moving a VM from one subscription to other subscription

Question

While moving a VM from one subscription to other subscription, it gives an error -  "message": "Resource move validation failed. Please see details. Diagnostic information: timestamp '20260315T152334Z', subscription id '<PII removed>', tracking id '<PII removed>', request correlation id 'PII removed'. (Code: ResourceMoveProviderValidationFailed) Cannot move one or more resources in the request. Please check details for information about each resource. (Code: CannotMoveResource, Target: Microsoft.Network/networkInterfaces) Cannot move resource abhyutthaanvmNewvirtualNetwork since it references resource /subscriptions/<PII removed>/resourceGroups/abhyutthaanvmR/providers/Microsoft.Network/virtualNetworks/abhyutthaanvmNewvirtualNetwork/subnets/AzureFirewallSubnet, which does not support move or updating references after the move. (Code: CannotMoveResourceDueToReference)",

  "code": "ResourceMoveProviderValidationFailed",

  "name": "BatchResponseItemError",

  "stack": "BatchResponseItemError: Resource move validation failed. Please see details. Diagnostic information: timestamp '20260315T152334Z', subscription id '<PII removed>', tracking id '<PII removed>', request correlation id '<PII Removed>'.\

Answer 1

Hello Aruna Singh,

Thank you for reaching out to the Microsoft Q&A forum.

It looks like your VM’s network interface is sitting in a subnet called AzureFirewallSubnet that hosts an Azure Firewall. Unfortunately that subnet (and the firewall resource in it) isn’t supported by the “move resource” operation, so the validation fails and the VM/NIC can’t be moved as long as that dependency remains.

You’ve got three main paths forward:

1. Remove or redeploy the Azure Firewall, move the VNet (and its subnet), then move the NIC and VM • Detach/delete the Azure Firewall resource in that subnet • Use az resource move or the Azure portal to move the virtual network first • Move the NIC, NSG, disks, then finally the VM
2. Use Azure Resource Mover • Resource Mover can orchestrate moves of VNets, firewalls, NICs, disks, and VMs across subscriptions (and even regions) in one coordinated workflow • It will handle resource ordering and re‐create dependent resources in the target subscription
3. Snapshot + rebuild the VM in the new subscription • Deallocate the VM • Create a snapshot of the OS disk (az snapshot create …) • Copy/move that snapshot or exported VHD into the target subscription • Create a managed disk from the snapshot and spin up a new VM pointing at that disk in your destination subscription • Reattach any data disks or recreate NICs/VNet as needed

Pick the approach that best fits your environment—if you can remove the firewall and subnet, the built-in “move resources” will work after that. If you need to keep the firewall in place, Resource Mover or the snapshot/recreate method is your easiest route.

Reference links:

• Move a Windows VM to another subscription or resource group https://docs.microsoft.com/azure/virtual-machines/windows/move-vm
• Move operation support by resource type (see which resources support move) https://docs.microsoft.com/azure/azure-resource-manager/management/move-support-resources
• Virtual machines move limitations (special cases like Azure Firewall subnet) https://docs.microsoft.com/azure/azure-resource-manager/management/move-limitations/virtual-machines-move-limitations
• Azure Resource Mover overview https://docs.microsoft.com/azure/resource-mover/overview

Hope that helps! Let me know which path you’d like to try or if you need more detailed steps.

 

 

Answer 2

Hi Aruna Singh,

Welcome to Microsoft Q&A,

The error message is pointing to a very specific blocker that goes beyond a typical VM move restriction. The VNet associated with your VM contains an AzureFirewallSubnet, indicating that Azure Firewall is deployed (or was previously deployed) in that VNet. Azure Firewall is a resource that does not support cross-subscription moves, and because the NIC references the VNet that contains it, the entire move chain is blocked.

When moving a VM with a network interface card to a new subscription, you must move all dependent resources, including the virtual network for the network interface card. However, a VNet cannot be moved if it contains a subnet with resource navigation links or references to resources that do not support move.

You could do either

1. Remove Azure Firewall from the VNet, then move (recommended if you want to keep the same VNet) (or)
2. Snapshot and redeploy (recommended if you want to keep Azure Firewall running)

https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-limitations/networking-move-limitations

Please Upvote and accept the answer if it helps!!