On Demand Migration Current - Permissions Reference Guide

Permissions Summary

IMPORTANT: When you run a discovery task on tenants for certain assets like Accounts and Mailboxes, the Exchange Administrator role is assigned to the corresponding Enterprise Application (service principal). This role assignment occurs automatically to retrieve mail attributes via Exchange Online PowerShell.

Consent Permission Types are Application (A) and Delegated (D).

Quest On Demand - Core - Basic

Purpose: Initial tenant setup. Required for source and target tenant

Permission Description API Type Purpose
Directory.Read.All Read directory data Graph A To read directory objects information to establish tenant connectivity and validate the environment.
Organization.Read.All Read organization information Graph A, D To read tenant-level properties such as tenant ID.
profile View users' basic profile Graph A To read the basic profile of the signed-in admin to authenticate the initial tenant connection.
Quest On Demand - Migration - Basic - Minimal

Purpose: Account discovery and migration. Required for source tenant

Permission Description API Type Purpose
Directory.Read.All Read directory data Graph A To read all directory objects (users, groups, contacts) and their properties.
Group.Read.All Read all groups Graph A To read all group objects and their properties.
RoleManagement.ReadWrite.Directory Read and write all directory RBAC settings Graph A To assign the Exchange Admin role to the enterprise application. Without this permission, the product cannot use Exchange Online PowerShell to read Exchange Online objects.

The Permission can be removed by following the manual steps documented in KB 4381368.

Exchange.ManageAsApp Manage Exchange As Application Exchange Online A To run Exchange Online PowerShell commands to read mail-enabled objects and their attributes.
Quest On Demand - Migration - Basic - Full

Purpose: Account discovery and migration. Required for target tenant

Permission Description API Type Purpose
Directory.ReadWrite.All Read and write directory data Graph A To read and write all directory objects (users, groups, and contacts) to provision and update accounts on the target.
Exchange.ManageAsApp Manage Exchange As Application Exchange Online A To run Exchange Online PowerShell commands to read and update mail attributes.
Group.ReadWrite.All Read and write all groups Graph A To read and write all group objects.
RoleManagement.ReadWrite.Directory Read and write all directory RBAC settings Graph A To assign the Exchange Admin role to the enterprise application. Without this permission, the product cannot use Exchange Online PowerShell to read Exchange Online objects.

The Permission can be removed by following the manual steps documented in KB 4381368.

User.ReadWrite.All Read and write all users' full profiles Graph A To read and write user objects, including properties such as on-premises ImmutableId.
Quest On Demand - Migration - Mailbox Migration - Minimal

Purpose: Mailbox discovery and migration. Required for source tenant

Permission Description API Type Purpose
Calendars.Read Read calendars in all mailboxes Graph A To retrieve and filter calendar items that are not accessible via the generic item endpoint. Also used for meeting links migration.
full_access_as_app Use Exchange Web Services with full access to all mailboxes Exchange Online A To enable all migrations relying on EWS (Exchange Web Services).
Domain.Read.All Read domains Graph A To validate input SMTP addresses and select the correct UPN suffix.
Mail.Read Read mail in all mailboxes Graph A To retrieve and filter by message-specific properties such as ‘isRead’. These properties cannot be accessed via MailboxItem.Read.All.
MailboxFolder.Read.All Read all the users' mailbox folders Graph A To scan the mailbox folder structure for migration planning.
MailboxItem.Export.All Export all the users' mailbox items Graph A To export the mailbox content in batches during migration.
MailboxItem.Read.All Read all the users' mailbox items Graph A To retrieve and filter by mailbox generic item metadata.
MailboxSettings.Read Read all user mailbox settings Graph A To read mailbox settings and identify mailbox IDs
Tasks.Read.All Read all users' tasks and tasklist Graph A To retrieve and filter tasks that are not accessible via the generic item endpoint.
User.Read.All Read all users' full profiles Graph A To resolve primary SMTP addresses for sensitivity labels and rules.
Quest On Demand - Migration - Mailbox Migration - Full

Purpose: Mailbox discovery and migration. Required for target tenant.

Permission Description API Type Purpose
Calendars.Read.Shared Read user and shared calendars Graph D Used for meeting link migration for mailbox activation.
Calendars.ReadWrite Read and write calendars in all mailboxes Graph A To read and write calendar events for migration, meeting links migration, and mailbox reset.
full_access_as_app Use Exchange Web Services with full access to all mailboxes Exchange Online A To all migrations relying on EWS (Exchange Web Services).
Contacts.ReadWrite Read and write contacts in all mailboxes Graph A To read and write contacts for mailbox migrations and mailbox reset operations.
Mail.ReadWrite Read and write mail in all mailboxes Graph A To read and write filter message-specific properties such as ‘isRead’, for mailbox migrations and mailbox reset tasks.
MailboxFolder.ReadWrite.All Read and write all the users' mailbox folders Graph A To scan and create a mailbox folder structure on the target.
MailboxItem.ImportExport.All Allows the app to perform backup and restore for all mailbox items Graph A To write mailbox data in batch during migration.
MailboxItem.Read.All Read all the users' mailbox items Graph A To retrieve and filter by mailbox item metadata.
MailboxSettings.ReadWrite Read and write all user mailbox settings Graph A To read and write mailbox settings for mailbox migrations and mailbox reset tasks.
Tasks.ReadWrite.All Read and write all users tasks and tasklists Graph A To migrate tasks for mailbox migrations and mailbox reset tasks that cannot be accessed via the generic 'item' endpoint.
User.Read.All Read all users' full profiles Graph A To resolve primary SMTP addresses for sensitivity labels and rules.
Quest On Demand - Migration - Mailbox Migration - Custom RBAC

Purpose: Authorize the migration of selected mailboxes only. Exchange Online RBAC permissions must be set up in the tenant for Exchange Web Services (EWS) to ensure that On Demand Migration can migrate mailbox data for users within the scope of the RBAC configuration. Additional consents are required when used in source or target tenants. Detailed implementation instructions are available in the Knowledge Base or you can contact Quest Technical Support for assistance.

Permission Description API Type Purpose
Directory.Read.All Read directory data Graph A To read Users, Groups objects, and retrieve the tenant domain name.
Quest On Demand - Migration - OneDrive - Minimal

Purpose: OneDrive discovery. Required for source tenant

Permission Description API Type Purpose
Files.Read.All Read files in all site collections Graph A To read all files for the user OneDrive.
Sites.FullControl.All Have full control of all site collections SPO A To retrieve all source tenant, OneDrive information. Without this level of permission, versions and permission of items cannot to be retrieved from source. This permission can be replaced with Sites.Selected permission. For more information, see Sites.Selected Permissions and On Demand Migration for OneDrive (4382683)

Note: a dedicated OneDrive Sites.Selected application will be added to On Demand Migration soon.

Quest On Demand - Migration - OneDrive - Full

Purpose: OneDrive migration. Required for target tenant

Permission Description API Type Purpose
Directory.Read.All Read directory data Graph A To read Users, Groups objects, and retrieve the tenant domain name.
Files.Read.All Read files in all site collections Graph A To read all files for the user OneDrive.
Sites.FullControl.All Have full control of all site collections SPO A To retrieve all source tenant, OneDrive information. Without this level of permission, versions and permission of items cannot to be retrieved from source. This permission can be replaced with Sites.Selected permission. For more information, see Sites.Selected Permissions and On Demand Migration for OneDrive (4382683)

Note: a dedicated OneDrive Sites.Selected application will be added to On Demand Migration soon.

Quest On Demand - Migration - Power BI

Purpose: Power BI migration. Required for source and target tenant

Permission Description API Type Purpose
profile View users' basic profile Graph D Read only permission, required to allow to install application for the tenant. Main permissions which allow access data are set manually by customer for service principal (which is “Quest On Demand - Migration - Power BI” enterprise application).
Quest On Demand - Migration - Power Platform

Purpose: This application is required for Power Platform migrations. The consent granted to this application allows On Demand Migration to access Microsoft Entra ID and the Power Platform service APIs to read user information and Power Platform content from the source tenant and write that content to the target tenant.

Permission Description API Type Purpose
Connectivity.Connections.Read Read connections Power Platform D View Power Platform connection instances (for example SharePoint, Outlook, SQL connections).
Connectivity.Connectors.Read Read connectors Power Platform D View available Power Platform connectors and their metadata.
EnvironmentManagement.Environments.Read Read environments Power Platform D Allows reading of environments.
Flows.Manage.All Allow the application to manage flows Power Automate D Create, update, delete, enable, disable, and otherwise administer Power Automate flows.
Flows.Read.All Allow the application to read flows Power Automate D Read flows accessible to the app, typically for inventory, monitoring, or reporting.
Flows.Read.Plans Allow the application read only permission for flow Power Automate D Read flow plans, licensing, or plan-related information without modification.
PowerApps.Apps.Read Read Power App Power Platform D Access all Power Apps and its dependencies
PowerAutomate.Flows.Read Read Power Automate Flows Power Platform D Read Power Automate flow definitions, metadata, and properties.
ResourceQuery.Resources.Read Query resources Power Platform D Query resources to search and discover Power Platform resources across environments.
User Access the PowerApps Service API (Legacy delegated permission used by Power Apps APIs.) PowerApps Service D Sign in as a user and access Power Apps service resources that the user can access.
User.Read.All Read all users' full profiles Graph D Read the full set of profile properties, reports, and managers of other users in your tenant, on behalf of the signed-in user.
User_impersonation Access Common Data Service as organization users Dynamics CRM D Access Dataverse data and operations under the permissions of the signed-in user.
User_impersonation Access Power Query Online Microsoft Power Query D Access Power Query Online on behalf of the signed-in user.
Quest On Demand - Migration - SharePoint - Minimal

Purpose: SharePoint discovery. Required for source tenant

Permission Description API Type Purpose
Directory.Read.All Read directory data Graph A To validate user and AD groups, and retrieve tenant domain name. Without this permission SharePoint project cannot be set up.
Files.Read.All Read files in all site collections Graph A Used for CSOM export mode. Not required for default export mode.
Sites.FullControl.All Have full control of all site collections SPO A To retrieve all source tenant, site, web and list information. Without this level of permission, versions and permission of items cannot to be retrieved from source.
Sites.Read.All Read items in all site collections SPO A Used for CSOM export mode. Not required for default export mode.
Sites.Read.All Read items in all site collections Graph A Used by Teams to retrieve information about OneDrive items, OneDrive item permission, sharing links and list items used for archiving Chats.
TermStore.Read.All Read managed metadata SPO A To read termgroup, termset and terms details using CSOM. Without this permission our term store discovery and migration will not work.
TermStore.Read.All Read all term store data Graph A To read termgroup, termset and terms details in paginated form using Graph API. Without this permission our term store discovery and migration will not work.
Quest On Demand - Migration - SharePoint - Full

Purpose: SharePoint migration. Required for target tenant

Permission Description API Type Purpose
Directory.Read.All Read directory data Graph A To validate user and AD groups, and retrieve tenant domain name. Without this permission SharePoint project cannot be set up.
Files.Read.All Read files in all site collections Graph A Used for CSOM export mode. Not required for default export mode.
Sites.FullControl.All Have full control of all site collections SPO A To add and update site, web, list SharePoint objects on the target. Without this permission SharePoint migration is not possible.
Sites.Read.All Read items in all site collections SPO A Used for CSOM export mode. Not required for default export mode.
Sites.ReadWriteAll Read and write items in all site collections Graph A Used by Teams to read and update information about OneDrive items, OneDrive item permission, sharing links and list items used for archiving Chats.
TermStore.Read.All Read all term store data Graph A To read termgroup, termset and terms details in paginated form using Graph API. Without this permission our term store discovery and migration will not work.
TermStore.ReadWrite.All Read and write managed metadata SPO A To read and write termgroup, termset and terms details using CSOM. Without this permission our term store discovery and migration will not work.
Quest On Demand - Migration - SharePoint - Selected Sites

Purpose: SharePoint migration. Can be used for the source or target tenant to limit access to specific SharePoint sites.

Permission Description API Type Purpose
Directory.Read.All Read directory data Graph A To validate user and AD groups, and retrieve tenant domain name. Without this permission SharePoint project cannot be set up.
Sites.Selected Access selected site collections Graph A Allows customers to grant access to specific SharePoint site collections, rather than the entire tenant. To read site, web, list SharePoint objects on the source, and add and update site, web, list SharePoint objects on the target. Without this permission SharePoint migration is not possible.
Sites.Selected Access selected site collections SPO A Allows customers to grant access to specific SharePoint site collections, rather than the entire tenant. To read site, web, list SharePoint objects on the source, and add and update site, web, list SharePoint objects on the target. Without this permission SharePoint migration is not possible.
Quest On Demand - Migration - Teams - Minimal

Purpose: Teams, M365 Groups, and Chat discovery. Required for source tenant

Permission Description API Type Purpose
Authorization.ReadWrite Teams Authorization ReadWrite Teams D To read channel settings for private and shared channels during the Teams Provision task.
ChannelMember.ReadWrite.All Add and remove members from all channels Graph A To add the migration service account to channels so that migrations requiring Graph delegated permissions can work, and to migrate channel membership.
ChannelMessage.Read.All Read all channel messages Graph A To migrate channel post messages.
ChannelSettings.ReadWrite.All Read the names, descriptions, and settings of all channels Graph A To migrate channel settings for standard channels.
Chat.Read.All Read all chat messages Graph A To migrate private chat messages.
ChatMember.ReadWrite.All Read the members of all chats Graph A To migrate private chat members.
Directory.Read.All Read directory data Graph D To perform prerequisite checks for migration service account roles, since the user must have Global Admin or Teams Admin role to create groups or teams with the proper settings.
Group.ReadWrite.All Read and write all groups Graph A To add the migration service account to groups so that migrations requiring Graph delegated permissions can work, and to migrate group membership.
GroupMember.ReadWrite.All Read and write all group memberships Graph A To migrate group settings.
Notes.Read.All Read all OneNote notebooks Graph A To migrate OneNote notebooks for Teams in education tenants.
Reports.Read.All Read all usage reports Graph A To discover user chat message counts during chat discovery.
Tasks.Read.All Read all users’ tasks and tasklist Graph A To migrate Planner tasks.
TeamMember.ReadWrite.All Add and remove members from all teams Graph A, D To add the migration service account to teams so that migrations requiring Graph delegated permissions can work, and to migrate team membership.
TeamsAppInstallation.ReadForTeam.All Read installed Teams apps for all teams Graph A To migrate channel tabs.
TeamSettings.Read.All Read all teams' settings Graph A To migrate team settings.
TeamSettings.ReadWrite.All Read and change teams' settings Graph D To archive source team with SharePoint readonly option
TeamsTab.ReadWrite.All Read tabs in Microsoft Teams. Graph A To migrate channel tabs.
TeamworkTag.Read.All Read tags in Teams Graph A To migrate team tags.
User.Read.All Read all users' full profiles Graph A To get migration service account user information during post and chat migration, and also used in chat discovery and chat migration.
user_impersonation Have full access to the Chat Service Aggregator and Skype Teams Service Teams, Chat Aggregator D To migrate channel settings for private and shared channels.
Quest On Demand - Migration - Teams - Full

Purpose: Teams, M365 Groups, and Chat migration. Required for target tenant

Permission Description API Type Purpose
Authorization.ReadWrite Teams Authorization ReadWrite Teams D To read channel settings for private and shared channels during the Teams Provision task.
ChannelMember.ReadWrite.All Add and remove members from all channels Graph A To add the migration service account to channels so that migrations requiring Graph delegated permissions can work, and to migrate channel membership.
ChannelMessage.Read.All Read all channel messages Graph A To migrate channel post messages.
ChannelMessage.Send Send channel messages Graph D To migrate channel post messages.
ChannelSettings.ReadWrite.All Read and write the names, descriptions, and settings of all channels Graph A To migrate channel settings for standard channels.
Chat.Read.All Read all chat messages Graph A To migrate private chat messages.
Chat.ReadWrite Read and write user chat messages Graph D To migrate private chat messages.
ChatMember.ReadWrite.All Add and remove members from all chats Graph A To migrate private chat members.
Directory.Read.All Read directory data Graph D To perform prerequisite checks for migration service account roles, since the user must have Global Admin or Teams Admin role to create groups or teams with the proper settings.
Directory.ReadWrite.All Read and write directory data Graph A To create Teams or Groups in a multi-geo environment.
GroupMember.ReadWrite.All Read and write all groups Graph A To add the migration service account to groups so that migrations requiring Graph delegated permissions can work, and to migrate group membership.
Group.ReadWrite.All Read and write all groups Graph A, D To migrate group settings.
Notes.ReadWrite.All Read and write all OneNote notebooks Graph A To migrate OneNote notebooks for Teams in education tenants.
Reports.Read.All Read all usage reports Graph A To discover user chat message counts during chat discovery.
Tasks.ReadWrite.All Read and write all users’ tasks and tasklists Graph A To migrate Planner tasks.
TeamMember.ReadWrite.All Add and remove members from all teams Graph A, D To add the migration service account to teams so that migrations requiring Graph delegated permissions can work, and to migrate team membership.
TeamsAppInstallation.ReadWriteForTeam.All Manage Teams apps for all teams Graph A To migrate channel tabs.
TeamSettings.ReadWrite.All Read and change all teams' settings Graph A To migrate team settings.
TeamsTab.ReadWrite.All Read and write tabs in Microsoft Teams Graph A To migrate channel tabs.
Teamwork.Migrate.All Create chat and channel messages with anyone's identity and with any timestamp Graph A To migrate channel post messages using the Teams Import API.
TeamworkTag.ReadWrite.All Read and write tags in Teams Graph A To migrate team tags.
User.Read.All Read all users' full profiles Graph A To get migration service account user information during post and chat migration, and also used in chat discovery and chat migration.
user_impersonation Have full access to the Chat Service Aggregator and Skype Teams Service Teams D To migrate channel settings for private and shared channels.

You can enhance the security of SharePoint Online (SPO), by ensuring that On Demand Migration for Teams has access only to specific SharePoint sites, preventing unnecessary exposure to other sites in the environment. To achieve selected access, you must configure the Sites.Selected permission which is part of the permissions model for controlling access to specific SharePoint sites or site collections. See the Knowledge Base for more details or contact Quest Technical Support for assistance with this implementation.

When implemented, Site.Selected replaces the Sites.ReadWrite.All permissions.

Quest - Migration - Teams - App Only Permissions

Purpose: Access the source tenant using application permissions only. Avoids all delegated permissions and does not add a migration service account to Teams on the source. Use this application when you need to minimal permissions during migration or meet strict compliance requirements.

Permission Description API Type Purpose
ChannelMember.Read.All Read members from all channels Graph A To read the members of all channels, without a signed‑in user.
ChannelMessage.Read.All Read all channel messages Graph A To read all channel messages in Microsoft Teams.
ChannelSettings.Read.All Read the names, descriptions, and settings of all channels Graph A To read all channel names, channel descriptions, and channel settings, without a signed-in user.
Chat.Read.All Read all chat messages Graph A To read all 1-to-1 or group chat messages in Microsoft Teams.
ChatMember.Read.All Read the members of all chats Graph A To read the members of all chats, without a signed-in user.
Group.Read.All Read all groups Graph A To read group properties and memberships, and read the calendar and conversations for all groups, without a signed-in user.
GroupMember.Read.All Read all group memberships Graph A To read memberships and basic group properties for all groups without a signed-in user.
Notes.Read.All Read all OneNote notebooks Graph A To read all OneNote notebooks in your tenant without a signed‑in user.
Reports.Read.All Read all usage reports Graph A To read all service usage reports without a signed-in user. Services that provide usage reports include Office 365 and Microsoft Entra ID.
Tasks.Read.All Read all users' tasks and task list Graph A To read all users' tasks and task lists in your tenant, without a signed-in user.
TeamMember.Read.All Read members from all teams Graph A To read the members of all teams in the entire tenant, without a signed‑in user.
TeamsAppInstallation.ReadForTeam.All Read installed Teams apps for all teams Graph A To read the Teams apps that are installed in any team, without a signed-in user. Does not give the ability to read application-specific or user-specific app settings.
TeamSettings.Read.All Read all teams' settings Graph A To read all team's settings, without a signed-in user.
TeamsTab.Read.All Read tabs in Microsoft Teams Graph A To read the names and settings of tabs inside any team in Microsoft Teams, without a signed-in user. This does not give access to the content inside the tabs.
TeamworkTag.Read.All Read tags in Microsoft Teams Graph A To read tags in Teams without a signed-in user
User.Read.All Read all users' full profiles Graph A To read the full set of profile properties, group membership, reports and managers of other users in your tenant, without a signed-in user.
Quest On Demand - Migration - Directory Sync- Minimal

Purpose: Directory Sync. Required for source tenant

Permission Description API Type Purpose
Device.Read.All Read all devices Graph A To read all device objects for directory synchronization.
Domain.Read.All Read domains Graph A To read accepted domains for environment validation.
Exchange.ManageAsApp Manage Exchange As Application Exchange Online A To run Exchange Online PowerShell commands to read mail-enabled objects and their mail attributes.
Group.Read.All Read all groups Graph A To read all group objects for directory synchronization.
OrgContact.Read.All Read organizational contacts Graph A To read all contact objects for directory synchronization.
RoleManagement.ReadWrite.Directory Read and write all directory RBAC settings Graph A To assign Exchange, User, and Teams Admin roles to the enterprise application.

Without the Exchange Admin role, the product cannot read mail attributes or use attribute filters for environment scoping.

Without the User Admin role, the product cannot read full user properties.

Without the Teams Admin role, the product cannot read Teams objects.

User.Read.All Read all users' full profiles Graph A To read all user objects for directory synchronization.
Quest On Demand - Migration - Directory Sync- Full

Purpose: Directory Sync. Required for source tenant

Permission Description API Type Purpose
Device.ReadWrite.All Read and write devices Graph A To read and write all device objects for directory synchronization.
Domain.Read.All Read domains Graph A To read accepted domains for environment validation.
Exchange.ManageAsApp Manage Exchange As Application Exchange Online A To run Exchange Online PowerShell commands to read mail-enabled objects and their mail attributes.
Group.ReadWrite.All Read and write all groups Graph A To read and write all group objects for directory synchronization.
OrgContact.ReadWrite.All Read organizational contacts Graph A To read and write all contact objects for directory synchronization.
RoleManagement.ReadWrite.Directory Read and write all directory RBAC settings Graph A

To assign Exchange, User, and Teams Admin roles to the enterprise application.

Without the Exchange Admin role, the product cannot read and write mail attributes or use attribute filters for environment scoping.

Without the User Admin role, the product cannot read and write full user properties.

Without the Teams Admin role, the product cannot read and write Teams objects.

User.ReadWrite.All Read and write all users' full profiles Graph A To read and write all user objects for directory synchronization.
Quest On Demand - Migration - EntraID Devices

Purpose: EntraID Device Migration. Required for source and target tenant.

Permission Description API Type Purpose
Device.Read.All Read all devices Graph A To read all device objects.
DeviceManagementConfiguration.ReadWrite.All Read and write Microsoft Intune device configuration and policies Graph A To allow the application to enroll devices to Intune and set the Primary User.
DeviceManagementManagedDevices.ReadWrite.All Read and write Microsoft Intune devices Graph A To read and remove the Device Autopilot Serial Hash from the tenant.
DeviceManagementServiceConfig.ReadWrite.All Read and write Microsoft Intune configuration Graph A To allow the application to enroll devices to Intune and set the Primary User.
Domain.Read.All Read domains Graph D To read accepted domains.
Exchange.ManageAsApp Manage Exchange As Application Exchange Online D To run Exchange Online PowerShell commands to read mail-enabled objects and their mail attributes.
Group.Read.All Read all groups Graph D To read all group objects.
RoleManagement.ReadWrite.Directory Read and write all directory RBAC settings Graph D To assign Exchange Admin roles to the enterprise application.

Without the Exchange Admin role, the product cannot read mail attributes or use attribute filters for environment scoping.

User.Read.All Read all users' full profiles Graph A, D To read the full set of profile properties, group membership, reports and managers of other users in your tenant, without a signed-in user.
Quest On Demand - Migration - Domain Rewrite

Purpose: Email Address Rewrite between tenants.

Permission Description API Type Purpose
Domain.Read.All Read domains Graph A To read accepted domains.
Exchange.ManageAsApp Manage Exchange As Application Exchange Online A To assign Exchange Admin roles to the enterprise application.

Without the Exchange Admin role, the product cannot read mail attributes or use attribute filters for environment scoping.

The Exchange Admin Role is also needed to create transport rules and connectors that are needed for email address rewrite.

Group.Read.All Read all groups Graph A To read all group objects.
RoleManagement.ReadWrite.Directory Read and write all directory RBAC settings Graph A To assign Exchange Admin roles to the enterprise application.

Without the Exchange Admin role, the product cannot read mail attributes or use attribute filters for environment scoping.

User.Read.All Read all users' full profiles Graph A To read the full set of profile properties, group membership, reports and managers of other users in your tenant, without a signed-in user.
Quest On Demand - Migration - Domain Move

Purpose: Move M365 Accepted Domain between tenants

Permission Description API Type Purpose
Domain.ReadWrite.All Read and write domains Graph A To read accepted domains.
Exchange.ManageAsApp Manage Exchange As Application Exchange Online A To run Exchange Online PowerShell commands to read mail-enabled objects and their mail attributes.
Group.ReadWrite.All Read and write all groups Graph A To read and write all group objects.
OrgContact.ReadWrite.All Read organizational contacts Graph A To read and write all contact objects.
RoleManagement.ReadWrite.Directory Read and write all directory RBAC settings Graph A To assign Exchange Admin roles to the enterprise application.

Without the Exchange Admin role, the product cannot use Exchange Online PowerShell to read and write mail attributes.

User.ReadWrite.All Read and write all users' full profiles Graph A To read and write all user objects.
Quest On Demand - Migration - AIP protected content migration - Read

Purpose: Required for the source tenant. Allows On Demand Migration to read sensitivity labels from the Microsoft Information Protection Sync Service and the Azure Rights Management Service.

Permission Description API Type Purpose
Content.SuperUser Read all protected content for this tenant AIP A To read and remove sensitivity labels from mail and files for Mailbox, OneDrive, and SharePoint
UnifiedPolicy.Tenant.Read Read all unified policies of the tenant MIP A To read sensitivity labels and associated policies
Quest On Demand - Migration - AIP protected content migration - Write

Purpose: Required for the target tenant only, and not the source. Allows On Demand Migration to read sensitivity labels from the Microsoft Information Protection Sync Service and write to the Azure Rights Management Service.

Permission Description API Type Purpose
Content.Writer Create protected content AIP A To apply sensitivity labels to mail and files for Mailbox, OneDrive, and SharePoint.
UnifiedPolicy.Tenant.Read Read all unified policies of the tenant MIP A To read sensitivity labels and associated policies

Office 365 Role Requirements

For Tenant Administrator
Asset Tenant Required Privileges MFA Allowed Purpose Additional Notes
Accounts, Mailboxes, OneDrive, SharePoint Source, Target Global Administrator role, which can be removed after consents are granted. Yes Grant consents, which creates ODM application service principals in the tenant. The Tenant Administrator account can be used for all assets and features.
Teams, M365 Groups Source, Target See Notes 1, 2 and 3 Yes Grant consents, which creates ODM application service principals in the tenant.

Provisions target Teams and M365 Groups, updates membership, and migrates Teams chats.

Migrates Group Mailboxes for Teams and M365 Groups.

See Notes 4 and 5.

Public Folders Migration Source, Target Owner permission for root Public Folders Yes Migrates public folders. Required if public folder migrations are in scope. ODM needs only the username; password is not required.
OneDrive Provisioning Target SharePoint Administrator role No Provisions target OneDrive accounts. Required if target OneDrive accounts are not pre-provisioned.

IMPORTANT: The temporary Migration Service account is highly recommended for Teams migration. You must login to the tenant as the Migration Service account and grant the consents and permissions to the On Demand service principal.. See Migration Service account in the Roles topic for more details.

Caution: If you do not use the Migration Service account and use a person account like the Tenant Administrator or a personal user account, the account name appears as the author of all migrated channel messages and chat messages.

NOTE: The following information is relevant to the migration of Teams and M365 Groups.

  1. For Source tenant
    • If Migration - Teams - Minimal consent is used then the Global Administratorrole can be replaced with the Teams Administrator role after the consent is granted.
    • If Migration - Teams - App Only Permissions consent is used then the Global Administrator role can be revoked after consent is granted. The Migration Service account is not required, and no additional permissions or licenses are needed.
  2. For Target tenant
    • The Global Administrator role is required to grant the Migration - Teams - Full consent. After consent is granted, the role can be replaced with both the Teams Administrator and Exchange Administrator roles.
  3. The Tenant Administrator or Migration Service account that grants the consents in the source (excluding Migration – Teams – App Only Permissions) and target tenants also requires the following:
    • an active Microsoft 365 license
    • Microsoft Teams app enabled within the Microsoft 365 license
    • the account must remain active for the duration of the migration
  4. The Migration Service account will always be added to target teams as an owner during migration. The Migration Service account name appears as the author of all migrated channel messages and chat messages. The original author and timestamp are preserved in the message body.
  5. After migration is complete, the Remove Migration Service Account task can be used to remove the migration service account from source and target teams.

Active Directory Permission Requirements

For Tenant Administrator
Asset Tenant Required Privileges MFA Allowed Purpose Additional Notes
Domain Rewrite, Domain Move, Directory Sync, Active Directory Migration Source, Target Global Admin role, which can be removed after consents are granted and PowerShell accounts are created.

Exchange Admin, Teams Admin, User Admin roles.

 Yes Grant consents, which creates an ODM application service principal in the tenant.

Auto-creates PowerShell accounts and a mail-enabled security group using an OAuth Token. Auto-assigns required privileges to the PowerShell accounts.

 Global Admin role must be reactivated during a Domain Move to auto-elevate the PowerShell accounts.
For PowerShell Accounts
Asset Tenant Required Privileges MFA Allowed Purpose Additional Notes
Directory Sync, Active Directory Migration Source, Target Exchange Admin, Teams Admin, User Admin roles. No Reads and updates tenant objects. Account names will be in the format of BinaryTreeCDSPowerShell.[GUID]
Domain Rewrite, Domain Move Source, Target Exchange Admin, Teams Admin, User Admin roles, with active Exchange Online license.

Account will be auto-elevated to Global Admin during a Domain Move.

 No Reads and updates tenant objects.

Auto-creates transport rules, connectors, and distribution groups for domain rewrite and advanced domain move functions.

 Account names will be in the format of BinaryTreePowerShell.[GUID] and BinaryTreeCDSPowerShell.[GUID]
For Domain Account
Asset Tenant Required Privileges MFA Allowed Purpose Additional Notes
Domain Rewrite, Domain Move, Directory Sync, Active Directory Migration Source, Target Permissions to read and update Active Directory objects in scope. N/A Reads and updates Active Directory objects. Required if local Active Directory environments are in scope.
Password Sync Source, Target Member of Administrators group or Domain Admins group N/A Sync passwords from source Active Dircetory to target Active Directory. Required if password sync is in scope.
SID History Migration Source Member of Administrators group or Domain Admins group N/A Sync SID History from source Active Directory to target Active Directory Required if SID History migration is in scope
SID History Migration Target Member of Administrators group or Domain Admins group or assigned Delegated migrateSIDHistory permissions N/A Sync SID History from source Active Directory to target Active Directory Required if SID History migration is in scope
Self Service Tools
Knowledge Base
Notifications & Alerts
Product Support
Software Downloads
Technical Documentation
User Forums
Video Tutorials
RSS Feed
Contact Us
Licensing Assistance
Technical Support
View All
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating