It is expected that you won't be able to import your App Service Certificate after transferring a Subscription to a new Directory—though you should be getting the following warning in your Key Vault:
The directory (XYZ) currently selected differs from this key vault's directory. Some actions will be disabled. Click this for more details.
When this happens, you will usually also get the following error message in your Key Vault's Keys, Secrets, and/or Certificates tabs:
The operation ‘List’ is not enabled in this key vault's access policy.
Those messages don't always show up immediately, presumably due to dependencies migrating between different data centers, which could be why you're receiving the less informative errors. My assumption is that the generic messages you're seeing will be replaced with these specific messages in time, but that they both stem from the same underlying issue.
Associate your Key Vault with your new Directory
Regardless, though, it's a good idea to ensure that your Key Vault is, in fact, associated with the new Directory after a Subscription transfer. As per the instructions linked from the Azure error, you can change the directory in the Azure PowerShell (Az) module using the following commands:
Select-AzSubscription -SubscriptionId <your-subscriptionId>
$vaultResourceId = (Get-AzKeyVault -VaultName myvault).ResourceId
$vault = Get-AzResource –ResourceId $vaultResourceId -ExpandProperties
$vault.Properties.TenantId = (Get-AzContext).Tenant.TenantId
$vault.Properties.AccessPolicies = @()
Set-AzResource -ResourceId $vaultResourceId -Properties $vault.Properties
Alternatively, see "Unable to access Key-Vault using Azure Portal", here on Stack Overflow, which provides similar instructions.
Note: It's useful to have Azure PowerShell (Az) module installed. If you don't, however, you can always use the Azure Cloud Shell, which is accessible in the Azure Portal via the shell icon to the right of the search bar. In that case, you may need to provision an Azure Storage account, if you haven't already.
Verifying the resolution
The above steps should resolve your issue. But there are two related conditions you should check to be safe.
App Service Certificate
First, go to your App Service Certificate in the Portal. There should be a link between your App Service Certificate and your Key Vault, which allows your private key to be stored in your Key Vault, and retrieved by applications with the appropriate Access Policy. Azure now has tooling built-in to detect when the App Service Certificate is not correctly linked to your Key Vault. To access this, click on Certificate Configuration, and make sure there is a checkmark next to Step 1: Store. If this is not the case, the portal will give you a warning which you can click to automatically reestablish this link.
Key Vault Access Policy
Second, return to your Key Vault, and click on Keys, Secrets, or Certificates. You should no longer be receiving any errors here. If you do, however, you may need to reconfigure or update your Microsoft Azure App Service Access Policy, which is normally created when you first create an Azure App Service Certificate.
Note: There are a lot of previous posts for troubleshooting and resolving access to the App Services via an Access Policy (e.g., here on Stack Overflow, but also on Microsoft Questions), so I'm not going to go into detail on those here. But I want to acknowledge that particular possibility just in case the App Service Certificate isn't properly registered after the Subscription migration.
With this all done, you should now be able to use the Import App Service Certificate from within your App Service.
