I changed my email and now I can't see my Key Vault

Question

I have a VM in Azure running some web services. I use Azure Key Vault to generate an SSL certificate for secure comms.

I had to change my email on my Azure account. My account was transferred by MS support, but the Key Vault says my Tenant ID has changed and I can't renew my certificate.

I need to renew my certificate, can someone please help? Thank you.

Answer 1

Hello @Krisse Casimiro ,

Thank you for reaching out Microsoft Q&A.

I understand that you have changed your email on the azure account and your account was transferred by the MS Support but the Key Vault says your Tenant ID has changed and you can't renew your certificate because moving a key vault to another subscription will cause a breaking change to your environment.

Azure Key Vault is automatically tied to the default Microsoft Entra tenant ID for the subscription in which it is created. All access policy entries and roles assignments are also tied to the tenant ID.

If you move your Azure subscription from tenant A to tenant B, your existing key vaults will be inaccessible by the service principals in tenant B. To fix this issue, you need to:

1. Change the tenant ID associated with all existing key vaults in the subscription to tenant B.
2. Remove all existing access policy entries.
3. Add new access policy entries associated with tenant B.

As you moved your subscription containing the key vault to a new tenant, you need to manually update the tenant ID and remove old access policies and role assignments.

follow the document when you are moving the Subscription containing key vault to the new tenant: https://learn.microsoft.com/en-us/azure/key-vault/general/move-subscription?source=recommendations#moving-a-key-vault-to-a-new-subscription

Hope this helps. Do let us know if you any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Regards,
Goutam Pratti.