Move subscription to new tenant, without disrupting service accounts in current tenant

Leo Johnson 151 Reputation points
2021-02-16T07:12:30.047+00:00

Hi All,

At the moment we are looking for the possibilities to merge our Azure tenants.

We need to move the subscription from one tenant to the new one.

Complicated factor: We are using service accounts in our old tenant which cannot be migrated and must keep working.
Those accounts are used in complex services and solutions and will be migrated in the far future.

So is it possible to migrate the subscription, without the risk that our accounts maybe stopped / malfunctioning?

Thanks!

Leo

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
22,150 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Shashi Shailaj 7,606 Reputation points Microsoft Employee
    2021-02-16T15:23:03.957+00:00

    @Leo Johnson ,

    At any given point of time an azure subscription needs to be associated with an azure AD tenant . The azure AD tenant provides the Identity and access control plane for all the assets/resources created within an azure subscription. If you have created service accounts in old tenant then you need to check what azure assets are using those service account. Are they present in the same azure subscription you are going to migrate to new tenant ? If the answer is yes . Then the dependent service/solution will stop working . For example you may have a azure automation runbook which creates service principals and that will stop working because the Service principal exists in Azure AD while the Azure runbook for the automation exists in the azure subscription and will move with it . any service which is using Managed Identity also will stop working and you may have to recreate the managed identity and make changes to configuration.

    The accounts per se will not stop functioning but all the azure resources in your azure subscription which were able to search those accounts/service principas by virtue of being associated with the old tenant will not be able to find them in the new tenant once subscription is moved to new tenant and will error out because you would have moved the old subscription to a new tenant (or azure active directory)

    You have mentioned that you are merging azure tenants. Generally as per my experience , most customers do this in a scenario where Office 365 subscription (lets call it O365 or old tenant) is associated in one azure AD tenant and the Azure resources are in a subscription associated to a separate azure AD tenant (Lets call it AAD or new tenant). Users had multiple accounts in both tenants And now a need to have a single account for accessing all company resources on Azure is seen. But there will be very few situations if you already have running solutions in which you may get it working without downtime. In most situations transferring a subscription might require downtime to complete the process. Careful planning is required to assess whether downtime will be required for your transfer. I would strongly suggest you to go through the following articles as part of transfer planning.

    https://learn.microsoft.com/en-us/azure/role-based-access-control/transfer-subscription

    I hope the above details help . In case you still have queries let us know and we will be happy to help further. If the clarification was useful , please do accept this post as answer which may help other members of the community searching for similar queries . If you believe that I have misunderstood the question or need more information , please post your queries in comments and we will be happy to help further on this.

    Thank you.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.