Merge Azure subscriptions and Entra tenants without losing governance
CloudServus moves Azure subscriptions into the right Microsoft Entra directory, rebuilds what the transfer breaks, and realigns governance so acquisitions and divestitures don't leave resources ungoverned.
Talk to an Expert →What moves when you merge Azure tenants
The core mechanism is a subscription transfer: moving an Azure subscription from its current Microsoft Entra directory into a different one, usually the acquiring company's. Organizations do this after a merger or acquisition, during a divestiture split, or to consolidate subscriptions that different teams created on their own. It's not a light operation. Microsoft treats it as a complex process that needs planning up front, and some scenarios require downtime to complete. CSP subscriptions can't change directory at all, so those need a different path.
The transfer itself only moves the subscription's resources. It does not carry over role assignments or custom RBAC roles, which Azure permanently deletes from the source directory. Managed identities, both system- and user-assigned, stop working and have to be disabled, re-created, or reattached. Key Vault access policies need their tenant ID updated and their policies rebuilt. None of this is optional cleanup. Skip it and the resources land in the new directory with no one able to manage them.
How we run the consolidation
Subscription transfer and access rebuild
- Directory transfer: move the subscription into the target Microsoft Entra directory, planned around the workloads that can't tolerate downtime
- RBAC rebuild: re-create role assignments and custom roles after the transfer wipes them, mapped to the correct users and groups in the target directory
- Managed identity reset: disable and re-enable system-assigned identities, re-create user-assigned ones, and reattach the role assignments they depended on
Resources that don't transfer cleanly
- Can't move directly: AKS clusters, Azure Databricks workspaces, Microsoft Entra Domain Services, and Dev Box or Deployment Environments have to be re-created in the target directory
- Blocked by Entra authentication: Azure SQL, Database for MySQL, and PostgreSQL Flexible Server instances with Entra authentication enabled won't transfer until that feature is disabled first
- Azure Policy: definitions, assignments, exemptions, and compliance history don't carry over. We export, re-import, and re-assign them at the right scope
Entra tenant consolidation
- Cross-tenant synchronization to automatically provision and de-provision B2B collaboration users across tenants during the transition, instead of manual guest invites
- Multitenant organization capabilities in Microsoft Entra ID to bridge Teams and Microsoft 365 collaboration between the two organizations before a full merge lands
- B2B direct connect where a mutual two-way trust is enough, without moving either tenant's directory
Governance realignment
- Management group placement so transferred subscriptions inherit the right policy and access baseline instead of sitting ungoverned at the root
- Policy re-assignment at the correct scope once the subscription lands in its new directory
- Subscription transfer policy configured if your organization needs to block or control future transfers
Rebuilding governance after the transfer
Azure Policy doesn't travel with a subscription transfer. Definitions, assignments, exemptions, and the compliance history behind them stay in the source directory. We treat that as a rebuild task: export what's assigned, decide what still applies under the target organization's standards, and re-assign it at the management group or subscription scope where it belongs.
That's also the point to fix the management group hierarchy instead of copying it as-is. Following Microsoft's Cloud Adoption Framework landing zone model, subscriptions get placed under the management groups that already carry the target organization's policy and RBAC baseline, so newly merged resources inherit real governance from day one instead of landing at the root with none.
When a full tenant merge isn't the right call
A straight subscription transfer isn't always the answer. Azure Lighthouse lets you delegate access to resources in one directory to users in another, without moving the subscription itself. That avoids the downtime a transfer can require and sidesteps the resources that can't transfer at all. It's a fit for staged integrations, minority-stake deals, or divestitures where the two organizations need to operate independently for a while before, or instead of, a full merge.
We'll tell you when that's the better path. Not every deal needs a same-week cutover, and forcing one on infrastructure that isn't ready just moves the outage risk from the calendar to production.
Planning an Azure tenant merger or split?
Talk to a CloudServus architect about your acquisition, merger, or divestiture timeline. We'll scope what transfers, what has to be rebuilt, and what governance needs to change before you touch production.
Talk to an Expert →