azure-docs
azure-docs copied to clipboard
MicrosoftDocs
Wrong warning that leads to unrecoverable state
In the section "List Key Vaults"
https://learn.microsoft.com/en-us/azure/role-based-access-control/transfer-subscription?WT.mc_id=Portal-Microsoft_Azure_Billing#list-key-vaults
there is a warning that says:
"If you are using encryption at rest for a resource, such as a storage account or SQL database, that has a dependency on a key vault that is not in the same subscription that is being transferred, it can lead to an unrecoverable scenario. If you have this situation, you should take steps to use a different key vault or temporarily disable customer-managed keys to avoid this unrecoverable scenario."
This is wrong. I did a transfer with an encrypted MySQL with a key in a KV located IN THE SAME subscription as the mysql server and it failed. The key is tied to the tenant, not the KV/subscription. So if you keep the encryption ON and do the transfer, you will lose access to the data inside the mysql server. This was confirmed by the PG team. You have to disable encryption BEFORE doing the change.
Please change it to avoid other people lose their MySQL servers.
Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.
- ID: 9afab524-67c2-2e76-fd7a-46238cb9d249
- Version Independent ID: ae2da577-6026-f322-1c09-dbcc6068c01a
- Content: Transfer an Azure subscription to a different Azure AD directory
- Content Source: articles/role-based-access-control/transfer-subscription.md
- Service: role-based-access-control
- GitHub Login: @rolyon
- Microsoft Alias: rolyon
@lesmoris-guesty Thanks for your feedback! We will investigate and update as appropriate.
@lesmoris-guesty Thanks for bringing this to our attention. I'm going to assign this to the document author so they can take a look at it accordingly.
@rolyon Can you please check and add your comments on this doc update request as applicable.
Hi @lesmoris-guesty Thanks for letting us know about this. We are checking with the team to make updates to the doc. thanks
Hi @lesmoris-guesty We have updated the warning text in the doc. https://learn.microsoft.com/en-us/azure/role-based-access-control/transfer-subscription Thanks again and let us know if you have any additional feedback. thanks