Treat an Azure subscription directory transfer as an identity rebuild

Source facts

Transferring a subscription to another Entra directory permanently removes its source-directory Azure RBAC role assignments and custom roles; they do not transfer to the target directory. Microsoft warns that the original role assignments cannot be restored after the transfer.

Microsoft also warns of potentially unrecoverable outcomes when encrypted resources depend on a key vault being transferred. Its impact list is not comprehensive, and some transfers require downtime. This is not a routine resource-group move. Microsoft Learn.

Applicability

Use this as a pre-transfer stop check, not a complete transfer procedure. Inventory the subscription’s actual services and identities, and establish whether its subscription type supports changing directories before planning execution.

DSE recommendation

DSE recommends an owner-approved reconstruction plan for required roles and identities, plus a separate assessment of every encryption-key dependency. Do not authorize the transfer while either inventory is incomplete. Require service owners to identify additional dependencies beyond the documentation’s examples, and agree on a maintenance and recovery plan appropriate to the actual workloads.

Verification

Before production approval, review exported role definitions and assignments, target identities, and the key-dependency map with their owners. Rehearse applicable service recovery in an isolated representative environment. Record unresolved dependencies as blockers rather than assuming a reverse directory change will restore the old authorization state.

Official references

Microsoft Learn: Transfer an Azure subscription to a different Microsoft Entra directory. Source retrieved September 9, 2026.