Container Registry: Name Reuse and Migration Challenges — Clarification Needed

Question

Container Registry: Name Reuse and Migration Challenges — Clarification Needed

Tom Smith 0

Problem description

I am trying to understand if there is a supported method to move an Azure Container Registry (ACR) resource across different Azure tenants. Specifically, I previously deleted the registry named 'alaska.azurecr.io' to use it in another tenant, and now I have recreated it in the source tenant. I want to know if it's possible, within supported practices, to transfer this registry to my other tenant, considering that the registry is empty and I have already migrated its contents elsewhere.

Environment

Azure Container Registry, region not specified in case information.

What I've already tried

I have not tried anything yet.

Current status

I am seeking guidance on whether moving an existing registry resource across tenants is supported or if I should create a new registry in the destination tenant. I would appreciate detailed steps or confirmation on supported workflows.

0 comments

1 answer

Your answer

Answer 1

Hi Tom Smith,

Welcome to Microsoft Q&A.

No, moving a single ACR registry to another Microsoft Entra tenant isn’t supported. Azure’s resource move operation doesn’t support moving resources to a new tenant. If the tenant IDs differ, the documented route is to transfer the whole subscription. That moves everything in it, so it’s overkill for one empty registry. Registry relocation is also limited to the same tenant (ACR relocation).

Since the registry is empty and your images are already elsewhere, create a new registry in the destination tenant:

Delete alaska in the source tenant. Registry names must be unique within Azure (quickstart), so the name has to be free before you can reuse it.
In the destination tenant, create the registry with az acr create (or the portal) using the same name. If the name still shows as taken, wait a bit and retry.
Choose the Domain Name Label (DNL) scope carefully. It’s permanent. Anything other than Unsecure adds a hash to the login server, for example alaska-abc123.azurecr.io (DNL docs). Use Unsecure if you need the plain alaska.azurecr.io name. Otherwise update Dockerfiles, YAML and Helm charts to the full hashed name.
If you need content later, az acr import works across tenants. Pass the source login server and credentials with pull access, such as a service principal with AcrPull (import docs). Cross-tenant import isn’t supported when the source has public access disabled.

Please click Accept Answer and upvote if this helped.