Regarding the replacement or migration of the server administrator

Complete separation from the former agent requires either taking control of the existing Microsoft Entra tenant or moving the Azure subscription and its resources into your company’s tenant; transferring billing or assigning Subscription Owner alone is insufficient if the agent still controls the current tenant.

1. First determine what the agent controls

Ask the agent to provide:

• Azure subscription name, ID, offer/agreement type, and billing account type.
• The Microsoft Entra tenant ID and confirmation whether that tenant is:
  • dedicated to the acquired manufacturer, or
  • shared with or owned by the agent.
• An inventory of resources, Marketplace/SaaS products, application registrations, managed identities, Key Vaults, network resources, databases, and storage.
• Current access assignments from Azure portal → Subscriptions → [subscription] → Access control (IAM) → Role assignments.
• The current billing administrator, shown under the subscription’s Settings → Billing properties where applicable.^1^

The agent or another currently authorized administrator must initiate the access and ownership changes; your company cannot unilaterally take over the subscription.

2. Choose the appropriate handover model

A. Existing tenant belongs exclusively to the acquired manufacturer

Keep the subscription in that tenant and perform a controlled organizational handover:

1. Give at least two company-controlled accounts the necessary tenant-level administrative control.
2. Assign your operational accounts Owner at the Azure subscription scope:
   • Subscriptions → [subscription] → Access control (IAM) → Add role assignment → Owner.
   • Owner provides full resource management and the ability to delegate access.^2^
3. Transfer billing ownership to your company using the procedure applicable to the current Azure agreement.
4. Verify company control of verified domains, privileged roles, emergency-access accounts, Conditional Access, application registrations, and partner-delegated access.
5. Inventory and remove the agent’s subscription and tenant access.
6. Rotate VM credentials, certificates, storage keys, application secrets, API credentials, and other service credentials. Former administrators can retain access through certificates, access keys, or VM credentials even after Azure RBAC access is removed.^3^

This is normally the least disruptive route because the resources remain in their existing tenant.

B. Existing tenant belongs to or is shared with the agent

Do not treat billing transfer plus Subscription Owner as complete ownership. Plan either:

• a supported transfer of the entire subscription into your company’s Microsoft Entra tenant, or
• a resource migration/redeployment if the subscription type or a contained service cannot transfer.

For a cross-tenant subscription transfer, the initiating user needs billing authority, a directly assigned and unconditional Owner role on the subscription, and an account in both source and target directories.^4^

For a supported MOSP/pay-as-you-go transfer, the current billing administrator uses:

1. Azure portal → Subscriptions → [subscription].
2. Select Transfer billing ownership.
3. Enter a billing administrator account controlled by your company.
4. Select Move subscription tenant when moving the subscription into your company’s tenant.
5. Send the request; your company accepts it and supplies its payment method.^5^

The exact process depends on the source and destination billing agreements. Not every combination supports self-service transfer; unsupported combinations require an Azure billing support request or resource migration.^6^

3. Will equipment users be affected?

A billing-only ownership transfer generally does not cause downtime or change the running resources. Most billing transfers leave the service tenant unchanged.^6^

A cross-tenant transfer needs a maintenance and validation plan:

• All existing Azure RBAC assignments and custom roles in the source tenant are permanently deleted.
• Managed identities, Key Vault permissions, and storage ACLs require remediation.
• Some services cannot transfer directly, including AKS clusters, Microsoft Entra Domain Services, and Azure Databricks workspaces.
• Databases using certain Microsoft Entra authentication configurations may have to be changed before transfer.
• Some scenarios require downtime.
• Customer-managed encryption keys dependent on a transferred Key Vault can create an unrecoverable situation unless addressed beforehand.^4^

Before transferring, export the existing assignments for reconstruction:

az role assignment list --all --include-inherited \
  --output json > role-assignments.json

az role definition list --custom-role-only true \
  --output json > custom-roles.json

Test the customer-facing upload/download workflow, DNS, public endpoints, database access, storage authorization, equipment ingestion, and monitoring before removing the agent’s final access. Marketplace SaaS subscriptions also need separate transfer handling because they do not automatically move with the Azure subscription.^6^

References

1. Add or change Azure subscription administrators
2. Assign a user as an administrator of an Azure subscription with conditions
3. Azure product transfer hub
4. Transfer an Azure subscription to a different Microsoft Entra directory
5. Transfer billing ownership of an MOSP Azure subscription to another account