Forum Discussion

Benjamin Graus's avatar
Benjamin Graus
Brass Contributor
Oct 17, 2022
Solved

Completely migrate DevOps Organisation to new Tenant and Subscription

Hi,  hope this question besides here.   Can anyone confirm the steps needed to completely migrate a DevOps Organisation to a new Tenant and Subscription.   The first steps are obvious: Prepare...
azure devops
  • Benjamin Graus's avatar
    Benjamin Graus
    Jan 09, 2023
    Coming back to my own request.
    We've done the migration last week and it was quite smooth.
    With the help and steps described here: https://learn.microsoft.com/en-us/azure/role-based-access-control/transfer-subscription we were able to reactivate most of the pipelines and resources without problems.
    KeyVault was a bit specific but once done like described it worked again immediately.

    The big work was at customer site to modify all pipelines with the new ServicePrinciples.

    Ben
Joe_Smith_OpsHub's avatar
Joe_Smith_OpsHub
Copper Contributor
Jun 23, 2025

Hi Benjamin Graus​, 

Thanks for laying it out so clearly. This kind of tenant and subscription migration in Azure DevOps can get tricky, especially when it comes to service principals and pipelines. 

A few things to keep in mind before making the move: 

  • User and service principal identities stay behind: When you switch Azure AD tenants, most of the user and service principal identities won’t carry over. You’ll need to recreate them in the new tenant.
  • Billing is the easy part: Changing the subscription (like from MPN to PAYG) is usually straightforward. The real work is on the identity and project content side.
  • Service connections are tenant-specific: Connections to App Services, GitBucket, etc., will need to be reconfigured— because they’re tied to SPNs from your old tenant.
  • Pipelines may break: If your pipelines use those old SPNs, you’ll need to update them with the new ones after migration.
  • Audit and traceability: Be careful during the switch —rebuilding things manually can leave gaps in traceability and version history. 

So yep, your assumptions are pretty spot on: 

  • You’ll need to recreate service principals in the new tenant.
  • Service connections and pipelines will need to be updated to reflect the new identity and permission structure. 

However, if you're looking to save yourself from a lot of manual work (and some post-migration surprises), you might want to check out OpsHub Migration Manager for Microsoft Azure DevOps (OM4ADO).  Co-built with Microsoft for no downtime, no disruptive and full fidelity migrations between Microsoft tools.  

Hope it helps!

Resources