re-create Role Assignments (like Cognitive Services User) for users in the new tenant. If you used Managed Identities for AI Search or storage access, those must be re-configured.

Virtual Networks (VNETs): If your VNET was peered to another VNET in the old tenant, that peering will break. You must delete the old peering and establish a Cross-Tenant Peering if the other VNET stayed behind, or re-establish local peering if both moved.

Web Apps (App Service): If your Web App uses a Managed Identity to talk to a SQL Database or Key Vault, it will stop working. Disable and re-enable the System-Assigned Managed Identity on the Web App to generate a new Identity ID in the new tenant, then grant that new ID permissions to your resources.

These typically remain intact, but if you used Key Vault-stored certificates, the connection to the Key Vault will need to be updated.

Key Vault: Key Vault is strictly tied to a Tenant ID. After the move, run the following Azure CLI command to update it:

az keyvault update --name MyKeyVault --resource-group MyRG --target-tenant-id <New-Tenant-ID>

Hope this helps! If the provided answer was helpful, please do Accept the answer and Upvote, If you need further assistance, please do let us know, Thanks

Was this answer helpful?

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-01-08T14:17:57.5266667+00:00

    Azure Resource Mover does not support moving resources between subscriptions that belong to different Entra ID tenants. The move operation is restricted to resources within the same tenant, meaning that you cannot directly migrate resources across different Entra ID tenants using Azure Resource Mover.

    Regarding the support for AI services, while Azure Cognitive Services are explicitly mentioned in the documentation, there is no definitive confirmation for the migration of other AI services such as Azure OpenAI, Azure AI Foundry, or Azure AI Hub. The official documentation does not list these services, and without additional authoritative sources, it is unclear if they can be moved using Azure Resource Mover. For the most accurate and updated information, it is advisable to consult the Azure documentation regularly or reach out to Azure support directly for specific inquiries about resource migration capabilities.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.