Migrator for Notes to Exchange 4.17

Microsoft Azure App Registration

For migration to Microsoft 365, you must use this page to register the MNE application with the Microsoft Entra admin center.

Follow instructions to manually register the App: You must perform the steps in Manually registering the MNE application with the Microsoft Entra admin center to register Migrator for Notes to Exchange with the Microsoft Entra admin center site. After App registration is complete, you will need to provide the following information from the Microsoft Entra admin center.

•

Tenant Domain Name: Your tenant’s primary domain name on the Microsoft Entra admin center. For example, Sitraka.onmicrosoft.com.

•

Tenant ID: Your tenant’s ID, found on the Home page of the Microsoft Entra admin center.

•

Registered App Client ID (SSDM): The application ID created with delegated permissions after the application is registered in the Microsoft Entra admin center. With the manual registration process, the client ID that you enter for the SSDM is the same as the Registered App Client ID.

•

Registered App Client ID: The Application ID created with application permissions after the application is registered in the Microsoft Entra admin center.

•

Registered App Client Secret: The Application Secret created after the application is registered in the Microsoft Entra admin center.

Show App Client Secret: When the check box is selected, the App Client Secret value is not masked but is displayed so that you can make note of the client secret value to use if you are manually registering the application with Microsoft Entra.

Manually registering the MNE application with the Microsoft Entra admin center

To find your Microsoft 365 tenant’s primary domain name, log into the Microsoft Entra admin center as an administrator. Under Home, under Basic information, find Primary domain. This will be a domain which ends in .onmicrosoft.com. This is your Microsoft 365 tenant domain name, for example sitraka.onmicrosoft.com.

The process of registering an application with the Microsoft Entra admin center is also described in the Microsoft Learn topic Register an application in Microsoft Entra ID.

Depending on the region from which you are accessing the Microsoft portal site, the user interface can differ.

To manually register the MNE application


	IMPORTANT: You must have global admin rights to register this application.

Search for App registrations in the search box at the top.

- OR-

In the left navigation pane, choose Applications, choose App registrations. From the Navigation bar, choose New registration.

On the Register an application page, enter the application registration information:

•

Name: For example, Quest Migrator for Notes to Exchange.

•

Supported account types: Select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant)

•

Redirect URI:

•

Select Public client/native (mobile & desktop)

•

Enter a URI: https://login.microsoftonline.com/common/oauth2/nativeclient


	NOTE: The Redirect URI is required to register the MNE application for both the Admin console and the SSDM to be able to access mailbox OneDrive storage.

Choose Register.

The newly registered application is displayed and the following application details become available.

•

Application (client) ID: The Application ID created after the application is registered in the Microsoft Entra admin center. You must copy this ID and use it later to complete the App Registration.

Under Manage in the left side menu, choose API permissions. Under Configured permissions choose Add a permission.

On the Request API permissions window on the right, under Microsoft APIs, choose Microsoft Graph.

Select Application permissions on the right. We will grant Delegated permissions in a following step.

For basic MNE configuration:

•

From Select permissions, filter on Directory., then expand Directory and select Directory.ReadWrite.All. Choose Add permissions to grant application permission.

•

From Select permissions, filter on Mail., the expand Mail and select Mail.Send. Choose Add permissions to grant application permission.

•

From Select permissions, filter on User., then expand User and select each of:

•

User.EnableDisableAccount.All,

•

User.ManageIdentities.All, and

•

User.ReadWrite.All,

and choose Add permissions to grant application permission.

To configure MNE for Oversized Attachment processing, take the following additional step:

•

From Select permissions, filter on Files., then expand Files and select Files.ReadWrite.All. Choose Add permissions to grant application permission.

Go back to add a permission for Microsoft Graph under Microsoft APIs and select the left box Delegated permissions.

For basic MNE configuration:

•

From the list, expand Openid permissions, and select each of:

•

offline_access,

•

openid, and

•

profile

and choose Add permissions to grant delegated permission.

•

From Select permissions, filter on Directory., then expand Directory and select Directory.AccessAsUser.All. Choose Add permissions to grant application permission.

To configure MNE for Oversized Attachment processing, take the following additional step:

•

From Select permissions, filter on Files., then expand Files and select Files.ReadWrite. Choose Add permissions to grant application permission.

Under Configured permissions choose Add a permission. On the Request API permissions window on the right, under APIs my organization uses, enter the API name Office 365 Exchange Online. Select this row.

Select Application permissions on the right.

From the list, select each of:

•

Exchange.ManageAsApp, under Exchange and

•

full_access_as_app under Other permissions.

Choose Add permissions to grant these application permissions.

Verify that you have added all required API permissions using the table below:

Table 1. API permissions
API / Permission name	Type	Description	When needed
Microsoft Graph
Directory.AccessAsUser.All	Delegated	Access directory as the signed in user	Always
Directory.ReadWrite.All	Application	Read and write directory data	Always
Files.ReadWrite	Delegated	Have full access to user files	For Oversized Attachments
Files.ReadWrite.All	Application	Read and write files in all site collections	For Oversized Attachments
Mail.Send	Application	Send mail as any user	Always
offline_access	Delegated	Maintain access to data you have given it access to	Always
openid	Delegated	Sign users in	Always
profile	Delegated	View users' basic profile	Always
User.EnableDisableAccount.All	Application	Enable and disable user accounts	Always
User.ManageIdentities.All	Application	Manage all users' identities	Always
User.Read	Delegated	Sign in and read user profile	Microsoft default
User.ReadWrite.All	Application	Read and write all users' full profiles	Always
Office 365 Exchange Online
Exchange.ManageAsApp	Application	Manage Exchange As Application	Always
full_access_as_app	Application	Use Exchange Web Services with full access to all mailboxes	Always

Under Manage in the left side menu, choose Certificates & secrets.

Under Client secrets, choose New client secret

Enter a description and specify an expiration for the client secret (for example, In 2 years).

Choose Add to generate the client secret.

Copy the new client secret value and keep it safe as you need it to complete the application registration in MNE. You cannot retrieve a client secret after you perform another operation or leave this resource management view (blade).

Under Manage in the left side menu, select API permissions.

Select Grant admin consent for (your company name).

A confirmation message appears on the top. Click Yes.

In the Microsoft Entra admin center’s left side pane, select Roles & admins. On the Roles and administrators | All roles page,

Enter Exchange Administrator in the search box. Click anywhere (except the check box) in the resulting Exchange Administrator row to select it. The Exchange Administrator | Assignments page opens.

Choose Add Assignments. Once the page fully loads, a clickable link (“x Member(s) selected”) appears under Select Members. Select this link.

A Select a member page opens. In the Search box, enter either the name you chose for your MNE application or the Application (client) ID. Select the corresponding row on the table, then choose Select.

Select Next. Enter a justification, such as “Quest Migrator for Notes to Exchange requires this permission.” and choose Assign.

Close the Exchange Administrator | Assignments page.

Repeat this process to assign the roles

•

Privileged Authentication Administrator, and

•

Privileged Role Administrator

to the MNE app in the same manner.

Your MNE app registration is complete. On the left side menu, choose Overview to obtain settings for the next step.

On the Microsoft Azure App Registration page in MNE, enter the values that were assigned for:

•

Tenant Domain Name: Your Microsoft 365 tenant domain name. For example, Sitraka.onmicrosoft.com.

•

Tenant ID: Your tenant’s ID, found on the Home page of the Microsoft Entra admin center.

•

Registered App Client ID: The Application ID created with application permissions after the application is registered in the Microsoft Entra admin center.

•

Registered App Client Secret: The Application Secret created after the application is registered in the Microsoft Entra admin center.

Click Save.

Edit Default Settings: Active Directory Configuration

This screen collects the information necessary for the program and its wizards to access Active Directory. (The screen is disabled if you are migrating to Microsoft 365 without using the Microsoft Entra Connect (formerly AD synchronization) tool.)

Click Apply after you enter new information or changes to existing information. The program does not read or save any new information or changes until Apply is clicked.

Active Directory credentials:

•

Automatically grant permissions: The access credentials must be an Active Directory administrative account that is a member of the Exchange Organization Management role group, is configured with remote PowerShell enabled, and has full access to the target Organizational Units (OUs). Quest recommends that customers not enable this check box unless directed by Quest support personnel.

If you use the Automatically grant permissions option, MNE delegates Full Control permissions to the root of the target OUs and the permissions are inherited by all OUs, even the OUs that are added after initial configuration.

Alternately, you could manually grant the permissions using the Active Directory Users and Computers tool. If you grant full access to the target OU using Delegation of Control Wizard, you must select Full Control. Open the wizard and select the following: Create a custom task to delegate | This folder, existing objects in this folder, and creation of new objects in this folder | Full Control.The program will check that the access credentials have Full Control rights to the target Organization Units (OUs), not just read/write permissions. You must reconfigure the account each time you change the target OU.

•

Global Catalog host name: Specify a Global Catalog (GC) at a level higher than all the users, groups, and contacts to be migrated. If you have multiple Global Catalogs/Domain Controllers in an AD forest, you can choose any GC as long as it is in the same domain.


	IMPORTANT: You must enter fully qualified domain names (FQDN) for the Global Catalog host name and the Domain Controller host name.

•

Domain Controller host name Specify the Domain Controller that is used to read data from or write data to Active Directory.

•

User name and Password: The access credentials used to authenticate the administrator by whose authority the program accesses Active Directory.

•

Always use these values: Select this check box if the wizards will always use these credentials. If this box is selected, the wizard skips the screen that requests credential information. If the check box is empty, the wizard retrieves the values entered here as defaults, but will display the screen to offer the option of accepting or changing the default credentials.

•

Path to existing organizational unit for distribution groups: Fully qualified domain name (FQDN) for the group organizational unit (OU) path.

•

Path to existing organizational unit for creating external members for distribution groups: Fully qualified domain name (FQDN) for the path for an existing organizational unit (OU) to which group members will be assigned when a member must be created as a new AD contact (when there is no corresponding AD user account).

•

Create user objects in Active Directory: Determines whether the Provisioning Wizard will create a new user object in AD when none is found to correspond with a user in the collection. Such new user objects are created in the container specified by the Path to existing organizational unit for creating user objects text box. Ordinarily the objects created are not mail-enabled, although the EnableUsers parameter (in Task Parameters) can be set to 1 to change that default behavior.

•

Path to existing organizational unit for creating user objects: Click Browse to find and specify the relative domain name for an existing organizational unit (for example, cn=users) where any new user objects will be created in AD (when a wizard encounters a contact for which there is no existing corresponding AD user account).

•

Use resource/user forest: If your target environment is configured for a resource forest and a user forest with corresponding user accounts, you must provide these credentials for the Data Migration Wizard to enable mailboxes and to associate the resource accounts with the user accounts. The credentials specified here identify the user forest, while the credentials specified for AD credentials pertain to the resource forest.

User forest credentials:


	NOTE: In addition to specifying the User forest credentials here, you must also add a set of parameters to the configuration data for the Data Migration Wizard, explained in Appendix A of the Migrator for Notes to Exchange Administration Guide—see the topic How do I prepare the SQL database for mailbox-enabling (if AD is configured for a resource forest and a user forest)?

•

Global Catalog host name: The name of the AD server.

•

User name: The user ID of the administrator who will be running the migration program, by whose authority the program accesses the user forest AD. This entry must be the SAM Account name, not the UPN.

•

Password: The password associated with the user name.

•

Apply: Reads and saves new or changed information. Any new information or changes are discarded if you do not click Apply before you exit.

•

More info: Launches the Log Viewer to display the associated log file. This button is enabled only if the program encountered significant errors or warnings that require resolution before continuing in the migration. If no significant errors or warnings are encountered, the button is dimmed (unavailable).

Discover Notes Information

•

Discover Notes Information: Find NABs

•

Discover Notes Information: Find Domains

•

Discover Notes Information: Export Notes Directory

Seleziona il prodotto:

Per una maggiore efficacia, compilare l'Obiettivo della chat:

Soluzioni consigliate per il problema

Migrator for Notes to Exchange 4.17 - Administration Guide

Microsoft Azure App Registration

Manually registering the MNE application with the Microsoft Entra admin center

Edit Default Settings: Active Directory Configuration

Discover Notes Information