#Fly App Profile Permissions

The Tenant Owner and Service Administrators can create a Fly app profile in AvePoint Online Services > Management > App management to connect to the Microsoft 365 tenant via the Fly app.

Refer to the following steps to create a Fly app profile:

*Note: If your app profile using the Fly app cannot be created or authorized, you can check if it is due to an Azure Rights Management Service issue in your tenant. Refer to the How to Check and Activate Azure Rights Management Service? section for details.

1. Click Create on the App management page.

2. On the Create app profile page, select a Microsoft 365 tenant where you want to create the app profile.

   *Note: Make sure your selected tenant has been connected to AvePoint Online Services.

3. Click Fly, and click Next.

4. Click Modern mode.

5. Click Consent of Fly to consent to the Fly app.

6. On the Microsoft 365 sign-in page, sign in with a Microsoft 365 Global Administrator account to consent to the app. The Microsoft 365 Global Administrator account is a requirement from Microsoft. Refer to the for more information.

   *Note: This account will be added as a Service Administrator of AvePoint Online Services if the account does not already exist in any existing AvePoint Online Services tenant.

   You can also use a Privileged Role Administrator account to consent to the app, but ensure it has the following additional permissions based on different workspaces.

Workspace	Permission
Microsoft Teams to Microsoft Teams	With the authentication method of the Fly app profile only, if the destination is a multi-geo tenant, and the destination Teams need to be created in a defined location, you need to assign the Microsoft 365 Global Administrator, SharePoint Administrator, or Exchange Administrator role to the Fly app. You can refer to How to Assign the Exchange Administrator Role to an App? for examples of role assignments.
Microsoft 365 Group	With the authentication method of the Fly app profile only, if the destination is a multi-geo tenant, and the destination Teams need to be created in a defined location, you need to assign the Microsoft 365 Global Administrator, SharePoint Administrator, or Exchange Administrator role to the Fly app. You can refer to How to Assign the Exchange Administrator Role to an App? for examples of role assignments.
Aviator Microsoft Teams	With the authentication method of the Fly app profile only, if the destination is a multi-geo tenant, and the destination Teams need to be created in a defined location, you need to assign the Microsoft 365 Global Administrator, SharePoint Administrator, or Exchange Administrator role to the Fly app. You can refer to How to Assign the Exchange Administrator Role to an App? for examples of role assignments.
Aviator Microsoft 365 Groups	With the authentication method of the Fly app profile only, if the destination is a multi-geo tenant, and the destination Teams need to be created in a defined location, you need to assign the Microsoft 365 Global Administrator, SharePoint Administrator, or Exchange Administrator role to the Fly app. You can refer to How to Assign the Exchange Administrator Role to an App? for examples of role assignments.

7. Click Finish to create the Fly app.

Once you create a Fly app profile, the AvePoint Fly app for authentication can be created.

*Note: You need to assign the Exchange Administrator role to the AvePoint Fly app in the following situations:

*Note: After you re-authorize the Fly app profile, you need to wait about one hour before using the app profile for your migration to refresh the token if there are permissions updated.

Refer to the following permissions requested by the AvePoint Fly app:

API	Permission	Type	Purpose
SharePoint	Sites.FullControl.All(Have full control of all site collections)	Application	Retrieve and migrate settings and permissions of SharePoint Online site collections and team sites.
SharePoint	TermStore.ReadWrite.All(Read and write managed metadata)	Application	Retrieve and migrate Managed Metadata Service.
SharePoint	User.ReadWrite.All(Read and write user profiles)	Application	Retrieve and migrate Microsoft 365 user profiles.
Microsoft Graph	Calendars.ReadWrite(Read and write calendars in all mailboxes)	Application	Retrieve the information of Microsoft 365 user profiles.
Microsoft Graph	Channel.Create(Create channels)	Application	Create channels in Microsoft Teams migrations.
Microsoft Graph	ChannelMember.ReadWrite.All(Add and remove members from all channels)	Application	Retrieve and migrate private channel members.
Microsoft Graph	ChannelMessage.Read.All(Read all channel messages)	Application	Retrieve and migrate all channel messages.
Microsoft Graph	ChannelSettings.ReadWrite.All(Read and write the names, descriptions, and settings of all channels)	Application	Retrieve and migrate channel settings in Microsoft Teams migrations.
Microsoft Graph	Chat.Create(Create chats)	Application	Create chats in Microsoft Teams Chat migrations.
Microsoft Graph	Chat.ReadWrite.All(Read and write all chat messages)	Application	Retrieve and migrate chat members/chat messages in Microsoft Teams Chat migrations.
Microsoft Graph	Directory.Read.All(Read directory data)	Application	Retrieve and migrate Microsoft 365 users.
Microsoft Graph	Group.ReadWrite.All(Read and write all groups)	Application	Retrieve and migrate Microsoft 365 Groups and Group members.
Microsoft Graph	InformationProtectionPolicy.Read.All(Read all published labels and label policies for an organization)	Application	Only required if you want to manage sensitivity labels of files/emails/Teams/Groups/sites.
Microsoft Graph	OnlineMeetings.ReadWrite.All(Read and create online meetings)	Application	Make sure the replaced meeting links in the destination are available to all attendees.
Microsoft Graph	Reports.Read.All(Read all usage reports)	Application	Only required by tenant discovery.
Microsoft Graph	ReportSettings.Read.All(Read all admin report settings)	Application	Retrieve the Reports setting of the Microsoft 365 admin center.
Microsoft Graph	Schedule.ReadWrite.All(Read and write all schedule items)	Application	Retrieve and migrate Teams Shifts app data in Microsoft Teams migrations.
Microsoft Graph	Sites.ReadWrite.All(Read and write items in all site collections)	Application	Migrate channel folders and files of team sites and private channels’ site collections.
Microsoft Graph	Tasks.ReadWrite.All(Read and write all users’ tasks and tasklists)	Application	Retrieve and migrate planners and data in planners.
Microsoft Graph	TeamsAppInstallation.ReadForUser.All(Read installed Teams apps for all users)	Application	Retrieve the list of apps installed in the personal scope of the specified user.
Microsoft Graph	TeamsAppInstallation.ReadWriteAndConsentForTeam.All(Manage installation and permission grants of Teams apps for all teams)	Application	Read, install, upgrade, and uninstall Teams apps in Teams and manage Teams access permissions.
Microsoft Graph	TeamsAppInstallation.ReadWriteForTeam.All(Manage Teams apps for all teams)	Application	Retrieve and migrate Team apps in Microsoft Teams migrations.
Microsoft Graph	Team.Create(Create teams)	Application	Create Teams in Microsoft Teams migrations.
Microsoft Graph	TeamMember.ReadWrite.All(Add and remove members from all teams)	Application	Retrieve and migrate Team members.
Microsoft Graph	Teamwork.Migrate.All(Create chat and channel messages with anyone’s identity and with any timestamp)	Application	Create Teams and channels, and migrate channel messages with any message sender and timestamp.
Microsoft Graph	TeamworkTag.ReadWrite.All(Read and write tags in Teams)	Application	Retrieve and migrate tags in Microsoft Teams migrations.
Microsoft Graph	TeamSettings.ReadWrite.All(Read and change all teams' settings)	Application	Retrieve and migrate Team settings in Microsoft Teams migrations.
Microsoft Graph	TeamsTab.Create(Create tabs in Microsoft Teams)	Application	Create tabs in destination chats in Microsoft Teams Chat migrations.
Microsoft Graph	TeamsTab.Read.All(Read tabs in Microsoft Teams)	Application	Retrieve tabs in destination chats in Microsoft Teams Chat migrations.
Microsoft Graph	TeamsTab.ReadWriteForTeam.All(Allow the Teams app to manage all tabs for all teams)	Application	Retrieve and migrate Team tabs in Microsoft Teams migrations.
Microsoft Graph	TeamsTab.ReadWriteSelfForChat(Allow the Teams app to manage only its own tabs in chats)	Application	Update tabs in destination chats.
Microsoft Graph	User.Read.All(Read all users' full profiles)	Application	Retrieve the information of Microsoft 365 user profiles.
Microsoft Graph	User.Read(Sign in and read user profile)	Delegated	Retrieve information of Microsoft 365 user profiles.
Office 365 Exchange Online	Exchange.ManageAsApp(Manage Exchange As Application)	Application	Use Exchange PowerShell to migrate mailbox permissions and distribution lists.
Office 365 Exchange Online	full_access_as_app(Use Exchange Web Services with full access to all mailboxes)	Application	Retrieve and migrate items from all mailboxes.*Note: If you do not want to add this permission to the app, you can create an RBAC assignment for the app to only access to specified mailboxes. Refer to the option 3 in the How to Migrate Mailboxes without the ApplicationImpersonation Role? section for details.
Azure Rights Management Services	Content.DelegatedReader(Read protected content on behalf of a user)	Application	Only required if you want to manage sensitivity labels of files/emails/Teams/sites.
Azure Rights Management Services	Content.DelegatedWriter(Create protected content on behalf of a user)	Application	Only required if you want to manage sensitivity labels of files/emails/Teams/sites.
Azure Rights Management Services	Content.SuperUser(Read all protected content for this tenant)	Application	Only required if you want to manage sensitivity labels of files/emails/Teams/sites.
Azure Rights Management Services	Content.Writer(Create protected content)	Application	Only required if you want to manage sensitivity labels of files/emails/Teams/sites.
Microsoft Information Protection Sync Service	UnifiedPolicy.Tenant.Read(Read all unified policies of the tenant)	Application	Only required if you want to manage sensitivity labels of files/emails/Teams/sites.

#How to Check and Activate Azure Rights Management Service?

When your app profile using the Fly app cannot be created or authorized, you can check if it is caused by the lack of Azure Rights Management Service subscription:

1. When the authentication error occurs after you authorize the app, navigate to the Developer Tools interface by pressing F12 on the keyboard.

2. Check the information under the Console tab.

3. If you can find the access denied error shown in the screenshot below, the error is caused by the lack of Azure Rights Management Service subscription.

For this error, we provide you with the following two solutions:

POST https://graph.microsoft.com/v1.0/servicePrincipals

{    

    "appId": "00000012-0000-0000-c000-000000000000"

}

GET https://graph.microsoft.com/v1.0/servicePrincipals(appId='00000012-0000-0000-c000-000000000000')

PATCH https://graph.microsoft.com/v1.0/servicePrincipals/{id}

{

    "accountEnabled":true