Rebuild the scope contract when moving Azure resources between groups

Source facts

Moving an Azure resource to another resource group or subscription changes its resource ID because that identifier includes the subscription and group. Cross-subscription moves described in this guidance require both subscriptions to belong to the same Entra tenant.

A resource group itself cannot be moved to another subscription. Its resources can move to another group, but the original group’s tags, role assignments, and policies do not automatically transfer to that destination. Microsoft Learn.

Applicability

Identify the exact movable resources and dependencies before scheduling the operation. Separate a same-tenant resource move from a directory transfer or regional relocation; this article does not establish eligibility for those different operations.

DSE recommendation

DSE recommends a before-and-after scope contract listing resource IDs, automation references, destination governance, and accountable owners. Ask the destination owner to approve the intended policy and access state explicitly. Preserve the source settings for comparison, but do not copy privileges without confirming they remain appropriate at the new scope.

Verification

After an approved test move, compare actual resource IDs with the planned references and inspect the destination’s effective assignments and policies. Exercise the relevant automation and workload access paths with authorized and unauthorized identities. Retain exceptions and repair evidence before approving a larger move; resource presence alone should not close the change.

Official references

Microsoft Learn: Move Azure resources to a new resource group or subscription. Source retrieved September 9, 2026.