Microsoft Entra ID App Creation Guide for SharePoint, OneDrive and Teams Migration

When you choose manual app registration in EdbMails, Microsoft Entra ID (formerly Azure Active Directory) needs an application identity for the Microsoft 365 tenant you are connecting. This guide explains the three common tasks: create the app, create a client secret, and add Microsoft Graph application permissions with admin consent.

The exact application name and permission list depend on the migration workload and whether you are configuring the Source or Target tenant. Use the corresponding EdbMails SharePoint, OneDrive, Teams and Channel, or Private and Group Chat guide for those workload-specific values.

Quick configuration summary

Before you begin

• Sign in to the Microsoft Entra admin center with an account authorized to create app registrations and grant the required admin consent.
• Confirm that you are working in the correct Source or Target tenant before creating the application.
• Open the workload-specific EdbMails manual-registration page so you can use the exact application name and permission list for that workload.
• Plan to store the Application (Client) ID, Directory (Tenant) ID and Client Secret Value securely. These values are used when EdbMails connects to the tenant.

Steps to Manually Register an App

Click the accordions below to create the app, create a client secret, and add the required permissions.

1. Step 1: Create the application in Microsoft Entra ID

   • Sign in to the Microsoft Entra admin center.
   • Go to Microsoft Entra ID > App registrations, and select + New registration.

     

   • Enter the application name.
   • Keep the default account type.
   • Leave the Redirect URI empty unless the EdbMails instructions for your migration scenario specifically require one.
   • Click the Register button.

     

   • On the application's Overview page, copy the Application (Client) ID and Directory (Tenant) ID. Keep both values with the Source or Target configuration they belong to.

   Why the tenant matters: An app registration belongs to the tenant where it is created. Source credentials should be used for the Source connection, and Target credentials should be used for the Target connection.

2. Step 2: Create a client secret

   • Open the application you created and select Certificates & secrets.

     

   • Under Client secrets, select + New client secret and enter the Description, select the Expiration period, and click ‘Add’.

     

   • Copy the entry shown in the Value column immediately and store it securely.

     

   Important: Copy the Client Secret Value, not the Secret ID. If the Value is not saved when it is created, create a new client secret before configuring EdbMails.

3. Step 3: Add application permissions and grant admin consent

   Add Microsoft Graph application permissions

   Required Microsoft Graph permissions by workload

   Choose your migration workload, then select Source or Target to view the exact Microsoft Graph Application permissions. These quick-reference lists match the dedicated EdbMails manual-registration pages.

   SharePoint Migration+

   Use separate Source and Target applications for SharePoint migration.

   SharePoint Migration SourceView the 5 required Source permissions.View permissionsSharePoint Migration TargetView the 7 required Target permissions.View permissions

   OneDrive Migration+

   Use separate Source and Target applications for OneDrive migration.

   OneDrive Migration SourceView the 5 required Source permissions.View permissionsOneDrive Migration TargetView the 7 required Target permissions.View permissions

   Office 365 Groups Migration+

   Use separate Source and Target applications for Office 365 Groups migration.

   Office 365 Groups Migration SourceView the 5 required Source permissions.View permissionsOffice 365 Groups Migration TargetView the 7 required Target permissions.View permissions

   Teams Documents Library and Channel Migration+

   Includes Teams document libraries, channels and channel messages. The Target will be Team sites.

   EdbMails Teams and Channel Migration SourceView the 9 required Source permissions.View permissionsEdbMails Teams and Channel Migration TargetView the 12 required Target permissions.View permissions

   Private (1:1) and Group Chat Migration+

   Includes Microsoft Teams private 1:1 chats and group chats between Microsoft 365 users.

   EdbMails Groups and Teams Chat Migration SourceView the 8 required Source permissions.View permissionsEdbMails Groups and Teams Chat Migration TargetView the 6 required Target permissions.View permissions

   Steps to Add Microsoft Graph application permissions

   • Navigate to ‘Overview’ and click ‘View API permissions’

     

   • Select + Add a permission.

     

   • Select Microsoft Graph.

     

   • Select Application permissions.

     

   • Using the Source or Target permission list shown above, search for each permission in Microsoft Graph and select it. Repeat until all required permissions are selected. Then click Add permissions.

     

   Grant admin consent

   • Return to API permissions and compare the configured permissions with the Source or Target permission list on the EdbMails workload page.
   • Select Grant admin consent for your organization.

     

   • Review the requested permissions and confirm the action.

     

   • Verify that the required permissions show the granted status before continuing to EdbMails.

Verify the app registration before connecting EdbMails

• The app was created in the intended Source or Target Microsoft 365 tenant.
• The application name matches the applicable EdbMails workload guide.
• The Application (Client) ID and Directory (Tenant) ID were copied from the correct app.
• The Client Secret Value was copied and stored securely.
• Every Microsoft Graph permission listed on the workload page was added for the correct Source or Target app.
• Application permissions, not Delegated permissions, were selected where specified.
• Admin consent was granted for the configured permissions.

1. Troubleshooting manual app registration

   1. The client secret value is no longer visible

      Microsoft Entra ID displays the secret Value when it is created. If you did not save the Value, create a new client secret and use the new Value in EdbMails.

   2. The permission is present but the connection still fails

      Check whether admin consent has been granted and verify that you selected Application permissions. Adding a permission and granting consent are separate actions.

   3. The app was created in the wrong tenant

      Create the application in the correct Source or Target tenant and use the Client ID, Tenant ID and Client Secret Value from that application. Tenant-specific credentials are not interchangeable.

   4. I am not sure which permission list to use

      Do not copy permissions from another workload. Open the SharePoint, OneDrive, Teams and Channel, or Private and Group Chat manual-registration page and use the Source or Target list shown there.

1. Frequently asked questions

   1. What is a Microsoft Entra ID app registration?

      An app registration creates an application identity in a Microsoft Entra tenant. EdbMails uses the application details and the permissions configured for the migration connection.

   2. What is the difference between Application and Delegated permissions?

      Application permissions allow an application to access an API using its own identity. Delegated permissions operate on behalf of a signed-in user. The EdbMails workload pages identify the required migration permissions as Application permissions.

   3. Where can I find the Application (Client) ID and Directory (Tenant) ID?

      Open the registered application in Microsoft Entra ID and view the Overview page.

   4. Should I copy the Client Secret ID or the Client Secret Value?

      Copy the Client Secret Value. The Secret ID is not the value used for this EdbMails connection.

   5. Why do I need to grant admin consent?

      Adding a permission records what the application requests. Admin consent authorizes the configured permissions for the tenant.

   6. Do I need separate Source and Target apps?

      Yes, for the tenant-to-tenant manual configurations described in these EdbMails workload guides. Create each app in the tenant it will connect to.

   7. Does this page contain the SharePoint, OneDrive or Teams permission lists?

      Yes. In Step 3, expand the required workload and select Source or Target to view a quick-reference permission list. The dedicated workload page remains the full guide for app naming, connection details and migration-specific instructions.

---

Related EdbMails resources:

• OneDrive manual app registration
• Teams and Channel manual app registration
• Private and Group Chat manual app registration
• Manual app registration for Office 365 mailbox migration