You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
**Moving a key vault to another subscription will cause a breaking change to your environment.**
24
23
25
-
Please make sure you understand the impact of this change and follow the guidance in this article carefully before deciding to move key vault to a new subscription.
24
+
Make sure you understand the impact of this change and follow the guidance in this article carefully before deciding to move key vault to a new subscription.
26
25
27
-
When you create a key vault it is automatically tied to the default Azure Active Directory tenant ID for the subscription in which it is created. All access policy entries are also tied to this tenant ID. If you move your Azure subscription from tenant A to tenant B, your existing key vaults will be inaccessible by the service principals (users and applications) in tenant B. To fix this issue, you need to:
26
+
When you create a key vault, it is automatically tied to the default Azure Active Directory tenant ID for the subscription in which it is created. All access policy entries are also tied to this tenant ID. If you move your Azure subscription from tenant A to tenant B, your existing key vaults will be inaccessible by the service principals (users and applications) in tenant B. To fix this issue, you need to:
28
27
29
28
* Change the tenant ID associated with all existing key vaults in the subscription to tenant B.
30
29
* Remove all existing access policy entries.
31
30
* Add new access policy entries associated with tenant B.
32
31
33
32
## Limitations
34
33
35
-
Some service principals (users and applications) are bound to a specific tenant. If you move your key vault to a subscription in another tenant, there is a chance that you will not be able to restore access to a specific service principal. You should check to make sure that all essential service principals exist in the tenant where you are moving your key vault.
34
+
Some service principals (users and applications) are bound to a specific tenant. If you move your key vault to a subscription in another tenant, there is a chance that you will not be able to restore access to a specific service principal. Check to make sure that all essential service principals exist in the tenant where you are moving your key vault.
36
35
37
36
## Design Considerations
38
37
@@ -54,7 +53,7 @@ Make sure that you go to the Azure Policy page on the Azure portal and look at t
54
53
55
54
## Procedure
56
55
57
-
### Initial Steps
56
+
### Initial Steps (Moving Key Vault)
58
57
59
58
1. Log in to the Azure portal
60
59
2. Navigate to your key vault
@@ -68,7 +67,7 @@ Make sure that you go to the Azure Policy page on the Azure portal and look at t
68
67
69
68
### Additional Steps (Post Move)
70
69
71
-
Now that you have moved your key vault to the new subscription, you need to update the tenant id and remove old access policies. Here are tutorials for these steps in Powershell and Azure CLI.
70
+
Now that you have moved your key vault to the new subscription, you need to update the tenant id and remove old access policies. Here are tutorials for these steps in PowerShell and Azure CLI.
72
71
73
72
```azurepowershell
74
73
Select-AzSubscription -SubscriptionId <your-subscriptionId> # Select your Azure Subscription
0 commit comments