You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Move managed identities to another region - Azure AD
3
+
description: Steps involved in getting a managed identity recreated in another region
4
+
services: active-directory
5
+
documentationcenter:
6
+
author: barclayn
7
+
manager: karenhoran
8
+
editor:
9
+
10
+
ms.service: active-directory
11
+
ms.subservice: msi
12
+
ms.topic: how-to
13
+
ms.tgt_pltfrm: na
14
+
ms.workload: identity
15
+
ms.date: 04/13/2022
16
+
ms.author: barclayn
17
+
ms.custom: subject-moving-resources
18
+
19
+
---
20
+
21
+
# Move managed identity for Azure resources across regions
22
+
23
+
There are situations in which you'd want to move your existing user-assigned managed identities from one region to another. For example, you may need to move a solution that uses user-assigned managed identities to another region. You may also want to move an existing identity to another region as part of disaster recovery planning, and testing.
24
+
25
+
Moving User-assigned managed identities across Azure regions is not supported. You can however, recreate a user-assigned managed identity in the target region.
26
+
27
+
## Prerequisites
28
+
29
+
- Permissions to list permissions granted to existing user-assigned managed identity.
30
+
- Permissions to grant a new user-assigned managed identity the required permissions.
31
+
- Permissions to assign a new user-assigned identity to the Azure resources.
32
+
- Permissions to edit Group membership, if your user-assigned managed identity is a member of one or more groups.
33
+
34
+
## Prepare and move
35
+
36
+
1. Copy user-assigned managed identity assigned permissions. You can list [Azure role assignments](../../role-based-access-control/role-assignments-list-powershell.md) but that may not be enough depending on how permissions were granted to the user-assigned managed identity. You should confirm that your solution doesn't depend on permissions granted using a service specific option.
37
+
1. Create a [new user-assigned managed identity](how-manage-user-assigned-managed-identities.md?pivots=identity-mi-methods-powershell#create-a-user-assigned-managed-identity-2) at the target region.
38
+
1. Grant the managed identity the same permissions as the original identity that it's replacing, including Group membership. You can review [Assign Azure roles to a managed identity](../../role-based-access-control/role-assignments-portal-managed-identity.md), and [Group membership](../../active-directory/fundamentals/active-directory-groups-view-azure-portal.md).
39
+
1. Specify the new identity in the properties of the resource instance that uses the newly created user assigned managed identity.
40
+
41
+
## Verify
42
+
43
+
After reconfiguring your service to use your new managed identities in the target region, you need to confirm that all operations have been restored.
44
+
45
+
## Clean up
46
+
47
+
Once that you confirm your service is back online, you can proceed to delete any resources in the source region that you no longer use.
48
+
49
+
## Next steps
50
+
51
+
In this tutorial, you took the steps needed to recreate a user-assigned managed identity in a new region.
| Azure Policy |[Remediate non-compliant resources with Azure Policy](../../governance/policy/how-to/remediate-resources.md)|
60
-
|Azure Purview |[Credentials for source authentication in Azure Purview](../../purview/manage-credentials.md)|
60
+
|Microsoft Purview |[Credentials for source authentication in Microsoft Purview](../../purview/manage-credentials.md)|
61
61
| Azure Resource Mover | [Move resources across regions (from resource group)](../../resource-mover/move-region-within-resource-group.md)
62
62
| Azure Site Recovery |[Replicate machines with private endpoints](../../site-recovery/azure-to-azure-how-to-enable-replication-private-endpoints.md#enable-the-managed-identity-for-the-vault)|
63
63
| Azure Search |[Set up an indexer connection to a data source using a managed identity](../../search/search-howto-managed-identities-data-sources.md)|
Copy file name to clipboardExpand all lines: articles/active-directory/roles/security-planning.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ keywords:
7
7
author: rolyon
8
8
manager: karenhoran
9
9
ms.author: rolyon
10
-
ms.date: 11/04/2021
10
+
ms.date: 04/19/2022
11
11
ms.topic: conceptual
12
12
ms.service: active-directory
13
13
ms.workload: identity
@@ -110,7 +110,7 @@ Evaluate the accounts that are assigned or eligible for the Global Administrator
110
110
111
111
#### Turn on multi-factor authentication and register all other highly privileged single-user non-federated administrator accounts
112
112
113
-
Require Azure AD Multi-Factor Authentication (MFA) at sign-in for all individual users who are permanently assigned to one or more of the Azure AD administrator roles: Global Administrator, Privileged Role Administrator, Exchange Administrator, and SharePoint Administrator. Use the guide to enable [Multi-factor Authentication (MFA) for your administrator accounts](../authentication/howto-mfa-userstates.md) and ensure that all those users have registered at [https://aka.ms/mfasetup](https://aka.ms/mfasetup). More information can be found under step 2 and step 3 of the guide [Protect access to data and services in Microsoft 365](https://support.office.com/article/Protect-access-to-data-and-services-in-Office-365-a6ef28a4-2447-4b43-aae2-f5af6d53c68e).
113
+
Require Azure AD Multi-Factor Authentication (MFA) at sign-in for all individual users who are permanently assigned to one or more of the Azure AD administrator roles: Global Administrator, Privileged Role Administrator, Exchange Administrator, and SharePoint Administrator. Use the guidance at [Enforce multifactor authentication on your administrators](../authentication/how-to-authentication-find-coverage-gaps.md#enforce-multifactor-authentication-on-your-administrators) and ensure that all those users have registered at [https://aka.ms/mfasetup](https://aka.ms/mfasetup). More information can be found under step 2 and step 3 of the guide [Protect user and device access in Microsoft 365](/microsoft-365/compliance/protect-access-to-data-and-services).
Copy file name to clipboardExpand all lines: articles/api-management/api-management-using-with-internal-vnet.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -66,7 +66,7 @@ After successful deployment, you should see your API Management service's **priv
66
66
67
67
### Enable connectivity using a Resource Manager template (`stv2` platform)
68
68
69
-
* Azure Resource Manager [template](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.apimanagement/api-management-create-with-internal-vnet-publicip) (API version 2021-01-01-preview )
69
+
* Azure Resource Manager [template](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.apimanagement/api-management-create-with-internal-vnet-publicip) (API version 2021-08-01 )
70
70
71
71
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Fazure-quickstart-templates%2Fmaster%2Fquickstarts%2Fmicrosoft.apimanagement%2Fapi-management-create-with-internal-vnet-publicip%2Fazuredeploy.json)
Copy file name to clipboardExpand all lines: articles/api-management/api-management-using-with-vnet.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -53,7 +53,7 @@ It can take 15 to 45 minutes to update the API Management instance. The Develope
53
53
54
54
### Enable connectivity using a Resource Manager template (`stv2` compute platform)
55
55
56
-
* Azure Resource Manager [template](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.apimanagement/api-management-create-with-external-vnet-publicip) (API version 2021-01-01-preview)
56
+
* Azure Resource Manager [template](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.apimanagement/api-management-create-with-external-vnet-publicip) (API version 2021-08-01)
57
57
58
58
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Fazure-quickstart-templates%2Fmaster%2Fquickstarts%2Fmicrosoft.apimanagement%2Fapi-management-create-with-external-vnet-publicip%2Fazuredeploy.json)
Audit logs are secure, immutable, timestamped records of discrete events that happened over time. These logs capture important events that may affect the functionality of your attestation instance.
16
+
If you create one or more Azure Attestation resources, you’ll want to monitor how and when your attestation instance is accessed, and by whom. You can do this by enabling logging for Microsoft Azure Attestation, which saves information in an Azure storage account you provide.
17
17
18
-
Azure Attestation manages attestation instances and the policies associated with them. Actions associated with instance management and policy changes are audited and logged.
18
+
Logging information will be available up to 10 minutes after the operation occurred (in most cases, it will be quicker than this). Since you provide the storage account, you can secure your logs via standard Azure access controls and delete logs you no longer want to keep in your storage account.
19
19
20
-
This article contains information on the events that are logged, the information collected, and the location of these logs.
20
+
## Interpret your Azure Attestation logs
21
21
22
-
## About Audit logs
22
+
When logging is enabled, up to three containers may be automatically created for you in your specified storage account: **insights-logs-auditevent, insights-logs-operational, insights-logs-notprocessed**. It is recommended to only use **insights-logs-operational** and **insights-logs-notprocessed**. **insights-logs-auditevent** was created to provide early access to logs for customers using VBS. Future enhancements to logging will occur in the **insights-logs-operational** and **insights-logs-notprocessed**.
23
23
24
-
Azure Attestation uses code to produce audit logs for events that affect the way attestation is performed. This typically boils down to how or when policy changes are made to your attestation instance as well as some admin actions.
24
+
**Insights-logs-operational** contains generic information across all TEE types.
25
25
26
-
### Auditable Events
27
-
Here are some of the audit logs we collect:
26
+
**Insights-logs-notprocessed** contains requests which the service was unable to process, typically due to malformed HTTP headers, incomplete message bodies, or similar issues.
| Create Instance | Creates a new instance of an attestation service. |
32
-
| Destroy Instance | Destroys an instance of an attestation service. |
33
-
| Add Policy Certificate | Addition of a certificate to the current set of policy management certificates. |
34
-
| Remove Policy Certificate | Remove a certificate from the current set of policy management certificates. |
35
-
| Set Current Policy | Sets the attestation policy for a given TEE type. |
36
-
| Reset Attestation Policy | Resets the attestation policy for a given TEE type. |
37
-
| Prepare to Update Policy | Prepare to update attestation policy for a given TEE type. |
38
-
| Rehydrate Tenants After Disaster | Re-seals all of the attestation tenants on this instance of the attestation service. This can only be performed by Attestation Service admins. |
28
+
Individual blobs are stored as text, formatted as a JSON blob. Let’s look at an example log entry:
39
29
40
-
### Collected information
41
-
For each of these events, Azure Attestation collects the following information:
42
30
43
-
- Operation Name
44
-
- Operation Success
45
-
- Operation Caller, which could be any of the following:
46
-
- Azure AD UPN
47
-
- Object ID
48
-
- Certificate
49
-
- Azure AD Tenant ID
50
-
- Operation Target, which could be any of the following:
51
-
- Environment
52
-
- Service Region
53
-
- Service Role
54
-
- Service Role Instance
55
-
- Resource ID
56
-
- Resource Region
31
+
```json
32
+
{
33
+
"Time": "2021-11-03T19:33:54.3318081Z",
34
+
"resourceId": "/subscriptions/<subscription ID>/resourceGroups/<resource group name>/providers/Microsoft.Attestation/attestationProviders/<instance name>",
Most of these fields are documented in the [Top-level common schema](/azure-monitor/essentials/resource-logs-schema#top-level-common-schema). The following table lists the field names and descriptions for the entries not included in the top-level common schema:
59
69
60
-
Audit logs are provided in JSON format. Here is an example of what an audit log may look like.
| failureResourceId | Resource ID of component which resulted in request failure |
80
+
| failureCategory | Broad category indicating category of a request failure. Includes categories such as AzureNetworkingPhysical, AzureAuthorization etc. |
81
+
| failureDetails | Detailed information about a request failure, if available |
82
+
| infoDataReceived | Information about the request received from the client. Includes some HTTP headers, the number of headers received, the content type and content length |
83
+
84
+
## Next steps
85
+
-[How to enable Microsoft Azure Attestation logging ](azure-diagnostic-monitoring.md)
0 commit comments