Forum Discussion
Completely migrate DevOps Organisation to new Tenant and Subscription
- Coming back to my own request.
We've done the migration last week and it was quite smooth.
With the help and steps described here: https://learn.microsoft.com/en-us/azure/role-based-access-control/transfer-subscription we were able to reactivate most of the pipelines and resources without problems.
KeyVault was a bit specific but once done like described it worked again immediately.
The big work was at customer site to modify all pipelines with the new ServicePrinciples.
Ben
We've done the migration last week and it was quite smooth.
With the help and steps described here: https://learn.microsoft.com/en-us/azure/role-based-access-control/transfer-subscription we were able to reactivate most of the pipelines and resources without problems.
KeyVault was a bit specific but once done like described it worked again immediately.
The big work was at customer site to modify all pipelines with the new ServicePrinciples.
Ben
Hello Benjamin,
Thank you very much for sharing your experience on this migration.
I'm going to embarque on similar approach but I'm also still beginner in Azure DevOps administration.
Especially now that they have introduce Microsoft Entra to replace AD.
I have one question.
I have actually a Azure DevOps Service setup with that mainly use Azure DevOps for its work items (we will introduce later, repository and pipeline and test plan) with a specific tenant.
- Azure Subscription
- Azure DevOps service (Visual Studio Online seen in resources in Azure subscription) and located in https://dev.azure.com/XXXXX (XXXXXX being by organization)
Now we have merged activitiy with a new customer that has his own Azure
- Azure Cust (but they have no subscription)
I think my point is, in your steps that you cited:
- Prepare the users in the new tenant
- Change the AAD connection for DevOps (https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/change-azure-ad-connection?view=azure-devops)
- UserMapping after migration in DevOps
- Document all RBAC, Roles, ecc. as described here: https://learn.microsoft.com/en-us/azure/role-based-access-control/transfer-subscription
- Migration of the subscription to the new tenant
- Restore RBAC, KeyVault, StorageAccount accesses in the new tenant
- Re-create all ServicePrincipals in DevOps and adjust the pipelines
1. As there are no use of Pipeline or REpository would we need still to restore the KeyVault, storage account?
2. Also all the work item you have created, were you able to keep all of them and all their history? even if the user are do no longer exist with the previous tenant and AD?
3. when you have changed the directory to the new directory, weren't there any trouble as the Subscritpion were not yet move to the tenant yet?
4. How did you perform the Subscription to the new tenant? have you used the Azure Portal to do so?
