Moving Azure App Service resources from one subscription to another subscription

As a follow up to my previous post:

Moving an Azure virtual machine and the Recovery Services Vault with its backups from one subscription to another
https://blog.terenceluk.com/2021/04/moving-azure-virtual-machine-and.html

I would like to continue to demonstrate and outline the process of moving App Service and Azure Functions from one subscription to another.

Microsoft Documentation

As always, I would like to provide the following links to the official Microsoft documentation and recommend that anyone undertaking this task ready through them.

Move resources to a new resource group or subscription
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription

Move operation support for resources
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources

Move guidance for App Service resources
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-limitations/app-service-move-limitations

Note that improvements for these cross subscription move operations are continued to be made so the behavior demonstrated below were performed in April 2021. An example of a change since 2020 is that Microsoft.Web/Certificates can now be moved.

Different behavior during Subscription to Subscription Move

I’ve found that the subscription to subscription move operation changes depending on when you run it.

One of them will run a validation check prior then stopping to allow you to initiate it. The second will run the validation and upon successfully completing it will automatically initiate the move. There does not appear to be any consistency in which is presented but the GUI will be different so it is best to assume that you will not get the option to initiate the move.

This is the GUI that would stop after validation and allow you to manually initiate the move:

This is the GUI that would automatically initiate the move upon a successful validation:

Subscription to Subscription Move Blockers (Validation errors)

You cannot move an App Service without the associated App Service Plan:

I understand that tools and scripts associated with moved resources will not work until I update them to use new resource IDs

Attempting to migrate the App Service without its corresponding App Service Plan will fail with:

{“code”:”ResourceMoveProviderValidationFailed”,”message”:”Resource move validation failed. Please see details. Diagnostic information: timestamp ‘20210426T203719Z’, subscription id ‘b0957dbf-1cad-4e5e-9360-341ccc197953′, tracking id ’53ba79fa-d2cf-4e59-b40c-7fa8067d58f2’, request correlation id ‘88065feb-7ee2-45cc-935d-560b90ad7d73’.”,”details”:[{“code”:”ResourceMoveProviderValidationFailed”,”target”:”Microsoft.Web/sites”,”message”:”{“Code”:”BadRequest”,”Message”:”Please select all the Microsoft.Web resources from ‘RG-VMs’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘RG-VMs’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together: Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-806a (Microsoft.Web/serverFarms)\r\n. Please check this link for more information: https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-App-Ser/troubleshoot”,”Target”:null,”Details”:[{“Message”:”Please select all the Microsoft.Web resources from ‘RG-VMs’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘RG-VMs’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together: Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-806a (Microsoft.Web/serverFarms)\r\n. Please check this link for more information: https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-App-Ser/troubleshoot”},{“Code”:”BadRequest”},{“ErrorEntity”:{“ExtendedCode”:”52036″,”MessageTemplate”:”Please select all the Microsoft.Web resources from ‘{0}’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘{1}’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together:{2}. Please check this link for more information: {3}”,”Parameters”:[“RG-VMs”,”RG-VMs”,” Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-806a (Microsoft.Web/serverFarms)\r\n”,”https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-App-Ser/troubleshoot”,”0″],”Code”:”BadRequest”,”Message”:”Please select all the Microsoft.Web resources from ‘RG-VMs’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘RG-VMs’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together: Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-806a (Microsoft.Web/serverFarms)\r\n. Please check this link for more information: https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-App-Ser/troubleshoot”}}],”Innererror”:null}”}]}

To successfully migrate the App Service, select the corresponding App Service Plan:

Note that the interface below is the one that automatically moves the resource when the validation completes. You cannot stop once the validation starts so proceed with caution to avoid unintended moves.

—————————————————————————————————————————-

You cannot move App Service resources if they have been moved from the original resource group they were originally created in. The example provided below displays an error message when the App Service and its resources was created in RG-VMs but later moved to RG-SQLDatabases. To correct this issue, simply move the resources back to the original resource group, then move it to the target subscription:

{“code”:”ResourceMoveProviderValidationFailed”,”message”:”Resource move validation failed. Please see details. Diagnostic information: timestamp ‘20210426T212111Z’, subscription id ‘b0957dbf-1cad-4e5e-9360-341ccc197953’, tracking id ‘b993a16b-4362-4997-b494-35df505256ab’, request correlation id ‘28624067-966e-4527-a5a4-4461e48e4381’.”,”details”:[{“code”:”ResourceMoveProviderValidationFailed”,”target”:”Microsoft.Web/serverFarms”,”message”:”{“Code”:”BadRequest”,”Message”:”Please select all the Microsoft.Web resources from ‘RG-SQLDatabases’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘Rg-Dest’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together: Test-App-Ser (Microsoft.Web/sites). This resource is located in resource group ‘RG-SQLDatabases’, but hosted in the resource group ‘RG-VMs’. This may be a result of prior move operations. Move it back to respective hosting resource group\r\n ASP-RGVMs-806a (Microsoft.Web/serverFarms). This resource is located in resource group ‘RG-SQLDatabases’, but hosted in the resource group ‘RG-VMs’. This may be a result of prior move operations. Move it back to respective hosting resource group\r\n. Please check this link for more information: https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-SQLDatabases/providers/Microsoft.Web/sites/Test-App-Ser/troubleshoot”,”Target”:null,”Details”:[{“Message”:”Please select all the Microsoft.Web resources from ‘RG-SQLDatabases’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘Rg-Dest’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together: Test-App-Ser (Microsoft.Web/sites). This resource is located in resource group ‘RG-SQLDatabases’, but hosted in the resource group ‘RG-VMs’. This may be a result of prior move operations. Move it back to respective hosting resource group\r\n ASP-RGVMs-806a (Microsoft.Web/serverFarms). This resource is located in resource group ‘RG-SQLDatabases’, but hosted in the resource group ‘RG-VMs’. This may be a result of prior move operations. Move it back to respective hosting resource group\r\n. Please check this link for more information: https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-SQLDatabases/providers/Microsoft.Web/sites/Test-App-Ser/troubleshoot”},{“Code”:”BadRequest”},{“ErrorEntity”:{“ExtendedCode”:”52036″,”MessageTemplate”:”Please select all the Microsoft.Web resources from ‘{0}’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘{1}’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together:{2}. Please check this link for more information: {3}”,”Parameters”:[“RG-SQLDatabases”,”Rg-Dest”,” Test-App-Ser (Microsoft.Web/sites). This resource is located in resource group ‘RG-SQLDatabases’, but hosted in the resource group ‘RG-VMs’. This may be a result of prior move operations. Move it back to respective hosting resource group\r\n ASP-RGVMs-806a (Microsoft.Web/serverFarms). This resource is located in resource group ‘RG-SQLDatabases’, but hosted in the resource group ‘RG-VMs’. This may be a result of prior move operations. Move it back to respective hosting resource group\r\n”,”https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-SQLDatabases/providers/Microsoft.Web/sites/Test-App-Ser/troubleshoot”,”0″],”Code”:”BadRequest”,”Message”:”Please select all the Microsoft.Web resources from ‘RG-SQLDatabases’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘Rg-Dest’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together: Test-App-Ser (Microsoft.Web/sites). This resource is located in resource group ‘RG-SQLDatabases’, but hosted in the resource group ‘RG-VMs’. This may be a result of prior move operations. Move it back to respective hosting resource group\r\n ASP-RGVMs-806a (Microsoft.Web/serverFarms). This resource is located in resource group ‘RG-SQLDatabases’, but hosted in the resource group ‘RG-VMs’. This may be a result of prior move operations. Move it back to respective hosting resource group\r\n. Please check this link for more information: https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-SQLDatabases/providers/Microsoft.Web/sites/Test-App-Ser/troubleshoot”}}],”Innererror”:null}”}]}

One of the questions I’ve been asked in the past is if an App service can be moved to another RG and then have the original RG deleted? I’ve done a test and it appears this is not possible.

—————————————————————————————————————————-

You cannot move App Service resources into another subscription’s resource group that already has a App Service (Microsoft.Web) resources as the following error message will be displayed:

{“code”:”ResourceMoveProviderValidationFailed”,”message”:”Resource move validation failed. Please see details. Diagnostic information: timestamp ‘20210426T213019Z’, subscription id ‘b0957dbf-1cad-4e5e-9360-341ccc197953’, tracking id ‘1d510c1c-d21c-423b-8fc9-6066aae13dec’, request correlation id ‘b06e6675-4e1c-4de9-9796-fe99d874187e’.”,”details”:[{“code”:”ResourceMoveProviderValidationFailed”,”target”:”Microsoft.Web/serverFarms”,”message”:”{“Code”:”BadRequest”,”Message”:”Please select all the Microsoft.Web resources from ‘RG-VMs’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘RG-VMs’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together: Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-806a (Microsoft.Web/serverFarms)\r\n. Please check this link for more information: https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-App-Ser/troubleshoot”,”Target”:null,”Details”:[{“Message”:”Please select all the Microsoft.Web resources from ‘RG-VMs’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘RG-VMs’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together: Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-806a (Microsoft.Web/serverFarms)\r\n. Please check this link for more information: https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-App-Ser/troubleshoot”},{“Code”:”BadRequest”},{“ErrorEntity”:{“ExtendedCode”:”52036″,”MessageTemplate”:”Please select all the Microsoft.Web resources from ‘{0}’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘{1}’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together:{2}. Please check this link for more information: {3}”,”Parameters”:[“RG-VMs”,”RG-VMs”,” Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-806a (Microsoft.Web/serverFarms)\r\n”,”https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-App-Ser/troubleshoot”,”0″],”Code”:”BadRequest”,”Message”:”Please select all the Microsoft.Web resources from ‘RG-VMs’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘RG-VMs’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together: Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-806a (Microsoft.Web/serverFarms)\r\n. Please check this link for more information: https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-App-Ser/troubleshoot”}}],”Innererror”:null}”}]}

Note that you cannot simply move the App Service resources out of the target subscription’s destination resource group and then proceed to repeat the move of the App Service resources from the source subscription because the App Service moved out of the resource group will still be hosted in that resource group. The only way around this if is to delete the App Service in the target subscription’s target resource group.

—————————————————————————————————————————-

You cannot an Azure Function in a resource group that contains another App Service without moving it together. You need to move all Microsoft.Web resources in the resource of the Azure Function or App Service that is being moved.

{“code”:”ResourceMoveProviderValidationFailed”,”target”:”Microsoft.Web/serverFarms”,”message”:”{“Code”:”BadRequest”,”Message”:”Please select all the Microsoft.Web resources from ‘RG-VMs’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘RG-VMs’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together: Test-Function-App001 (Microsoft.Web/sites)\r\n Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-ba9d (Microsoft.Web/serverFarms)\r\n ASP-RGVMs-bc50 (Microsoft.Web/serverFarms)\r\n. Please check this link for more information: https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-Function-App001/troubleshoot”,”Target”:null,”Details”:[{“Message”:”Please select all the Microsoft.Web resources from ‘RG-VMs’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘RG-VMs’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together: Test-Function-App001 (Microsoft.Web/sites)\r\n Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-ba9d (Microsoft.Web/serverFarms)\r\n ASP-RGVMs-bc50 (Microsoft.Web/serverFarms)\r\n. Please check this link for more information: https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-Function-App001/troubleshoot”},{“Code”:”BadRequest”},{“ErrorEntity”:{“ExtendedCode”:”52036″,”MessageTemplate”:”Please select all the Microsoft.Web resources from ‘{0}’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘{1}’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together:{2}. Please check this link for more information: {3}”,”Parameters”:[“RG-VMs”,”RG-VMs”,” Test-Function-App001 (Microsoft.Web/sites)\r\n Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-ba9d (Microsoft.Web/serverFarms)\r\n ASP-RGVMs-bc50 (Microsoft.Web/serverFarms)\r\n”,”https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-Function-App001/troubleshoot”,”0″],”Code”:”BadRequest”,”Message”:”Please select all the Microsoft.Web resources from ‘RG-VMs’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘RG-VMs’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together: Test-Function-App001 (Microsoft.Web/sites)\r\n Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-ba9d (Microsoft.Web/serverFarms)\r\n ASP-RGVMs-bc50 (Microsoft.Web/serverFarms)\r\n. Please check this link for more information: https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-Function-App001/troubleshoot”}}],”Innererror”:null}”}

Note how the resource group contains other App Service and Azure Function resources that need to be moved together.

Failing to select the Test-App-Ser App Service will continue to fail the validation:

Validation will be successful when the Test-App-Ser App Service is selected for move:

—————————————————————————————————————————-

You cannot move an App Service that has an uploaded but unbinded SSL certificate to another subscription:

The following App Service currently does not have a certificate uploaded:

Here I have uploaded a certificate via the TLS/SSL settings:

Notice how attempting to move the App Service with the certificate uploaded but not binded will fail the validation checks:

{“code”:”ResourceMoveProviderValidationFailed”,”target”:”Microsoft.Web/serverFarms”,”message”:”{“Code”:”BadRequest”,”Message”:”Please select all the Microsoft.Web resources from ‘RG-VMs’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘RG-VMs’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together: Test-Function-App001 (Microsoft.Web/sites)\r\n Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-ba9d (Microsoft.Web/serverFarms)\r\n ASP-RGVMs-bc50 (Microsoft.Web/serverFarms)\r\n 522312DA8771ED22F143DC297BF75F9C8EAF171E-RG-VMs-CanadaCentralwebspace (Microsoft.Web/certificates)\r\n. Please check this link for more information: https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/22d77ef8-89c3-40c2-8730-e786114770a0/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-Function-App001/troubleshoot”,”Target”:null,”Details”:[{“Message”:”Please select all the Microsoft.Web resources from ‘RG-VMs’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘RG-VMs’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together: Test-Function-App001 (Microsoft.Web/sites)\r\n Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-ba9d (Microsoft.Web/serverFarms)\r\n ASP-RGVMs-bc50 (Microsoft.Web/serverFarms)\r\n 522312DA8771ED22F143DC297BF75F9C8EAF171E-RG-VMs-CanadaCentralwebspace (Microsoft.Web/certificates)\r\n. Please check this link for more information: https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/22d77ef8-89c3-40c2-8730-e786114770a0/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-Function-App001/troubleshoot”},{“Code”:”BadRequest”},{“ErrorEntity”:{“ExtendedCode”:”52036″,”MessageTemplate”:”Please select all the Microsoft.Web resources from ‘{0}’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘{1}’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together:{2}. Please check this link for more information: {3}”,”Parameters”:[“RG-VMs”,”RG-VMs”,” Test-Function-App001 (Microsoft.Web/sites)\r\n Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-ba9d (Microsoft.Web/serverFarms)\r\n ASP-RGVMs-bc50 (Microsoft.Web/serverFarms)\r\n 522312DA8771ED22F143DC297BF75F9C8EAF171E-RG-VMs-CanadaCentralwebspace (Microsoft.Web/certificates)\r\n”,”https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/22d77ef8-89c3-40c2-8730-e786114770a0/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-Function-App001/troubleshoot”,”0″],”Code”:”BadRequest”,”Message”:”Please select all the Microsoft.Web resources from ‘RG-VMs’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘RG-VMs’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together: Test-Function-App001 (Microsoft.Web/sites)\r\n Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-ba9d (Microsoft.Web/serverFarms)\r\n ASP-RGVMs-bc50 (Microsoft.Web/serverFarms)\r\n 522312DA8771ED22F143DC297BF75F9C8EAF171E-RG-VMs-CanadaCentralwebspace (Microsoft.Web/certificates)\r\n. Please check this link for more information: https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/22d77ef8-89c3-40c2-8730-e786114770a0/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-Function-App001/troubleshoot”}}],”Innererror”:null}“}

In order to move the App Service, we will need to move the certificate as well but the certificate object is not displayed in the resource group because it is a hidden resource. Begin by obtaining the certificate name by opening the properties of it in the TLS/SSL settings:

Navigate to the resource group that contains the App Service, enable the Show hidden types option and locate the microsoft.web/certificates object with the name that matches what is displayed in the Certificate Details:

Note that you can click into the certificate object to view its properties to confirm the name and other properties:

With the certificate selected, you can now proceed to migrate the App Service resource to another subscription.

Note that I selected the Azure Function because you have to move all microsoft.web resources within the resource group.

The validation should successfully complete so the subscription move can start:

Note that you cannot move a certificate on its own even if it is not binded. The following is the error displayed if a certificate is moved on its own:

{“code”:”ResourceMoveProviderValidationFailed”,”message”:”Resource move validation failed. Please see details. Diagnostic information: timestamp ‘20210427T010342Z’, subscription id ‘b0957dbf-1cad-4e5e-9360-341ccc197953’, tracking id ‘a40dbd4b-28af-4f44-b150-e6b269c10592’, request correlation id ‘2af61d8a-ab6a-476c-b024-e191d758009c’.”,”details”:[{“code”:”ResourceMoveProviderValidationFailed”,”target”:”Microsoft.Web/certificates”,”message”:”{“Code”:”BadRequest”,”Message”:”Please select all the Microsoft.Web resources from ‘RG-VMs’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘Rg-Dest’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together: Test-Function-App001 (Microsoft.Web/sites)\r\n Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-ba9d (Microsoft.Web/serverFarms)\r\n ASP-RGVMs-bc50 (Microsoft.Web/serverFarms)\r\n 522312DA8771ED22F143DC297BF75F9C8EAF171E-RG-VMs-CanadaCentralwebspace (Microsoft.Web/certificates)\r\n. Please check this link for more information: https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-Function-App001/troubleshoot”,”Target”:null,”Details”:[{“Message”:”Please select all the Microsoft.Web resources from ‘RG-VMs’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘Rg-Dest’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together: Test-Function-App001 (Microsoft.Web/sites)\r\n Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-ba9d (Microsoft.Web/serverFarms)\r\n ASP-RGVMs-bc50 (Microsoft.Web/serverFarms)\r\n 522312DA8771ED22F143DC297BF75F9C8EAF171E-RG-VMs-CanadaCentralwebspace (Microsoft.Web/certificates)\r\n. Please check this link for more information: https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-Function-App001/troubleshoot”},{“Code”:”BadRequest”},{“ErrorEntity”:{“ExtendedCode”:”52036″,”MessageTemplate”:”Please select all the Microsoft.Web resources from ‘{0}’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘{1}’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together:{2}. Please check this link for more information: {3}”,”Parameters”:[“RG-VMs”,”Rg-Dest”,” Test-Function-App001 (Microsoft.Web/sites)\r\n Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-ba9d (Microsoft.Web/serverFarms)\r\n ASP-RGVMs-bc50 (Microsoft.Web/serverFarms)\r\n 522312DA8771ED22F143DC297BF75F9C8EAF171E-RG-VMs-CanadaCentralwebspace (Microsoft.Web/certificates)\r\n”,”https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-Function-App001/troubleshoot”,”0″],”Code”:”BadRequest”,”Message”:”Please select all the Microsoft.Web resources from ‘RG-VMs’ resource group for cross-subscription migration. Also, please ensure destination resource group ‘Rg-Dest’ doesn’t have any Microsoft.Web resources before move operation. Here is the list of resources you have to move together: Test-Function-App001 (Microsoft.Web/sites)\r\n Test-App-Ser (Microsoft.Web/sites)\r\n ASP-RGVMs-ba9d (Microsoft.Web/serverFarms)\r\n ASP-RGVMs-bc50 (Microsoft.Web/serverFarms)\r\n 522312DA8771ED22F143DC297BF75F9C8EAF171E-RG-VMs-CanadaCentralwebspace (Microsoft.Web/certificates)\r\n. Please check this link for more information: https://portal.azure.com/?websitesextension_ext=asd.featurePath%3Ddetectors%2FMigration#resource/subscriptions/b0957dbf-1cad-4e5e-9360-341ccc197953/resourceGroups/RG-VMs/providers/Microsoft.Web/sites/Test-Function-App001/troubleshoot”}}],”Innererror”:null}”}]}

Subscription to Subscription Move Possibilities

You can move App Service resources with other types of resources. The following demonstrates how the resources App Service, Function App, VM, VNet, Storage account, and RSV can all be moved in one operation:

—————————————————————————————————————————

You can move a App Service with a custom domain configured and a SSL certificate binded as long as all the resources are moved together:

—————————————————————————————————————————-

Having a VNet configured for the App Service (VNet Integration) does not stop you from migrating the App Service to another subscription. This essentially means that You can move the App Service and App Plan without removing VNet integration even if the VNet is still in the source subscription. I’ve also noticed that it is possible to assign a VNet and subnet from another subscription (cross subscriptions) when configuring VNet integration for an App Service.

With the above said, I have not been able to test whether VNet integration would continue to work so if anyone reading this post has experience with this, please leave a comment.

Hope this helps anyone who may be looking for more information about what the migration of App Services and other related resources from one subscription to another would look like.