AvePoint Docs
Graph API
My support tickets
Graph API
My support tickets
English

    Home > Appendices > Fly Delegated App Profile Permissions

    Export to PDF

    Fly Delegated App Profile Permissions

    The Tenant Owner and Service Administrators can create a using the Modern mode in AvePoint Online Services > Management > App management to connect to the Microsoft 365 tenant via the AvePoint Fly Delegated App.

    Note the following before you consent the app:

    - You can also use a Privileged Role Administrator account to consent to the app, but ensure it has the following additional permissions based on different workspaces. - > ***Note**: If you use a Privileged Role Administrator account to consent to the app, the **User consent** method will be unavailable when you re-authorize the app. To use an end user to re-authorize the app, use a Global Administrator account to consent to the app when you create the app.
    WorkspaceSource PermissionDestination Permission
    SharePoint OnlineRefer to Delegated App Profile Permissions for details.Refer to Delegated App Profile Permissions for details.
    OneDriveRefer to Delegated App Profile Permissions for details.Refer to Delegated App Profile Permissions for details.
    Aviator SharePoint OnlineRefer to Delegated App Profile Permissions for details.Refer to Delegated App Profile Permissions for details.
    Aviator OneDriveRefer to Delegated App Profile Permissions for details.Refer to Delegated App Profile Permissions for details.
    Microsoft Teams to Google Chat SpaceRefer to Delegated APP Profile Permissions for details.N/A
    Microsoft Teams to Microsoft TeamsRefer to Delegated App Profile Permissions for details.Refer to Delegated App Profile Permissions for details.
    Microsoft Teams ChatN/ARefer to Delegated App Profile Permissions for details.
    Aviator Microsoft TeamsRefer to Delegated App Profile Permissions for details.Refer to Delegated App Profile Permissions for details.
    Aviator Microsoft 365 GroupsRefer to Delegated App Profile Permissions for details.Refer to Delegated App Profile Permissions for details.
    Microsoft 365 GroupRefer to Delegated App Profile Permissions for details.Refer to Delegated App Profile Permissions for details.
    SharePoint Online to Google DriveRefer Delegated App Profile Permissions to for details.N/A
    OneDrive to Google DriveRefer to Delegated App Profile Permissions for details.N/A
    Google DriveN/ARefer to Delegated App Profile Permissions for details.
    GmailN/ARefer to Delegated App Profile Permissions for details.
    Exchange OnlineRefer to Delegated App Profile Permissions for details.Refer to Delegated App Profile Permissions for details.
    - When consenting the delegated app profile for the first time, you must select the **Consent on behalf of your organization** option on the **Permissions requested** page and use a Microsoft 365 Global Administrator to consent.

    After granting consent, if your organization needs to revoke the Global Administrator role, you have two options:

    - Remove the **Global Administrator** role from the consent user. - Re-authorize the app profile, change to use the **User consent** method, and use a normal user to re-authorize the app profile. Refer to for more information. After you re-authorize the delegated app profile, wait about one hour before using the app profile for your migration to refresh the token if there are permissions updated. - > ***Note**: If you use a Privileged Role Administrator account to consent to the app, the **User consent** method will be unavailable when you re-authorize the app. To use an end user to re-authorize the app, use a Global Administrator account to consent to the app when you create the app.

    Refer to the following permissions requested by the AvePoint Fly Delegated App:

    APIPermissionTypePurpose
    Microsoft GraphRoleManagement.Read.Directory(Read directory RBAC settings)DelegatedRetrieve Microsoft global groups.Check Service Account available roles.
    Microsoft GraphGroup.ReadWrite.All(Read and write all groups)DelegatedAllow to create groups and read all group properties and memberships.Additionally, allow group owners to manage their groups and allow group members to update group content.
    Microsoft GraphDomain.Read.All(Read domains)DelegatedRetrieve the Microsoft 365 tenant domain.
    Microsoft GraphUser.Read.All(Read all users' full profiles)DelegatedRetrieve information of user profiles.
    Microsoft GraphChat.ReadWrite(Read and write user chat messages)DelegatedRetrieve and migrate chat members / chat messages in Microsoft Teams Chat migrations.
    Microsoft GraphTeamsTab.ReadWriteForTeam(Allow the Teams app to manage all tabs in teams)DelegatedRetrieve and migrate team tabs in Microsoft Teams migrations.
    Microsoft GraphTeamsAppInstallation.ReadWriteAndConsentForTeam(Manage installed Teams apps in teams)DelegatedRead, install, upgrade, and uninstall Teams apps in Teams and manage Teams access permissions.
    Microsoft GraphTeamSettings.ReadWrite.All(Read and change teams’ settings)DelegatedRetrieve and migrate team settings in Microsoft Teams migrations.
    Microsoft GraphTeamsAppInstallation.ReadWriteForTeam(Manage installed Teams apps in teams)DelegatedRetrieve and migrate team apps in Microsoft Teams migrations.
    Microsoft GraphTeamMember.ReadWrite.All(Add and remove members from teams)DelegatedMigrate team members to the destination.
    Microsoft GraphTeam.Create(Create teams)DelegatedCreate Teams in Microsoft Teams migrations.
    Microsoft GraphChannelSettings.ReadWrite.All(Read and write the names, descriptions, and settings of channels)DelegatedRetrieve and migrate channel settings in Microsoft Teams migrations.
    Microsoft GraphChannelMessage.Send(Send channel messages)DelegatedMigrate channel messages in Microsoft Teams migrations.
    Microsoft GraphChannelMessage.Read.All(Read user channel messages)DelegatedRetrieve channel messages in Microsoft Teams migrations.
    Microsoft GraphChannelMember.ReadWrite.All(Add and remove members from channels)DelegatedRetrieve and migrate channel members in Microsoft Teams migrations.
    Microsoft GraphChannel.Create(Create channels)DelegatedCreate channels in Microsoft Teams migrations.
    Microsoft GraphSchedule.ReadWrite.All(Read and write all schedule items)DelegatedRetrieve and migrate Teams Shifts app data in Microsoft Teams migrations.
    Microsoft GraphTeamsTab.Create(Create tabs in Microsoft Teams)DelegatedCreate tabs in destination chats in Microsoft Teams Chat migrations.
    Microsoft GraphTeamsTab.Read.All(Read tabs in Microsoft Teams)DelegatedRetrieve tabs of destination chats in Microsoft Teams Chat migrations.
    Microsoft GraphTeamworkTag.ReadWrite(Read and write tag and tag member)DelegatedRetrieve and migrate Teams work tags in Microsoft Teams migrations.
    Microsoft GraphTeamsTab.ReadWriteSelfForChat(Allow the Teams app to manage only its own tabs in chats)DelegatedUpdate tabs in destination chats.
    Microsoft GraphFiles.ReadWrite.All(Have full access to all files user can access)DelegatedMigrate files of team sites to the destination.
    Microsoft GraphSites.Read.All(Real content in all site collections)DelegatedRetrieve all site collections.
    SharePointAllSites.FullControl(Have full control of all site collections)DelegatedRetrieve and migrate content in SharePoint migrations.
    SharePointTermStore.ReadWrite.All(Read and write managed metadata)DelegatedRetrieve and migrate Managed Metadata Service data.
    Office 365 Exchange OnlineEWS.AccessAsUser.All(Access mailboxes as the signed-in user via Exchange Web Services)DelegatedUse Exchange Web Services with full access to user data via impersonation.
    Office 365 Exchange OnlineExchange.Manage(Manage Exchange configuration)DelegatedRetrieve and migrate mailbox permissions, distribution groups, and other data related to Exchange PowerShell.
    Microsoft Information Protection Sync ServiceUnifiedPolicy.User.Read(Read all unified policies a user has access to)DelegatedRetrieve sensitivity labels of files/mails/Groups.
    Azure Rights Management Servicesuser_impersonation(Create and access protected content for users)DelegatedMigrate sensitivity labels of files/mails/Groups.