Move App Service resources to a new resource group or subscription

This article describes the steps to move App Service resources between resource groups or Azure subscriptions. There are specific requirements for moving App Service resources to a new subscription. Unless otherwise noted, these steps apply to both App Service Web Apps and Azure Functions.

If you want to move your app to a new region, see the Relocate to another region guidance for either App Service or Azure Functions.

You can move App Service resources to a new resource group or subscription but you need to delete and upload its TLS/SSL certificates to the new resource group or subscription. Also, you can't move a free App Service managed certificate. For that scenario, see Move with free managed certificates.

Move across subscriptions

When you move an app across subscriptions, the following guidance applies:

• Moving a resource to a new resource group or subscription is a metadata change that doesn't affect how the resource functions. For example, the inbound IP address for an app service doesn't change when you move the app service.
• The destination resource group must not have any existing App Service resources. App Service resources include:
  • Web apps
  • App Service plans
  • Uploaded or imported TLS/SSL certificates
  • App Service Environments
• You must move all App Service resources in the resource group together.
• You can't move App Service Environments to a new resource group or subscription.
  • You can move an app and plan hosted on an App Service Environment to a new subscription without moving the App Service Environment. The app and plan that you move are always associated with your initial App Service Environment. You can't move an app/plan to a different App Service Environment.
  • If you need to move an app and plan to a new App Service Environment, you must recreate these resources in your new App Service Environment. To recreate your resources in a different App Service Environment, consider using the backup and restore feature.
• You can't move apps with private endpoints. To move the app, delete the private endpoints and recreate them after the move.
• You can't move apps with virtual network integration. To move the app, remove the virtual network integration and reconnect it after the move.
• You can only move App Service resources from the resource group where you originally created them. If an App Service resource isn't in its original resource group, move it back to its original resource group. Then, move the resource across subscriptions. For help with finding the original resource group, see the next section.
• When you move an app to a different resource group or subscription, the location of the app remains the same, but its policy changes. For example, consider a case where your app runs in Subscription1 (Central US) and has Policy1 and Subscription2 (UK South) that has Policy2. If you move your app to Subscription2, the location of the app remains the same (Central US); however, it falls under the new policy Policy2.

Find original resource group

If you don't remember the original resource group, you can find it through diagnostics. In your app page in the Azure portal, select Diagnose and solve problems. Then, select Configuration and Management.

Select Migration Options.

Select the option for recommended steps to move the app.

You see the recommended actions to take before moving the resources. The information includes the original resource group for the web app.

Move hidden resource types in portal

When you use the portal to move your App Service resources, you might see an error indicating that you didn't move all of the resources. If you see this error, check if there are resource types that the portal didn't display. Select Show hidden types. Then, select all of the resources to move.

Move with free managed certificates

You can't move a free App Service managed certificate. Instead, delete the managed certificate and recreate it after moving the web app. To get instructions for deleting the certificate, use the Migration Operations tool.

If your free App Service managed certificate gets created in an unexpected resource group, try moving the app service plan back to its original resource group. Then, recreate the free managed certificate. This change fixes the issue.

Move support

To determine which App Service resources you can move, see move support status for:

• Microsoft.AppService
• Microsoft.CertificateRegistration
• Microsoft.DomainRegistration
• Microsoft.Web

Next steps

For commands to move resources, see Move resources to new resource group or subscription.