The ability for On Demand service principals to access and operate with tenant assets requires explicit permissions. The Tenant Administrator grants these permissions through consents. Multi-factor authentication (MFA) is supported for tenant administrators when granting consents.

When a tenant is added, the initial Core - Basic permission set is granted consent to the On Demand service principal. Additional consents are required to work with different features of On Demand Migration

While consents allow Quest On Demand Migrationto access tenant assets that are exposed to the application, you can selectively restrict access to specific assets in your tenant and allow access to the other assets in the environment. Granting selective access requires additional configuration in your tenant as described below.

In this topic:

• Restricting access scope
• Granting Consents
• Consents for initial tenant setup
• Consents for Sensitivity Labels
• Consents for Account Migration
• Consents for Mailbox Migration
• Consents for Public Folder Migration
• Consents for OneDrive Migration
• Consents for Teams and M365 groups Migration
• Consents for SharePoint Migration
• Consents for Power BI Migration
  • Azure Portal Security Group Setup
  • Power BI Setup
• Verifying Service Principals

Restricting access scope

You can use the following resource-scoped access control methods in your tenant:

Role Based Access Control for Exchange Online

RBAC for Applications in Exchange Online allows admins to grant permissions to Quest On Demand Migration for Mailboxes which migrates data in Exchange Online. Exchange Online RBAC permissions must be set up in the tenant for Exchange Web Services (EWS) to ensure that Quest On Demand Migration for Mailboxes can migrate mailbox data for users within the scope of the RBAC configuration. See the Knowledge Base for more details or contact Quest Technical Support for assistance.

Sites.Selected permission for specific SharePoint Online site collections

You can enhance the security of SharePoint Online (SPO), by ensuring that On Demand Migration for SharePoint has access only to specific SharePoint sites, preventing unnecessary exposure to other sites in the environment. To achieve selected access, you must configure the Sites.Selected permission which is part of the permissions model for controlling access to specific SharePoint sites or site collections.

This permission can also be used to restrict On Demand Migration for Teams for migrating Teams and M365 Groups within the scope of the specific SharePoint sites that are exposed to the application.

Here’s a breakdown of what Sites.Selected means:

Purpose: The Sites.Selected permission is used primarily in the context of Microsoft Graph API or Azure AD permissions, where you want to restrict access to only specific SharePoint sites. It is part of the delegated or application permissions model, which allows a service or app to interact with SharePoint on behalf of the user (in delegated permissions) or as itself (in application permissions).

What it does: This permission gives an application or user the ability to access only selected SharePoint sites, instead of granting broader access to all sites in the tenant. This is more granular compared to other permissions like Sites.FullControl.All, Sites.Read.All, or Sites.Manage.All, which grant broader access.

Key Permissions in Comparison:

• Sites.FullControl.All: This allows full control of all SharePoint sites across the tenant.
• Sites.Read.All: This provides read access to all sites in the tenant.
• Sites.Selected: Access is restricted to a specific set of sites (only the ones specified).

NOTE: When implemented, Site.Selected replaces the Sites.FullControl.All and Sites.Read.All permissions.

Example Scenarios:

• Admin-level control: An administrator can use Sites.Selected to configure apps that need specific access to particular sites for functions like document management, workflow integration, or customized solutions.
• Granular control: You could use it for limiting access to a few department-specific sites or a small set of collaborative sites, instead of granting Quest On Demand access to the entire SharePoint Online environment.

How it's implemented: The Sites.Selected permission, is typically granted during the registration of an Azure AD app, or when configuring API permissions to interact with SharePoint via Graph API. It requires specifying the sites the app will have access to, and this can be done by defining a list of URLs or site identifiers. This permission requires implementation through the Azure portal, PowerShell scripts and Graph explorer. See the Knowledge Base for more details or contact Quest Technical Support for assistance with this implementation.

Granting Consents

1. Click Tenants from the navigation pane.
2. Select a tenant and click Edit Consents from the tenant tile.
3. Click Grant Consent or Regrant Consent for the permissions type.
4. Log in as the tenant administrator of the source or target tenant. Then click Accept in the Microsoft consents dialog.

This section lists the minimum consents and roles required by the various On Demand Migration service principals for managing tenants, Microsoft 365 objects and other migration services.

NOTE: The following permission sets are legacy and not available for new Quest® On Demand Migration subscribers. If you already use them, they should be replaced with either the corresponding Minimal or Full permission sets. Migration - Basic Migration - Mailbox Migration Migration - SharePoint Migration - Teams

For more details about the permissions granted through consents for each service principal, see the On Demand Migration Permissions Reference Guide.