In on-premise farm, I understand that using Move-SPUser will update the user identity in all the web applications in the farm.

Is there a recommend approach wherein I can use Move-SPUser to update user identity only in 1 web application?

1 Answer 1


Move-SPUser and stsadm -o migrateuser are farm-wide operations. There is no way to restrict identity migration to a single Web Application.

There are 3rd party products that can accomplish this, like Metalogix ControlPoint can clone permissions within a specific scope.

  • Many thanks for your response. I made all the content DBs in the farm as read-only except the DB that are part of the web application that I would like to convert . I then ran Move-SPuser command, this converted the user identities only in DBs that are not set to read-only. Can this approach be followed?
    – George
    Commented Oct 27, 2021 at 8:04
  • The problem is the UPS will see the 'move' and will also attempt to move the user. The approach you took is /likely/ unsupported, but that would be a better question to bring up with Microsoft.
    – user6024
    Commented Oct 27, 2021 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.