CODEWITHSUNDEEP
azureazure-active-directory
kagarlickij
kagarlickij

Reputation: 8127

Azure subscription migration to new tenant: save RBAC

I need to migrate Azure subscription to new tenant (Azure AD)
According to documentation and similar questions RBAC has to be set from scratch again
Is there any way to automate it? Export Subscription's IAM rules and import them to new one?

Upvotes: 2

Views: 181

Answers (1)

Martin Brandl
Martin Brandl

Reputation: 58981

I might be wrong, but: I guess the answer is no since the users within the RBAC definition must be stored using the AAD Object Id (because the e-mail may change). So I think this is technically impossible (at least without some kind of manual mapping).

However, you might be able to create a mapping by retrieving all users from TenantX and from TenantY and perform the user mapping based on some properties. Then you could use the Get-AzureRmRoleAssignment cmdlet to retrieve the RBAC rules, store it somewhere (e. g. as JSON), change the directory and then re-apply the RBAC rules with changed ObjectIds using the New-AzureRmRoleAssignment cmdlet.

Upvotes: 2

Related Questions