ODM and the principle of least privilege (minimum permissions) (4347335)

When applying the concept of least permissions to On Demand Migration (ODM), full functionality of the tool will require two Entra ID accounts in the target tenant. The first account, is the "consent granting admin account" will need to grant consent to the ODM Service Principals (Enterprise Applications) for the workloads to be migrated. This "consent granting admin account" is the only account required for the source tenant. 

The second account is required for ODM to automatically pre-provision OneDrives in the target tenant, as part of the initial OneDrive migration.

1.) Dedicated ODM Consent Account 

A dedicated consent account will be required to "grant consent" to the ODM workloads, which are represented by Enterprise Applications in Azure Active Directory.

• Consent account can have MFA enabled and can be subject to Conditional Access Policies that require MFA.
• Consent account will need to be a Global Administrator to “grant consent” to the tenants.
• Consent account can be demoted from Global Admin to Teams Admin after successfully granting consent. Consent account will need to be re-promoted to Global Admin should consents need to be re-granted in the future. 
• Consent account should not change, especially in the target tenant. If the target Global Administrator account is changed, then Teams data migrated by the previous consent account will not be able to be modified in subsequent migrations.
• The "Display Name" of the consent account will be used to post items in the target Teams channels, so it is important that the display name is chosen carefully. A display name such as "Migration", "Migration Admin", or "Migrated" could be used to generically differentiate data that was migrated from the source tenant to the target tenant.
• Consent account will need to be licensed for each workload being migrated, Exchange Online, SharePoint (SharePoint and OneDrive), Teams, etc.

2.)  Optional ODM OneDrive pre-provision service account

A dedicated ODM OneDrive admin service account (Azure AD user account) will be required for processes that, due to API limitations, must be performed outside of the consents granted by the GA account above. Here are examples of tasks where this ODM admin service account is required:

OneDrive migrations

• Automatic provisioning of the OneDrive accounts on the target

Note: It is possible to pre-provision OneDrive accounts in the target outside of ODM using this Microsoft article. However, guest user migrations and process resource features will not be available unless this optional service account is provided.

ODM OneDrive Admin Service Account Requirements:

• Service Account cannot have MFA enabled on the account level. Furthermore, this service account must be excluded from any Conditional Access Policies in Azure that require MFA.
• Service Account will need to be a SharePoint Administrator.

OneDrive Service Account can be managed in ODM by going to ODM Accounts | Dashboard | Configure Connections | Target