You change an Azure subscription to use a different Azure Active Directory (Azure AD) tenant. Which two effects can occur?

When an Azure subscription is moved to a new Azure AD tenant, the subscription's trust relationship with the original tenant is severed. This means that all role assignments defined at the subscription level, which are tied to identities in the original Azure AD tenant, become invalid and are effectively lost. Similarly, managed identities for Azure resources (like VMs) are service principals in Azure AD. When the subscription moves, these managed identities, being linked to the original tenant, are also lost and must be re-created in the new tenant. Virtual machine disk snapshots are data plane objects stored within the subscription's storage accounts and are not directly tied to the Azure AD tenant, so they are retained. Existing Azure resources themselves are not deleted; they remain within the subscription, but their access control might be affected.