Access control of an Azure subscription

Whoever creates an Azure subscription is usually its only owner. When that person leaves, management changes hands, or the subscription has to move to another organization, you want to change the ownership. In Azure that's three different things: who can manage the subscription, who pays the bill and which tenant the subscription belongs to. This article shows how to change each of them.

Note. The old co-administrator role no longer exists: Microsoft retired the classic administrator roles on 31 August 2024. Use Azure RBAC role assignments instead, as described below.

What exactly do you want to change?

GoalHowResult
Someone else can manage the subscriptionAssign the Owner roleBilling and tenant stay the same
Someone else pays and manages the invoiceTransfer billing ownershipSubscription and resources keep running
Subscription to another Entra tenantChange directoryExisting role assignments are removed

Add a new owner (Azure RBAC)

  1. Sign in at portal.azure.com and search for Subscriptions.
  2. Select the subscription and choose Access control (IAM).
  3. Select Add > Add role assignment.
  4. Open the Privileged administrator roles tab and select Owner.
  5. Under Members, pick the user or, better, a group.
  6. Under Conditions you can limit which roles the new owner may assign. Then select Review + assign.
Access control (IAM) of a subscription in the Azure portal

To remove the old owner, delete their role assignment under Access control (IAM) > Role assignments. Always keep at least two owners, preferably through a group, so you never lock yourself out.

Should someone only manage resources without granting access to others? Use the Contributor role instead of Owner. If they only look at costs, Cost Management Reader is enough.

Transfer billing ownership

For a pay-as-you-go subscription (Microsoft Online Subscription Program):

  1. Go to Cost Management + Billing > Subscriptions and select the subscription.
  2. Choose Transfer billing ownership.
  3. Enter the new owner's email address. Choose whether the subscription may move to their tenant.
  4. The new owner receives an email and must accept the transfer within a limited time and add a payment method.

For a Microsoft Customer Agreement or an Enterprise Agreement the transfer goes through the billing account and billing profiles. For a subscription bought through a CSP partner, arrange it with that partner. Credit-based subscriptions, such as Visual Studio/MSDN or a free trial, usually can't be transferred.

Move the subscription to another tenant

  1. Open the subscription and select Change directory at the top.
  2. Pick the target tenant. You need an account in both tenants and the Owner role on the subscription.
  3. Confirm the change.
Careful. Changing the directory removes all role assignments and system-assigned managed identities. Key vaults, storage accounts with Entra authentication and other services that rely on the old tenant must be set up again. Export all role assignments first, for example with az role assignment list --all.

Tips

Read also

Security defaults in Microsoft Entra ID: what they do and how to enable them
All Microsoft 365 admin portals in one list: the right URLs in 2026
Change a UserPrincipalName (UPN) in Microsoft 365 and Entra ID

Nederlandstalige versie: De eigenaar van een Azure-abonnement wijzigen of overdragen


More in English