{"id":9,"date":"2025-12-29T15:55:15","date_gmt":"2025-12-29T15:55:15","guid":{"rendered":"https:\/\/tomaszwojtasik.com\/?p=9"},"modified":"2025-12-29T21:06:47","modified_gmt":"2025-12-29T21:06:47","slug":"what-breaks-when-you-move-azure-resources-between-subscriptions","status":"publish","type":"post","link":"https:\/\/tomaszwojtasik.com\/index.php\/2025\/12\/29\/what-breaks-when-you-move-azure-resources-between-subscriptions\/","title":{"rendered":"What Breaks When You Move Azure Resources Between Subscriptions"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p>On a daily basis, I work with resources hosted in Microsoft Azure. From time to time, there is a need to move resources between different Azure subscriptions while staying within the same Entra ID tenant.<\/p>\n\n\n\n<p>During one of these moves, I noticed an unexpected behavior related to permissions assigned to managed identities. I decided to write this article to highlight this issue, as it may cause problems if it is not taken into account during resource migrations.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Problem<\/h2>\n\n\n\n<p>Many of the services I build or manage are based on an architecture that uses <strong>App Service<\/strong> and\/or <strong>Azure Function Apps<\/strong> as executable components. These resources typically use <strong>system-assigned managed identities<\/strong>.<\/p>\n\n\n\n<p>Managed identities are used to grant access to data resources and other services. For example:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A managed identity is assigned a role on a <strong>Storage Account<\/strong>, such as <strong>Storage Blob Data Contributor<\/strong> <\/li>\n\n\n\n<li>A managed identity is granted permission to read secrets from <strong>Azure Key Vault<\/strong> using an <strong>access policy<\/strong><\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"481\" src=\"https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources1-1024x481.jpg\" alt=\"\" class=\"wp-image-10\" srcset=\"https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources1-1024x481.jpg 1024w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources1-300x141.jpg 300w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources1-768x361.jpg 768w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources1-1536x722.jpg 1536w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources1.jpg 1720w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Screenshot showing managed identity role assignment on Storage Account<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"397\" src=\"https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources2-1024x397.jpg\" alt=\"\" class=\"wp-image-11\" srcset=\"https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources2-1024x397.jpg 1024w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources2-300x116.jpg 300w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources2-768x298.jpg 768w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources2-1536x595.jpg 1536w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources2.jpg 1767w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Screenshot showing managed identity access policy on Key Vault<\/figcaption><\/figure>\n\n\n\n<p>When moving a resource to another subscription within the same tenant, I encountered an issue where <strong>not all permissions were transferred<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"444\" src=\"https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources3-1024x444.jpg\" alt=\"\" class=\"wp-image-12\" srcset=\"https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources3-1024x444.jpg 1024w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources3-300x130.jpg 300w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources3-768x333.jpg 768w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources3.jpg 1350w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Option to move resources to another subscription<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"513\" src=\"https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources4-1024x513.jpg\" alt=\"\" class=\"wp-image-13\" srcset=\"https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources4-1024x513.jpg 1024w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources4-300x150.jpg 300w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources4-768x385.jpg 768w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources4.jpg 1240w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Selecting the target subscription and resource group<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"382\" src=\"https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources5-1024x382.jpg\" alt=\"\" class=\"wp-image-14\" srcset=\"https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources5-1024x382.jpg 1024w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources5-300x112.jpg 300w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources5-768x287.jpg 768w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources5-1536x573.jpg 1536w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources5.jpg 1672w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Successful resource move validation<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"606\" src=\"https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources6-1024x606.jpg\" alt=\"\" class=\"wp-image-15\" srcset=\"https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources6-1024x606.jpg 1024w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources6-300x177.jpg 300w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources6-768x454.jpg 768w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources6.jpg 1048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Confirming resource move<\/em><\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"594\" height=\"332\" src=\"https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources7.jpg\" alt=\"\" class=\"wp-image-16\" srcset=\"https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources7.jpg 594w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources7-300x168.jpg 300w\" sizes=\"auto, (max-width: 594px) 100vw, 594px\" \/><figcaption class=\"wp-element-caption\">Successful resource move confirmation<\/figcaption><\/figure>\n\n\n\n<p>Continuing with the examples above:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Role assignments on the Storage Account are not transferred<\/strong><\/li>\n\n\n\n<li><strong>Key Vault access policies are transferred correctly<\/strong><\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"422\" src=\"https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources8-1024x422.jpg\" alt=\"\" class=\"wp-image-17\" srcset=\"https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources8-1024x422.jpg 1024w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources8-300x124.jpg 300w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources8-768x316.jpg 768w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources8-1536x633.jpg 1536w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources8.jpg 1685w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Missing managed identity role assignment on Storage Account after move<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"326\" src=\"https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources9-1024x326.jpg\" alt=\"\" class=\"wp-image-18\" srcset=\"https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources9-1024x326.jpg 1024w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources9-300x96.jpg 300w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources9-768x245.jpg 768w, https:\/\/tomaszwojtasik.com\/wp-content\/uploads\/2025\/12\/moveresources9.jpg 1490w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Managed identity access policy still present on Key Vault after move<\/figcaption><\/figure>\n\n\n\n<p>This difference in behavior is quite surprising, especially considering that both permissions are assigned to the same managed identity and the tenant remains unchanged.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Can Be Done<\/h2>\n\n\n\n<p>I was not able to find a way to automatically preserve or reapply the original managed identity role assignments on Storage Accounts during the move.<\/p>\n\n\n\n<p>The solution I currently use is procedural rather than technical:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>I maintain a <strong>resource move checklist \/ instruction<\/strong><\/li>\n\n\n\n<li>The instruction explicitly includes steps to <strong>manually reassign missing role assignments<\/strong> after the move<\/li>\n<\/ul>\n\n\n\n<p>While this approach works, it is important to be aware of this limitation to avoid unexpected access issues after migrating resources between subscriptions.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction On a daily basis, I work with resources hosted in Microsoft Azure. From time to time, there is a need to move resources between different Azure subscriptions while staying within the same Entra ID tenant. During one of these moves, I noticed an unexpected behavior related to permissions assigned to managed identities. I decided [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9","post","type-post","status-publish","format-standard","hentry","category-azure"],"_links":{"self":[{"href":"https:\/\/tomaszwojtasik.com\/index.php\/wp-json\/wp\/v2\/posts\/9","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tomaszwojtasik.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tomaszwojtasik.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tomaszwojtasik.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tomaszwojtasik.com\/index.php\/wp-json\/wp\/v2\/comments?post=9"}],"version-history":[{"count":4,"href":"https:\/\/tomaszwojtasik.com\/index.php\/wp-json\/wp\/v2\/posts\/9\/revisions"}],"predecessor-version":[{"id":27,"href":"https:\/\/tomaszwojtasik.com\/index.php\/wp-json\/wp\/v2\/posts\/9\/revisions\/27"}],"wp:attachment":[{"href":"https:\/\/tomaszwojtasik.com\/index.php\/wp-json\/wp\/v2\/media?parent=9"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tomaszwojtasik.com\/index.php\/wp-json\/wp\/v2\/categories?post=9"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tomaszwojtasik.com\/index.php\/wp-json\/wp\/v2\/tags?post=9"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}