Manual App Registration for Office 365 Groups Migration

Use this guide to configure Microsoft Entra ID applications for an EdbMails Office 365 Groups migration. Create Office 365 Groups Migration Source in the Source tenant and Office 365 Groups Migration Target in the Target tenant.

This page contains the Office 365 Groups-specific application names, Source and Target permission lists, and connection checks. Use the Microsoft Entra ID App Creation Guide for the common steps to create the app, create a client secret, add Microsoft Graph Application permissions, and grant admin consent.

Quick configuration summary

Before you configure the Office 365 Groups apps

• Confirm the Microsoft 365 tenant that contains the Source Office 365 Groups and the tenant that will receive them.
• Keep the Source and Target app credentials separate so the Client ID, Tenant ID, and Client Secret Value stay matched to the correct tenant.
• Use the Source application details only for the Source connection and the Target application details only for the Target connection.
• Add the complete permission list to the corresponding app before granting admin consent.

Steps to manually register an app for Office 365 Groups Migration

Click the Source Office 365 Groups app or Target Office 365 Groups app accordion below based on the tenant you are configuring.

1. Source Office 365 Groups app

   1. Create the Source Office 365 Groups app

   Create the application in the Source tenant. Enter the application name as Office 365 Groups Migration Source.

   Click here to know the steps to create the app in Microsoft Entra ID.

   2. Create the Source client secret

   Create a client secret for Office 365 Groups Migration Source. Copy the Client Secret Value when it is displayed and keep it with the Source application details.

   Click here to know the steps to create a client secret.

   3. Add Source Office 365 Groups permissions

   Set all these permissions in the Office 365 Groups Migration Source app.

   API: Microsoft GraphPermission type: Application permissions

   • Files.Read.All
   • Group.Read.All
   • GroupMember.Read.All
   • Sites.Read.All
   • User.Read.All

   After all five permissions are selected, grant admin consent for the Source tenant.

   Click here to know steps to add Application permissions and grant admin consent.

2. Target Office 365 Groups app

   1. Create the Target Office 365 Groups app

   Create the application in the Target tenant. Enter the application name as Office 365 Groups Migration Target.

   Click here to know the steps to create the app in Microsoft Entra ID.

   2. Create the Target client secret

   Create a separate client secret for Office 365 Groups Migration Target. Copy and securely store its Client Secret Value.

   Click here to know the steps to create a client secret.

   3. Add Target Office 365 Groups permissions

   Set all these permissions in the Office 365 Groups Migration Target app.

   API: Microsoft GraphPermission type: Application permissions

   • Files.ReadWrite.All
   • Group.ReadWrite.All
   • GroupMember.ReadWrite.All
   • Sites.Create.All
   • Sites.FullControl.All
   • Sites.ReadWrite.All
   • User.Read.All

   After all seven permissions are selected, grant admin consent for the Target tenant.

   Click here to know steps to add Application permissions and grant admin consent.

Why the Source and Target Office 365 Groups permission lists are different

The Source app reads the Office 365 Groups data selected for migration. The Target app needs the permissions required to create or write the migrated content in the destination. Keep the two permission sets separate and apply each list only to its corresponding app.

1. Connect the Office 365 Groups tenants in EdbMails

   Source connection

   When connecting the Source tenant for Office 365 Groups migration, use the Application (Client) ID, Directory (Tenant) ID, and Client Secret Value from Office 365 Groups Migration Source.

   Target connection

   When connecting the Target tenant, use the corresponding credentials from Office 365 Groups Migration Target. The Client ID, Tenant ID, and Client Secret Value must all belong to the Target app in the Target tenant.

Verify the Office 365 Groups app registration before connecting EdbMails

• Office 365 Groups Migration Source exists in the Source tenant.
• The Source app contains the five Microsoft Graph Application permissions listed on this page.
• Office 365 Groups Migration Target exists in the Target tenant.
• The Target app contains the seven Microsoft Graph Application permissions listed on this page.
• Admin consent is granted after each permission list is complete.
• The Client ID, Tenant ID, and Client Secret Value used in EdbMails belong to the same Source or Target app.

1. Troubleshooting manual app registration

   1. EdbMails cannot authenticate the Office 365 Groups connection

      Confirm that the Client ID, Tenant ID, and Client Secret Value all come from the Office 365 Groups app registered in the tenant you are connecting. Then verify that admin consent has been granted for the complete permission list.

   2. The Target app does not have the expected access

      Compare the Target app with all seven Microsoft Graph Application permissions listed above. Verify that Sites.FullControl.All and the remaining Target permissions are present and have admin consent.

   3. The Source and Target app credentials were mixed

      Use only the credentials from Office 365 Groups Migration Source for the Source connection and only the credentials from Office 365 Groups Migration Target for the Target connection.

   4. I copied the Client Secret ID instead of the Client Secret Value

      EdbMails requires the Client Secret Value. If the Value is no longer visible in Microsoft Entra ID, create a new client secret in the corresponding Office 365 Groups app and copy the Value when it is displayed.

1. Frequently asked questions

   1. Are the Office 365 Groups permissions Application or Delegated permissions?

      Configure the permissions listed on this page as Application permissions under Microsoft Graph.

   2. Do the Source and Target Office 365 Groups apps use the same permissions?

      No. Use the five Source permissions shown in the Source section and the seven Target permissions shown in the Target section.

   3. Where should Sites.FullControl.All be added for the Target app?

      Add Sites.FullControl.All under Microsoft Graph > Application permissions as part of the Office 365 Groups Target permission list.

   4. Do I need separate Source and Target app registrations?

      Yes. Register the Source app in the Source Microsoft 365 tenant and the Target app in the Target tenant.

   5. Where do I create the app and client secret?

      Use the Microsoft Entra ID App Creation Guide for the common app registration and client-secret steps, then use the Office 365 Groups values on this page.

   6. Can I use these permissions for another migration workload?

      Use the dedicated manual registration page for the workload you are configuring. Each workload page provides the Source and Target permission lists required for that migration.