Registering the Metalogix Content Matrix SharePoint Client Application for OAuth Authentication
The very first time OAuth Authentication is selected, the application Metalogix Content Matrix SharePoint Client must be registered for the tenant.
IMPORTANT: Prior to version 9.2, the Metalogix SharePoint Migration Client application was used for OAuth Authentication. Jobs created before version 9.2 (including those that use PowerShell or Distributed Migration) will continue to use this application (as long as it is still registered in Azure Active Directory). Starting with version 9.2, all jobs using OAuth Authentication will use the Metalogix Content Matrix SharePoint Client application.
Required Permissions
At a minimum, the following permissions are required to register and provide consent for the Metalogix Content Matrix SharePoint Client application.
·For a site-level connection, the account must have a minimum of Site Administrator and Application Administrator permission roles.
·For a tenant-level connection, the account must have a minimum of Application Administrator permission role.
Providing Consent to Grant the Application Requested Permissions
The first time a Content Matrix user attempts to connect to SharePoint Online using Office 365 OAuth Authentication, a dialog displays requesting that you grant the permissions that the application needs to perform migrations.
A Global Administrator can check the Consent on behalf of your organization box, which will prevent this dialog from displaying for other users. If the account is not a Global Administrator, the Consent on behalf of your organization option will be hidden.
IMPORTANT: If a Global Administrator does not consent on behalf of the organization, each Content Matrix user who attempts to connect using Office 365 OAuth Authentication for the first time must sign in with an account that has the Application Administrator and SharePoint Administrator permission role.
After [Accept] is clicked, the connection is created (and the application will be registered if it does not already exist in Azure Active Directory). In addition, the token cache file ConnectionsTokenCache.dat is created in the AppData/Roaming/Metalogix folder. (Note, if you have used OAuth Authentication in an earlier version of Content Matrix, this file will already exist.)
Completing a Connection to SharePoint Online Using Office 365 OAuth Authentication
When you select one of the Office 365 OAuth authentication types, before making a connection to SharePoint Online, a pop-up specific to the authentication type will display, as described in the following table.
NOTE: If you click the Do not show the message again. box, Content Matrix will continue to use the selected option and no longer display the pop-up. You can resume having the pop-up display by clicking Reset Configuration Options on the ribbon toolbar Settings tab.
|
If you selected... |
Then ... |
|---|---|
|
Auto Detect or Office365 OAuth/Standard/ADFS Authentication |
the pop-up will ask you to confirm that you want to use the Office 365 OAuth option. Choose [Yes - Use OAuth]. |
|
Office 365 OAuth with MFA Authentication (Not Auto Detected) |
the pop-up will inform you of some migration limitations associated with this authentication type. See the topic Migration Limitations When Using Office 365 OAuth with MFA Authentication for details. |
Signing into your O365 Account to Use Office 365 OAuth Authentication
When prompted to sign into your O365 account, for Auto Detect or Office365 OAuth/Standard/ADFS Authentication, you must use the account you specified as the Connect As account in Content Matrix. The connection will fail if you try to sign in with another account. (This is not an issue with Office 365 OAuth with MFA Authentication, which does not use a Connect As account.)
IMPORTANT: If you are using OAuth Authentication for the first time, a dialog may display requesting that you consent to granting permissions that the application needs to perform migrations. To provide this consent, the account must be an Application Administrator. (This dialog will not display if a Global Administrator has granted consent on behalf of the organization.)
Migration Limitations When Using Office 365 OAuth with MFA Authentication
The following migration options are currently not supported when Office 365 OAuth with MFA is used as the Authentication Type, and they will be disabled.
NOTE: If your SPO tenant is configured for Multi Factor Authentication and it is important for you to migrate these objects, you will need to use Office 365 Web Browser Authentication instead. Office 365 OAuth/Standard/ADFS Authentication does not work in an MFA-configured environment.
·Navigation Links and Headings: Quick launch navigation (left-hand navigation) and the global navigation (top bar navigation).
NOTE: Tree View settings will be migrated.
·The following List Settings:
§Survey Options (under list settings for Survey List)
§Browser enabled InfoPath form templates (that is, they will not be browser-activated at the target)
·Web parts, unless the Import Pipeline is being used
·Nintex Forms
·Nintex Workflows
·SPD 2010 style workflows.
NOTE: Even if the options are checked, SPD 2010 style workflows and Nintex workflows will not be migrated for Office 365 OAuth with MFA Authentication. SPD 2013 style workflows, however, will be migrated.
·Content type InfoPath forms
·List and Site level content type information management policies.
Migrating to SharePoint Online Using the Import Pipeline
Metalogix Content Matrix currently has limited support for migration using the Import Pipeline.
By default, when the Use Import Pipeline option is checked on the List Content Options tab, the SPO Provided Azure Containers option is selected. However, if you want to use Azure Private Containers, you will also need to populate the Azure Storage Connection String field.
NOTE: If you upgraded from version 9.2 or earlier and have existing jobs that use Azure Private Containers, the value in the EnvironmentSettings configuration variable UploadManagerAzureStorageConnectionString will be used. For security purposes going forward, the connection string must be entered for each migration that uses Azure Private Containers. Content Matrix will no longer look for the UploadManagerAzureStorageConnectionString value in the EnvironmentSettings.xml file and you may remove it (leaving the configuration variable itself empty).
For detailed information on additional system and configuration requirements for using the Import Pipeline, please see:
·Configuring Settings for Migrations Using the Import Pipeline
·the Metalogix Content Matrix Performance Optimization Guide PDF document included in the installation ZIP file, includes instructions for configuring Azure Private Containers.