How to move an Azure Subscription to a different Tenant

      37 Comments on How to move an Azure Subscription to a different Tenant

Buy Me a Coffee

In this post I will explain how to move an Azure Subscription to a different Azure Tenant (Directory). I often use this to move my MPN subscription to a Greenfield tenant to test new functionalities without worrying about settings I’ve made in the past. But this can also be use to bundle multiple Visual Studio subscriptions in one tenant or for any other reason.

 

Demosetup

 

I will be using two Tenants:

– My old tenant called “Demotenant” this is a directory with a MPN subscription attached.

– The other tenant I’m using is “Vmlabblog.com” with a Pay-As-You-Go subscription attached.

In this Tutorial I’m going to move my MPN subscription from Demotenant to Vmlabblog.com.

 

Guest user

 

1. The first step is to create an user which has access to both tenants. The user needs to have a working email-account. I will be using the globaladmin of the “Vmlabblog.com” tenant for this purpose. Login to Tenant the old tenant (demotenant) with an admin account and go to “Azure Active Directory -> Users” and press “New guest user”.

2. Enter the email-address of the guest user (user of the new tenant) and press “Invite”. The guest user you’ve just entered will be added to the Azure AD and send an invitation mail on the email-address entered.

 

3. Now we need to assign owner rights for the subscription to guest we’ve just added. This is necessary to be able to see and move the subscription to another tenant.  Go to subscriptions -> Access control (IAM) and press “Add” in Add a role assignment.

 

4. Select the role “Owner” and select the guest user. Select “Save” to apply the changes.

 

5. Wait till the changes have been applied and signout.

Move subscription

 

6. Check the mailbox of the user you added as a guest user for an invitation email. Open the email and press “Get Started”

 

7. Sign in with the credentials of the Guest User to the new tenant (demotenant). These are the same credentials as used to login into the old tenant. (vmlabblog.com)

 

8. To sign in to the tenant with your guest account you need to agree with the permissions press “Accept” to continue.

 

9. In the Azure portal check if you are in the correct tenant. If not select “Switch directory”

 

10. Select the “all directories” tab, here you should see both the old tenant (demotenant) and the new tenant (VMLabblog.com). Select the old tenant (demotenant).

 

 

11. Go to subscriptions and select the subscription you want to move.

 

12. Select the subscription and press “Change directory” and select the new Tenant. Press “Change” to apply the changes.

 

13. The change will take some time.

 

14. When you now refresh the page (this may take some time) the subscription is gone in the old Tenant (demotenant)

 

15. Switch to the new Directory. You will notice only one subscription is displayed, this is because of the “Global subscriptions filter. Click “global subscriptions filter”.

 

16. Select in the Default subscription filter “select all”

 

17. Now both subscriptions are displayed in the “Subscriptions” view.

 

18. The subscription has now been moved from the old tenant (demotenant) to the new tenant (VMLabBlog.com).

 

37 thoughts on “How to move an Azure Subscription to a different Tenant”

  1. valireality

    Nice tutorial, thanks for that. What about resources like resource groups, VM’s, vNet, public IP, etc.?

    Reply ↓
    1. Aad Lutgert Post author

      This response is updated on 10-08-2020

      Hi,

      These resources will be available in the new tenant. It may take some time before the change are applied. Also check the subscription filter you may need to check the box to display the resources which are attached to the moved subscription.

      Reply ↓
  2. Greg

    Thanks for this, further to the previous comment, if you move the Subscription, where do all the resource groups and associated resources that were in it end up if the subscription that they were in got moved?

    Thanks in advance

    Reply ↓
    1. Aad Lutgert Post author

      Hi Greg,

      Thanks for your reply, I just had another look at the question and misread the question. The resource groups and associated resources are attached to the moved subscription and will be available in the new tenant.

      Reply ↓
    1. Aad Lutgert Post author

      Hi Raul,

      Good question, the payment method and invoice recipients will not change when you change the directory of a subscription. Also the account admin will stay the same, so you will need to add the account admin to the new tenant as guest. Another option is to transfer the billing ownership.

      best regards,
      Aad

      Reply ↓
  4. Manuel

    Hi Aad,

    Thanks for this tutorial!

    What will happen with roles, permissions, Service Principles etc. I set up in the old tenant (so with the whole access control)? Do I need to create them again?

    Thanks!
    Manuel

    Reply ↓
  5. Ted Asuncion

    wow! great article. So I can just jump my subscription from one directory to another directory as long as I have an account that has access to both subscriptions?

    I’ve been struggling planning on how to do this. btw, i saw another blog where he created a temporary subscription under the source tenant on the same directory – like a middle-man kind of subscription. Why would he do that? See the article that I’m referring to below for more details.

    https://social.technet.microsoft.com/wiki/contents/articles/51360.azure-how-to-move-resources-between-subscriptions-under-different-tenants.aspx

    Reply ↓
    1. Aad Lutgert Post author

      Hi Ted,

      You are correct. I just looked at the article, but if I understand it correctly this is a different use case. The author doesn’t want to move the subscription to another directory but only wants to move RG1 from subscription 1 to subscription 3. To do this without moving subscription 1 you will need to use a temporary subscription.

      Hope this answers your question.

      best regards

      Reply ↓
  6. Agustin

    Hi Aad, Awesome article!
    Do you know if this can be done with the visual studio professional subscription?
    The monthly credit renewal will be maintained in the new tenant?
    I would like to keep my tests in another tenant for that.

    Again, thanks for write this tutorial!
    Kind regards.

    Reply ↓
      1. varun

        Clarification needed, I observed Microsoft mentioned RBAC will be removed completely when a subscription is moved to a new tenant, when I tried, same has happened.

        Reply ↓
  8. ferry

    Hi Aad,

    Thanks for this tutorial!

    I just got stuck at this point, Migration of resources from one subscrption to another through powershell.

    any related docs or videos , please share with my mail.

    Thanks and Regards
    Ferry

    Reply ↓
  9. Laurent FRANCFORT

    Hi Aad,

    Thanks for this tutorial, it seems too simple to be realistic 🙂
    From what I understood it’s more a “administrative/ops” move rather than a technical move, so any technical settings should be kept. Can you confirm ?
    You used Pay As You Go subscriptions. Do you know if it works also with CSP subscriptions ?

    Laurent

    Reply ↓
    1. Aad Lutgert Post author

      Hi Laurent,

      To put it very simply resources are attached to a subscription. The subscription uses the azure ad to authenticate users. In this operation, you break the trust between the Azure AD and the subscription. This results in users losing their access to the resources. As mentioned earlier take a careful look at Microsoft’s “Before you begin” before starting such an action. According to this page point 3 you can’t change the Azure AD tenant for an Azure CSP subscription. But you could ask your CSP partner for help.

      Best regards, Aad

      Reply ↓
  11. Ivan

    When moving, will there be downtime ? does VM´s have to be shutdown ? Or can this be done seamlessly ?

    // Ivan

    Reply ↓
  12. Mark Cox

    Great demo. I have two tenants one for infrastructure and one for o365. This isn’t ideal as I have two logins! Which subscription would you move to where and why? Would there be downtime?

    Reply ↓
  13. Mark Cox

    Great demo. I have two tenants one for infrastructure and one for o365. This isn’t ideal as I have two logins! Which subscription would you move to where and why? Would there be downtime ?

    Reply ↓
  14. Jayesh

    Nice demo mate. is it possible to take access (or get it assigned to our tenant) of customer’s subscription ? actually my requirement is to work on subscription which will be in customer tenant and i want it to access it and do work. (I don’t want to transfer or move customer subscription to my tenant ) please can you assist ?

    Reply ↓
      1. Jayesh

        Hi Aad,

        Thanks for your reply.

        actually we have just started and taken partner portal access with Microsoft and become partner and now we are moving towards to become CSP and planning to onboard our customer’s subscription not our partner tenant. this is our plan actually.

        onboarding customers by inviting them is good onboarding option but as we have multiple customers we are planning to go with azure lighthouse to onboard customers. what do you think, are we going in right direction ?

        Reply ↓
  15. Jordan van Bergen

    Can we move a Sponsorship Azure subscription from our non-profit tenant to a pay as you go tenant belonging to another company (not a non-profit)?

    Reply ↓
    1. Aad Lutgert Post author

      Hi Jordan,

      I’ve never tried a Sponsorship subscription, but I believe all subscriptions can be moved as long it’s not a Azure CSP (Cloud Solution Providers) Subscription.

      regards, Aad

      Reply ↓
  16. Amar

    Hi Aad,
    Thank you for the explanation.
    I am able to move my subscription from one tenant to another.

    Will my all “RBAC and users having subscription level permissions” also get moved to new tenant?

    Reply ↓
  17. krishna kumar vollala

    Hi ,

    Thanks for the detail explanation. I see a conflict statement on point 7 where initially you mentioned old tenant is demotenant and new tenant is vmlabblog.com but below point saying reverse. Not sure sorry correct me if my understanding is wrong.

    7. Sign in with the credentials of the Guest User to the new tenant (demotenant). These are the same credentials as used to login into the old tenant. (vmlabblog.com)

    thanks
    krishna

    Reply ↓
  18. Guilherme

    Hi. Such a great article!! Thanks so much! I’ve two questions: – When moving, will there be any downtime? We have our app services and DBs running… so if there is downtime, we will need to plan it accordingly. – Once moved, will all resources
    completely disappear from the old tenant (I imagine so)? Thanks again.

    Reply ↓
  19. Russ

    Hello, great guide! will we need to apply new public IPs to the Vnics? or will that transfer over as well? I think it would since its part of the subscription but would rather make sure.

    Thank you

    Reply ↓
  22. Gowtham

    Hello Aad,
    Good Article!!
    Can you please confirm for me the procedure is the same for the below requirement as well!!
    Tenant 1 – With 2 Subscriptions with Azure AD DS.
    Tenant 2 – With 1 Subscription with Azure AD.
    Req: Need to migrate 2 subscriptions from Tenant 1 to Tenant 2
    So that we can see all 3 subscriptions in Tenant 2.

    Reply ↓
    1. Aad Lutgert Post author

      Hi,

      Yes, it will work the same. You need to be carefull, because the Azure AD (DS) will not move with the subscription (you’re associating a subscription with a new directory). Users that have roles assigned using Azure role-based access control lose their access. Classic subscription administrators, including Service Administrator and Co-Administrators, also lose access. Check this link for helpful tips https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-how-subscriptions-associated-directory#before-you-begin

      regards, Aad

      Reply ↓
  23. Vladimir Nekic

    Hello everyone. I am seeing some responses that are pretty recent. This article is from 2020 and should be treated as such unless the author updates this.

    Currently that option of changing directory is still available. Keep in mind that doesn’t transfer the billing ownership which may be desired option. Please make sure that the new option of “Transfer Billing Ownership” is reviewed as well.

    https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/billing-subscription-transfer

    Reply ↓

Leave a Reply

Your email address will not be published. Required fields are marked *