MK Nepal Solutions

O365 Migration: register the app (App ID) in each tenant

Create an Entra ID app registration with Microsoft Graph application permissions, grant admin consent, and add the tenant in the app.

Why an app registration is needed

The Teams & Groups, OneDrive and Exchange parts of O365 Migration work tenant to tenant with Microsoft Graph application permissions: they create groups and teams, copy OneDrives and mailboxes without signing in as each user. This needs an Entra ID app registration (App ID) in the source and in the destination tenant, approved by an administrator.

The SharePoint part of O365 Migration (and SharePoint Migrator) doesn't need an App ID: it signs in as a user.

1. Register the app

  1. Open the Entra admin center → App registrations → New registration.
  2. Name it, for example O365 Migration, keep Single tenant, and click Register.
  3. Copy the Application (client) ID and the Directory (tenant) ID from the Overview page.

2. Add the permissions

Open API permissions → Add a permission → Microsoft Graph → Application permissions.

TenantTeams & GroupsOneDriveExchange
SourceGroup.Read.All, User.Read.All, Channel.ReadBasic.All, ChannelMember.Read.All, ChannelMessage.Read.All, Files.Read.AllUser.Read.All, Files.Read.AllUser.Read.All, Mail.Read, Contacts.Read, Calendars.Read
DestinationGroup.ReadWrite.All, User.Read.All, Team.Create, Channel.Create, TeamMember.ReadWrite.All, ChannelMember.ReadWrite.All, Teamwork.Migrate.All, Files.ReadWrite.AllUser.Read.All, Files.ReadWrite.AllUser.Read.All, Mail.ReadWrite, Contacts.ReadWrite, Calendars.ReadWrite

Add only the columns you need. Then click Grant admin consent for …. Optionally add Organization.Read.All so the app shows the organization name and domains.

ChannelMessage.Read.All (reading channel conversations) is a protected API. Microsoft must approve it for your app before it works: submit Microsoft's protected APIs in Microsoft Teams request form. Groups, members, channels and files can be migrated without it.
Exchange: an administrator can limit the app to some mailboxes with an application access policy (New-ApplicationAccessPolicy). If one is in place, include the mailboxes you migrate.

3. Create a secret or certificate

Open Certificates & secrets, then either:

  • Client secret: click New client secret and copy the Value. It is shown only once, and it's the Value, not the Secret ID.
  • Certificate: upload the public certificate. O365 Migration needs a PEM file containing the certificate and its private key, for example made with:
openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 730 -subj "/CN=TeamsGroupsMigrator"
type cert.pem key.pem > migrator.pem

Upload cert.pem to the app registration, and choose migrator.pem in O365 Migration.

4. Add the tenant in the app

In O365 Migration, open Tenants → Add tenant, enter the tenant ID or domain, the Application (client) ID and the secret or certificate, then click Add and test. The test signs in and lists, per feature (Teams & Groups, OneDrive, Exchange mail, contacts and calendar), which permissions are granted and which are missing.

The secret is encrypted with Windows for your user account and is only sent to Microsoft's sign-in service.

Was this article helpful?

Updated 2026-10-17