Sites.Selected Permissions and On Demand Migration for SharePoint and Teams (4378526)

Update permissions from an OnDemand SharePoint and Teams Migration Azure AD Application to use Sites.Selected permissions using the provided PowerShell scripts. 
 

To view and update the application permissions: 

1. Select Enterprise applications from left side menu. 

2. Search for name of SharePoint and Teams application that was granted consent for the tenant (e.g. “Quest On Demand - Migration - SharePoint – Full”) and select it. 

3. Select Security/Permissions from the left side menu to view the current permissions. 

4. Use the provided PowerShell script using the noted application ID to remove default permissions and replace with site selected.

   1. Install the Micsoft.Graph module 
      PS C:\> Install-Module Microsoft.Graph -Scope CurrentUser -Repository PSGallery –Force

   2. Connect to MS Graph with tenant admin credentials 
      PS C:\> Connect-MgGraph -Scopes "User.Read.All", "Group.ReadWrite.All"

   3. Use provided scripts to update SharePoint and Teams applications using the appropriate application ID. (Make sure to PowerShell script files are unblocked. 
      PS C:\> .\UpdateAppConsent_ODMSP.ps1 -ApplicationId <application_Id> 
      PS C:\> .\UpdateAppConsent_ODMTeams.ps1 -ApplicationId <application_Id> 

5. Refresh the permissions to confirm permissions have been updated. For SharePoint, the following 3 permissions should now be granted to the application. 
   
   

   Click To See Full Image.

Use Graph Explorer to assign the application to specific site: 

The following steps in Graph Explorer will need to be performed for each site. For Teams migrations the permissions Post update must be performed for the SharePoint and Teams permissions. If the Team has Private or Shared channels the process must be performed for the Private and Shared channel sites for both SharePoint and Teams permissions. 

1. Open Graph Explorer  
   https://developer.microsoft.com/en-us/graph/graph-explorer?adlt=strict 

2. Login to graph explorer using tenant credential 

3. Run GET https://graph.microsoft.com/v1.0/me in graph explorer to confirm the current user. 

4. Run GET https://graph.microsoft.com/v1.0/sites/<hostname>:/<relativeUrl> to get the site “id”. Note the format includes host name and relative site Url separated with a colon “:”. 
   

   e.g. 
   GET https://graph.microsoft.com/v1.0/sites/m365x13156933.sharepoint.com:/sites/TargetSitesSelected 

   Sample response: 
   { 

       "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#sites/$entity", 
       "@microsoft.graph.tips": "Use $select to choose only the properties your app needs, as this can lead to performance improvements. For example: GET sites('<key>')/microsoft.graph.getByPath(path=<key>)?$select=displayName,error", 
       "createdDateTime": "2025-02-17T17:49:32.977Z", 
       "description": "", 
       "id": "m365x13156933.sharepoint.com,59ce1e8e-cb4f-44e6-9f38-99ed413d7c1d,2b139a34-a9ae-491d-a767-06948ddfa38c", 
       "lastModifiedDateTime": "2025-02-17T17:53:55Z", 
       "name": "TargetSitesSelected", 
       "webUrl": "https://m365x13156933.sharepoint.com/sites/TargetSitesSelected", 
       "displayName": "Target Sites Selected", 
       "root": {}, 
       "siteCollection": { 
           "hostname": "m365x13156933.sharepoint.com" 
       } 
   } 

5. Copy the site “id” value as returned in the above response and run  
   Post command POST https://graph.microsoft.com/v1.0/sites/<siteId>/permissions with the following request body which includes the SharePoint or Teams application id and display name. Make sure to include “/permissions” at end of command. 

   e.g. For SharePoint – Full permission 
   POST https://graph.microsoft.com/v1.0/sites/m365x13156933.sharepoint.com,59ce1e8e-cb4f-44e6-9f38-99ed413d7c1d,2b139a34-a9ae-491d-a767-06948ddfa38c/permissions 

   with request body 

   { 
   "roles": ["fullcontrol"], 
   "grantedToIdentities": [{ 
   "application": { 
   "id": "574da12a-fdd0-4b44-9c4f-b1a126167672", 
   "displayName": " Quest On Demand - Migration - SharePoint – Full" 
   } 
   }] 
   } 

   Sample Response for SharePoint permission: 
   { 
       "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#sites('m365x13156933.sharepoint.com%2C59ce1e8e-cb4f-44e6-9f38-99ed413d7c1d%2C2b139a34-a9ae-491d-a767-06948ddfa38c')/permissions/$entity", 
       "id": "aTowaS50fG1zLnNwLmV4dHw1NzRkYTEyYS1mZGQwLTRiNDQtOWM0Zi1iMWExMjYxNjc2NzJAYjcyMzY5NjktYmQ1Yy00YjVhLTg1YjQtN2MwYmIxYTdjYzll", 
       "roles": [ 
           "fullcontrol“ 
       ], 
       "grantedToIdentitiesV2": [ 
           { 
               "application": { 
                   "displayName": " Quest On Demand - Migration - SharePoint – Full", 
                   "id": "574da12a-fdd0-4b44-9c4f-b1a126167672“ 
               } 
           } 
       ], 
       "grantedToIdentities": [ 
           { 
               "application": { 
                   "displayName": " Quest On Demand - Migration - SharePoint – Full", 
                   "id": "574da12a-fdd0-4b44-9c4f-b1a126167672"   
             } 
           } 
       ] 
   } 

6. For Teams migrations, repeat step 5 for Teams application. 

 Running SharePoint migrations using Sites.Selected Permissions with ODMSP 
 
Sites.Selected on Source 

1. Update the SharePoint application for the source using the provided PowerShell script 

2. Grant the sites you want to migrate Sites.Selected permissions from Graph Explorer 

3. Discover the sites using the Discover from File Task 

4. Migrate sites as usual. 

Sites.Selected on Target 

1. Update the SharePoint application for the target using the provided PowerShell script 

2. Pre-provision target sites 

3. Grant the sites you want to migrate Sites.Selected permissions from Graph Explorer 

4. Manually update the target site “Custom scripts” settings to “Allowed”

   1. Note that the Custom script setting is automatically reset to Blocked every 24 hours (to be confirmed)
      
      

Click To See Full Image.

5. Migrate sites as usual. 

Note that if Custom script setting is reset to blocked during a migration, the Sites Pages library may not be migrated. 

 Running Teams migrations using Sites.Selected Permissions with ODM Teams 
 
Sites.Selected on Target 

1. Update the SharePoint and Teams applications for the target using the provided PowerShell script. 

2. Discover Teams or M365 Groups. 

3. Provision Teams or M365 Groups. 

4. Grant the Teams or M365 Group sites you want to migrate Sites.Selected permissions for the SharePoint and Teams applications from Graph Explorer. For Teams grant the Private and Shared channel sites Sites.Selected permissions as needed. 

5. Migrate Teams or M365 Groups as usual. 

 
Note: If you are migrating Teams and SharePoint contents using the Standard and Customized (All SharePoint Content) manually update the target site “Custom scripts” settings to “Allowed”