How to configure the ODM "limited permissions" migration model (4348397)

Benefits of this new "limited permissions" model in On Demand Migration (ODM):

• No Global Admin credentials are required for this option (after consent has been granted) and all migration operations will be driven by the token generated using app service principle.
• No passwords are stored in key vaults, which allows for enhanced security for the migration project.
• Changes to the Global Administrator User account that was used to Grant Consent to ODM should not impact migration operations.

Section 1 - If you are setting up On Demand Migration (ODM) for the first time and want to use the limited permissions model:

1.) Global Administrator rights are required to add the source and target tenants to the On Demand Migration (ODM) Portal.
2.) Click Tenants on the left navigation pane.
3.) Add the source Office 365 tenant to the Office 365 Portal, if not already added.
4.) Add the target Office 365 tenant to the Office 365 Portal.
5.) Click on "Edit Consents" on the source Office 365 tenant
6.) Locate the Migration heading and click "Grant Consent" for all sections under migration you intend to migrate:

Basic
Mailbox Migration
SharePoint - Also required for OneDrive migrations
Teams

NOTE: You will need to use a Global Administrator account in order to "Grant Consent" to these permissions for migration.

7.) Click on "Edit Consents" on the target Office 365 tenant
8.) Locate the Migration heading and click "Grant Consent" for all sections under migration you intend to migrate:

Basic
Mailbox Migration
SharePoint - Also required for OneDrive migrations
Teams

NOTE: You will need to use a Global Administrator account in order to "Grant Consent" to these permissions for migration.

9.) Continue to Section 3 below

Section 2 -  If you are an existing customer that would like to setup a new ODM Migration Project that uses the new limited permission model:

If you are an existing ODM customer and would like to make use of this new feature, then a new Migration Project will need to be created in the ODM Portal. Global Administrator rights will be required to "Regrant Consent" to the "Migration - Basic" permission under Tenants. Here are the steps to "Regrant Consent":

1.) Click Tenants on the left navigation pane
2.) Click on "Edit Consents" on the source Office 365 tenant
3.) Locate the Migration heading and Basic
4.) Click "Regrant Consent"

NOTE: You will need to provide Global Administrator credentials in order to "Regrant Consent"

5.) Click on "Edit Consents" on the target Office 365 tenant
6.) Locate the Migration heading and Basic
7.) Click "Grant Consent"
8.) Continue to Section 3 below

Section 3 - You are now ready to create a new Migration Project using the new limited permissions model that does not require ongoing Global Administrator rights. Here are the steps:

1.) Click Migration on the left navigation pane
2.) Click New Project
3.) Select the Source tenant
4.) Select the Target tenant
5.) Click Save and Continue

6.) Leave the source and target credentials sections blank to invoke the "limited permissions" migration model
7.) Click Save and Continue

The setup of this new ODM Migration Project is now complete. The Global Administrator account will no longer tied to migration operations performed by On Demand Migration.

*Note: There are limitations to this new limited permissions model. If you select the option to "Do not provide Admin Credentials", as described in the steps above, the following operations will fail:

    Accounts tab
        Guest User Migration
        Process Resources

    OneDrive tab
        Target Provision

    Public Folders
        Migration

OneDrive can be provisioned outside of ODM by following the steps in this Microsoft article.

We do recommend to check ODM documentation for any limitations and considerations for each migration workflow due the often changes.