AvePoint Learn
Request article
Contact support
Request article
Contact support
English

    Home > Appendices > Fly Delegated App Profile Permissions

    Export to PDF

    Fly Delegated App Profile Permissions

    The Tenant Owner and Service Administrators can create a Fly delegated app profile using the Modern mode in AvePoint Online Services > Management > App management to connect to the Microsoft 365 tenant via the AvePoint Fly Delegated App.

    Note the following before you consent the app:

    After granting consent, if your organization needs to revoke the Global Administrator role, you have two options:

    • Remove the Global Administrator role from the consent user.

    • Re-authorize the app profile, change to use the User consent method, and use a normal user to re-authorize the app profile. Refer to Re-authorize an App Profile for Microsoft Tenants for more information. After you re-authorize the delegated app profile, wait about one hour before using the app profile for your migration to refresh the token if there are permissions updated.

      NOTE

      If you use a Privileged Role Administrator account to consent to the app, the User consent method will be unavailable when you re-authorize the app. To use an end user to re-authorize the app, use a Global Administrator account to consent to the app when you create the app.

    Refer to the following permissions requested by the AvePoint Fly Delegated App:

    APIPermissionTypePurpose
    Microsoft GraphRoleManagement.Read.Directory
    (Read directory RBAC settings)    		DelegatedRetrieve Microsoft global groups.
    Check Service Account available roles.
    Microsoft GraphGroup.ReadWrite.All
    (Read and write all groups)
    		DelegatedAllow to create groups and read all group properties and memberships.
    Additionally, allow group owners to manage their groups and allow group members to update group content.
    Microsoft GraphDomain.Read.All
    (Read domains)    		DelegatedRetrieve the Microsoft 365 tenant domain.
    Microsoft GraphUser.Read.All
    (Read all users' full profiles)    		DelegatedRetrieve information of user profiles.
    Microsoft GraphChat.ReadWrite
    (Read and write user chat messages)    		DelegatedRetrieve and migrate chat members / chat messages in Microsoft Teams Chat migrations.
    Microsoft GraphTeamsTab.ReadWriteForTeam
    (Allow the Teams app to manage all tabs in teams)    		DelegatedRetrieve and migrate team tabs in Microsoft Teams migrations.
    Microsoft GraphTeamsAppInstallation.ReadWriteAndConsentForTeam
    (Manage installed Teams apps in teams)    		DelegatedRead, install, upgrade, and uninstall Teams apps in Teams and manage Teams access permissions.
    Microsoft GraphTeamSettings.ReadWrite.All
    (Read and change teams’ settings)    		DelegatedRetrieve and migrate team settings in Microsoft Teams migrations.
    Microsoft GraphTeamsAppInstallation.ReadWriteForTeam
    (Manage installed Teams apps in teams)    		DelegatedRetrieve and migrate team apps in Microsoft Teams migrations.
    Microsoft GraphTeamMember.ReadWrite.All
    (Add and remove members from teams)    		DelegatedMigrate team members to the destination.
    Microsoft GraphTeam.Create
    (Create teams)    		DelegatedCreate Teams in Microsoft Teams migrations.
    Microsoft GraphChannelSettings.ReadWrite.All
    (Read and write the names, descriptions, and settings of channels)    		DelegatedRetrieve and migrate channel settings in Microsoft Teams migrations.
    Microsoft GraphChannelMessage.Send
    (Send channel messages)    		DelegatedMigrate channel messages in Microsoft Teams migrations.
    Microsoft GraphChannelMessage.Read.All
    (Read user channel messages)    		DelegatedRetrieve channel messages in Microsoft Teams migrations.
    Microsoft GraphChannelMember.ReadWrite.All
    (Add and remove members from channels)    		DelegatedRetrieve and migrate channel members in Microsoft Teams migrations.
    Microsoft GraphChannel.Create
    (Create channels)    		DelegatedCreate channels in Microsoft Teams migrations.
    Microsoft GraphSchedule.ReadWrite.All
    (Read and write all schedule items)    		DelegatedRetrieve and migrate Teams Shifts app data in Microsoft Teams migrations.
    Microsoft GraphTeamsTab.Create
    (Create tabs in Microsoft Teams)    		DelegatedCreate tabs in destination chats in Microsoft Teams Chat migrations.
    Microsoft GraphTeamsTab.Read.All
    (Read tabs in Microsoft Teams)    		DelegatedRetrieve tabs of destination chats in Microsoft Teams Chat migrations.
    Microsoft GraphTeamworkTag.ReadWrite
    (Read and write tag and tag member)    		DelegatedRetrieve and migrate Teams work tags in Microsoft Teams migrations.
    Microsoft GraphTeamsTab.ReadWriteSelfForChat
    (Allow the Teams app to manage only its own tabs in chats)    		DelegatedUpdate tabs in destination chats.
    Microsoft GraphFiles.ReadWrite.All
    (Have full access to all files user can access)    		DelegatedMigrate files of team sites to the destination.
    Microsoft GraphSites.Read.All
    (Real content in all site collections)    		DelegatedRetrieve all site collections.
    SharePointAllSites.FullControl
    (Have full control of all site collections)    		DelegatedRetrieve and migrate content in SharePoint migrations.
    SharePointTermStore.ReadWrite.All
    (Read and write managed metadata)    		DelegatedRetrieve and migrate Managed Metadata Service data.
    Office 365 Exchange OnlineEWS.AccessAsUser.All
    (Access mailboxes as the signed-in user via Exchange Web Services)    		DelegatedUse Exchange Web Services with full access to user data via impersonation.
    Office 365 Exchange OnlineExchange.Manage
    (Manage Exchange configuration)    		DelegatedRetrieve and migrate mailbox permissions, distribution groups, and other data related to Exchange PowerShell.
    Microsoft Information Protection Sync ServiceUnifiedPolicy.User.Read
    (Read all unified policies a user has access to)    		DelegatedRetrieve sensitivity labels of files/mails/Groups.
    Azure Rights Management Servicesuser_impersonation
    (Create and access protected content for users)    		DelegatedMigrate sensitivity labels of files/mails/Groups.