{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-127-rebuild-the-scope-contract-when-moving-azure-resources-between-groups/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-127-rebuild-the-scope-contract-when-moving-azure-resources-between-groups/", "slug": "dse-20260909-127-rebuild-the-scope-contract-when-moving-azure-resources-between-groups", "url": "https://update.dsesecurity.com/updates/dse-20260909-127-rebuild-the-scope-contract-when-moving-azure-resources-between-groups/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-127-rebuild-the-scope-contract-when-moving-azure-resources-between-groups.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-127-rebuild-the-scope-contract-when-moving-azure-resources-between-groups/" }, "title": "Rebuild the scope contract when moving Azure resources between groups", "summary": "Review changed resource identifiers and destination governance separately from the resource move itself.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:29:49+00:00", "modified_at": "2026-09-10T00:52:38+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 230, "potentially_affected": "Azure resources moving between resource groups or subscriptions within one Entra tenant.", "dse_recommendation": "Inventory resource-ID dependencies and explicitly reconcile destination tags, role assignments, and policies.", "primary_source": { "name": "Move Azure resources to a new resource group or subscription - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Moving an Azure resource to another resource group or subscription changes its resource ID because that identifier includes the subscription and group. Cross-subscription moves described in this guidance require both subscriptions to belong to the same Entra tenant.

\n

A resource group itself cannot be moved to another subscription. Its resources can move to another group, but the original group’s tags, role assignments, and policies do not automatically transfer to that destination. Microsoft Learn.

\n

Applicability

\n

Identify the exact movable resources and dependencies before scheduling the operation. Separate a same-tenant resource move from a directory transfer or regional relocation; this article does not establish eligibility for those different operations.

\n

DSE recommendation

\n

DSE recommends a before-and-after scope contract listing resource IDs, automation references, destination governance, and accountable owners. Ask the destination owner to approve the intended policy and access state explicitly. Preserve the source settings for comparison, but do not copy privileges without confirming they remain appropriate at the new scope.

\n

Verification

\n

After an approved test move, compare actual resource IDs with the planned references and inspect the destination’s effective assignments and policies. Exercise the relevant automation and workload access paths with authorized and unauthorized identities. Retain exceptions and repair evidence before approving a larger move; resource presence alone should not close the change.

\n

Official references

\n

Microsoft Learn: Move Azure resources to a new resource group or subscription. Source retrieved September 9, 2026.

", "content_text": "Source facts\nMoving an Azure resource to another resource group or subscription changes its resource ID because that identifier includes the subscription and group. Cross-subscription moves described in this guidance require both subscriptions to belong to the same Entra tenant.\nA resource group itself cannot be moved to another subscription. Its resources can move to another group, but the original group’s tags, role assignments, and policies do not automatically transfer to that destination. Microsoft Learn.\nApplicability\nIdentify the exact movable resources and dependencies before scheduling the operation. Separate a same-tenant resource move from a directory transfer or regional relocation; this article does not establish eligibility for those different operations.\nDSE recommendation\nDSE recommends a before-and-after scope contract listing resource IDs, automation references, destination governance, and accountable owners. Ask the destination owner to approve the intended policy and access state explicitly. Preserve the source settings for comparison, but do not copy privileges without confirming they remain appropriate at the new scope.\nVerification\nAfter an approved test move, compare actual resource IDs with the planned references and inspect the destination’s effective assignments and policies. Exercise the relevant automation and workload access paths with authorized and unauthorized identities. Retain exceptions and repair evidence before approving a larger move; resource presence alone should not close the change.\nOfficial references\nMicrosoft Learn: Move Azure resources to a new resource group or subscription. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nMoving an Azure resource to another resource group or subscription changes its resource ID because that identifier includes the subscription and group. Cross-subscription moves described in this guidance require both subscriptions to belong to the same Entra tenant.\n\nA resource group itself cannot be moved to another subscription. Its resources can move to another group, but the original group’s tags, role assignments, and policies do not automatically transfer to that destination. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription).\n\n## Applicability\n\nIdentify the exact movable resources and dependencies before scheduling the operation. Separate a same-tenant resource move from a directory transfer or regional relocation; this article does not establish eligibility for those different operations.\n\n## DSE recommendation\n\nDSE recommends a before-and-after scope contract listing resource IDs, automation references, destination governance, and accountable owners. Ask the destination owner to approve the intended policy and access state explicitly. Preserve the source settings for comparison, but do not copy privileges without confirming they remain appropriate at the new scope.\n\n## Verification\n\nAfter an approved test move, compare actual resource IDs with the planned references and inspect the destination’s effective assignments and policies. Exercise the relevant automation and workload access paths with authorized and unauthorized identities. Retain exceptions and repair evidence before approving a larger move; resource presence alone should not close the change.\n\n## Official references\n\n[Microsoft Learn: Move Azure resources to a new resource group or subscription](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-127-rebuild-the-scope-contract-when-moving-azure-resources-between-groups/", "url": "https://update.dsesecurity.com/updates/dse-20260909-127-rebuild-the-scope-contract-when-moving-azure-resources-between-groups/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-127-rebuild-the-scope-contract-when-moving-azure-resources-between-groups/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Rebuild the scope contract when moving Azure resources between groups", "item": "https://update.dsesecurity.com/updates/dse-20260909-127-rebuild-the-scope-contract-when-moving-azure-resources-between-groups/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-127-rebuild-the-scope-contract-when-moving-azure-resources-between-groups/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-127-rebuild-the-scope-contract-when-moving-azure-resources-between-groups/", "url": "https://update.dsesecurity.com/updates/dse-20260909-127-rebuild-the-scope-contract-when-moving-azure-resources-between-groups/", "headline": "Rebuild the scope contract when moving Azure resources between groups", "description": "Review changed resource identifiers and destination governance separately from the resource move itself.", "abstract": "Review changed resource identifiers and destination governance separately from the resource move itself.", "articleBody": "Source facts\nMoving an Azure resource to another resource group or subscription changes its resource ID because that identifier includes the subscription and group. Cross-subscription moves described in this guidance require both subscriptions to belong to the same Entra tenant.\nA resource group itself cannot be moved to another subscription. Its resources can move to another group, but the original group’s tags, role assignments, and policies do not automatically transfer to that destination. Microsoft Learn.\nApplicability\nIdentify the exact movable resources and dependencies before scheduling the operation. Separate a same-tenant resource move from a directory transfer or regional relocation; this article does not establish eligibility for those different operations.\nDSE recommendation\nDSE recommends a before-and-after scope contract listing resource IDs, automation references, destination governance, and accountable owners. Ask the destination owner to approve the intended policy and access state explicitly. Preserve the source settings for comparison, but do not copy privileges without confirming they remain appropriate at the new scope.\nVerification\nAfter an approved test move, compare actual resource IDs with the planned references and inspect the destination’s effective assignments and policies. Exercise the relevant automation and workload access paths with authorized and unauthorized identities. Retain exceptions and repair evidence before approving a larger move; resource presence alone should not close the change.\nOfficial references\nMicrosoft Learn: Move Azure resources to a new resource group or subscription. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:29:49+00:00", "dateModified": "2026-09-10T00:52:38+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-127-rebuild-the-scope-contract-when-moving-azure-resources-between-groups/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-127-rebuild-the-scope-contract-when-moving-azure-resources-between-groups/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Rebuild the scope contract when moving Azure resources between groups" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 230, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Move Azure resources to a new resource group or subscription - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription" } } ] } }