Essentials for Office 365 2.14 - Installation Guide

SharePoint Permissions Setup

To work with SharePoint locations, you must set up a valid level of permissions. When you work with individual Sites or Site Collections in the Navigator pane of Essentials, the lowest level of user to connect to a site is a Site contributor. However, this level allows a minimal list of actions (view structure, views, content etc.). With this permissions level, for example, we reconnect to use users who have direct site collection administrator permissions.

When you work in Hyper Migration Mode and do bulk migrations using SharePoint Administrator or Global administrator. An account with less privileges will only be able to perform a limited set of migrations.

The Essentials tool requests certain user roles to start and successfully finish hyper migration or hyper backup jobs. These administrative accounts are required to connect to the tenant level, to each site collection, users OneDrive’s, Office 365 groups, Microsoft Teams sites, etc. In order to connect to all of this you must be either a Global Administrator or a SharePoint Administrator. If you use an Exchange Administrator or Billing Administrator, or any other user role, the Migration will fail. This is because Essentials will not be able to access the target site collection in order to upload content and/or the azure job would be restricted by Office 365.  

Firewall Permission Setup

URLs that need to be Unblocked.

OAuth Permissions

The first time that OAuth Authentication is selected when connecting to SharePoint Online, the Quest SharePoint Migration Client application must be registered for the tenant.

It is recommended that an account with the Global Administrator role be used to register the application, because a Global Administrator can provide consent on behalf of the entire organization. In the event that a Global Administrator does not register the application, users with the Application Administrator role can register the application for their own account only.

IMPORTANT: For an Application Administrator, the the Quest SharePoint Migration Client application records current SharePoint permissions as part of the registration process. Therefore, a user who registers as an Application Administrator must already have the appropriate permissions to connect and perform migrations using OAuth authentication. For example, at the time of registration, a user who is going to make tenant-level connections must also be a SharePoint Administrator if they want the app to allow them to access to all site collections within the tenant and to be able to Paste as a Site Collection. Similarly, a user who will be migrating Managed Metadata must also be a Term Store Administrator at the time of registration.

Account Permission Requirements

The following table provides an overview of the Account Permission required to perform various operations for and with Essentials.