Move File Sync and storage resources with their tenant relationship intact

Source facts

Microsoft warns that placing the Storage Sync Service and associated storage accounts under different Entra tenants is unsupported, even if synchronization initially appears to work. When moving tenants, the guide requires sync and storage resources to move together. It says relevant RBAC assignments do not migrate with moved storage resources and sync access must be reauthorized. Microsoft Learn

Applicability

This review is for an Azure File Sync resource-group, subscription, or tenant move that could change the administrative relationship between synchronization and storage resources.

DSE recommendation

DSE recommends building one inventory of the Storage Sync Service, associated storage accounts, subscriptions, and governing tenants before the move. Have the identity and storage owners approve the target relationship and reauthorization plan together. Keep application availability during the transition in the change plan, and define how access will be restored if the move stops synchronization. Do not use a momentary successful sync as approval for an unsupported target arrangement.

Verification

After the authorized move, inspect the tenant and subscription of every related top-level resource. Verify the required sync authorization and a controlled synchronization operation. Record the final relationship and any missing permission as explicit evidence, and resolve an unsupported split before considering the move complete.

Official references

• Microsoft: Azure File Sync Resource Moves and Topology Changes | Microsoft Learn