Forum Discussion
Azure subscription transfer
Hi,
I can transfer an existing subscription to a new AAD (Azure Active Directory) tenant. When am going to transfer it all Roll-Based-Access-Control (RBAC) roll assignments will be deleted from the source tenant. So my question is, do we need to re-assign the access for each? or is there any other way to transfer the AAD tenant with all RBAC?
You are actually transferring your subscription to a different AAD tenant, not the other way around. Since there can only be one "authoritative" AAD directory per Azure subscription, it is not possible to transfer "role assignments". What you could do instead, is:
- export current role assignments with 'security principals' (users, groups, SPNs, MIs), roles, and scopes
- map those original security principals with their "representatives" in the new tenant
- prepare a script (or a template) that will populate the RBAC with those role assignments as a bulk operation to minimize any disruptions this transfer may cause
There is a comprehensive guide about the transfer with recommended workflow: Transfer an Azure subscription to a different Azure AD directory | Microsoft Docs
5 Replies
You are actually transferring your subscription to a different AAD tenant, not the other way around. Since there can only be one "authoritative" AAD directory per Azure subscription, it is not possible to transfer "role assignments". What you could do instead, is:
- export current role assignments with 'security principals' (users, groups, SPNs, MIs), roles, and scopes
- map those original security principals with their "representatives" in the new tenant
- prepare a script (or a template) that will populate the RBAC with those role assignments as a bulk operation to minimize any disruptions this transfer may cause
There is a comprehensive guide about the transfer with recommended workflow: Transfer an Azure subscription to a different Azure AD directory | Microsoft Docs
- Thank you very much David. I got the correct idea from your well explained answer. It was very supportive. Thanks again. 😊
- I'm glad it helped. Will you please mark my response as the answer? Thx.
Hello! You've posted your question in the Tech Community Discussion space, which is intended for discussion around the Tech Community website itself, not product questions. I'm moving your question to the Azure Active Directory space - please post Azure AD questions here in the future.
- Thanks in advanced Eric!
