Move SCEPman resources
Moving SCEPman resources from tenant to tenant is not supported. For more information on the underlying problem, see https://learn.microsoft.com/en-us/azure/key-vault/general/move-subscription
This guide explains how to move SCEPman resources from one subscription to a new resource group in a different subscription within the same tenant.
Preparations
Resources associated with the private endpoint cannot be moved. Therefore, if your SCEPman is using Private endpoints, the following SCEPman resources are not movable:
1x Virtual network
2x Private endpoints
2x Network Interface
2x Private DNS zone
Movable SCEPman resources are:
App Service Plan
SCEPman and Certificate Master App Services
Storage Account
Key Vault
Log Analytics Workspace
Since Private Endpoints are not movable, you need to take the following steps (if your SCEPman is not using Private endpoints, skip these steps):
First, enable public access on the Key Vault and Storage Account and remove the private endpoints
Then, disconnect the outbound network integration on both app services
The same applies to the Certificate Master App service.
Moving Resources
After moving SCEPman resources to the new subscription, SCEPman will lose its connection to the Storage Account. To resolve this, you will need to run the Complete-SCEPmanInstallation command. Please note that this will be the only downtime during the process (from moving the resources until you run the command), which should be resolved within 3-5 minutes.
Make sure to have the required permissions to run the Complete-SCEPmanInstallation CMDlet before moving the resources.
Create a new Resource group in the target subscription.
Now move the resources. An easy way to move resources is to select them in the Resource group and choose "Move to another subscription" option
Then you need to choose the new Subscription and Resource group, resources will be validated and moved.
After moving SCEPman resources:
To fix the connection to the Storage Account, run the Complete-SCEPmanInstallation CMDlet.
Now you have the option to reconfigure the private endpoints as mentioned at Private Endpoints
Considerations regarding the location of the moved SCEPman resources
Moving resources within the same resource group location is possible.
Moving resources between different resource group locations, the resources will remain in the original location and will simply be listed in the new resource group under a different location. E.g.:
Last updated