Unable to change or recreate System Assigned Identity on migrated Azure ML Workspace

Hello Venkata Narasimha Nikhil Kumar Reddy,

Welcome to Microsoft Q&A,

Thank you for the details. Based on your description, the issue you're facing with the System Assigned Managed Identity (SAMI) is expected behavior after migrating an Azure Machine Learning Workspace across tenants.

Why This Happens

System-assigned managed identities are tenant-bound. When an Azure ML Workspace is moved to a different tenant, the original SAMI becomes invalid. Because of this limitation:

The old SAMI cannot be reused

It cannot be re-enabled

It cannot be recreated within the new tenant

This is why your attempts to update or restore the identity are consistently failing.

Recommended Steps,

1. Create a new Azure ML Workspace in the target tenant

Azure’s recommended approach is to deploy a new workspace in the destination tenant. This automatically generates a correct SAMI aligned with the new tenant and avoids long-term issues.

2. If you must keep the migrated workspace:

This scenario requires backend validation, as the SAMI cannot be fixed through ARM/portal operations. Please share the Workspace Resource ID, and we can check internally whether the engineering team can perform a backend identity repair.

Although these steps are correct, they will not resolve the tenant-bound SAMI issue but here are the standard checks you performed:

Disable and Re-enable SAMI using PATCH API:

Disable:

$bodyJson = @{identity= @{type='None'}} | ConvertTo-Json
Invoke-RestMethod -Method PATCH -Uri $url -ContentType $contentType -Headers $header -Body $bodyJson

Re-enable (after provisioningState = Succeeded):

$bodyJson = @{identity= @{type='SystemAssigned'}} | ConvertTo-Json
Invoke-RestMethod -Method PATCH -Uri $url -ContentType $contentType -Headers $header -Body $bodyJson

Ensure you have at least Owner or User Access Administrator to manage identity updates.

Confirm if any identity operations failed due to permission or tenant issues.

These steps are correct, but due to the nature of SAMI being tenant-tied, they won’t recover the identity.

Your configuration and steps were correct the issue is due to a platform limitation when moving system-assigned identities across tenants. A new workspace is the most reliable solution.

Please refer this

• Set up authentication between Azure Machine Learning and other services
• Recovering Synapse Analytics workspace after transferring a subscription

I Hope this helps. Do let me know if you have any further queries.

Thank you!