AvePoint Docs
Graph API
My support tickets
Graph API
My support tickets
English

    Home > Aviator > Aviator for Microsoft Teams > Permissions Required by Source Teams > Custom App Profile Permissions

    Export to PDF

    Custom App Profile Permissions

    With the Tenant Owner and Service Administrator role, you can create a custom app profile in AvePoint Online Services > Management > App management to connect to the Microsoft 365 tenant using a custom Azure app.

    Refer to the following procedures to create a custom app profile:

    1. Prepare a certificate in Microsoft Entra ID. Refer to for more information.

      You can ignore this step if you have a certificate.

    2. Create a custom Azure app in Microsoft Entra ID. Refer to for more information.

    3. .

    4. in AvePoint Online Services.

    *Note: After you re-authorize the app profile, you need to wait about one hour before using the app profile for your migration to refresh the token if there are permissions updated.

    Refer to the following tables to add API permissions required to the custom Azure app.

    *Note: √ refers to the permission is required to copy or merge the data type.

    API  Permission  Type  Purpose  TeamChannelPlanner
    Microsoft GraphDirectory.Read.All(Read directory data)Application  Only required if the source is a multi-geo tenant. √   
    Microsoft GraphDomain.Read.All(Read domains)Application  Retrieve domains.√√√
    Microsoft GraphRoleManagement.Read.Directory(Read directory RBAC settings)Application  Retrieve directory roles.√√
    Microsoft GraphGroup.Read.All (Read all groups)Application Retrieve Microsoft 365 Groups and group members. √√√ 
    Microsoft GraphGroup.ReadWrite.All(Read and write all groups)ApplicationOnly required if you use both the app profile and the service account in the source connection and the source service account is not the group owner, to automatically add the service account as the group owner.√ √   
    Microsoft GraphSites.Read.All (Read items in all site collections)ApplicationRetrieve channel folders and files of team sites and private channels’ site collections.√ √ √ 
    Microsoft GraphUser.Read.All (Read all users’ full profiles)Application Retrieve information of Microsoft 365 user profiles. √ √ √ 
    Microsoft GraphChannelMember.Read.All(Read the members of all channels)Application Retrieve private/shared channel members.√ √   
    Microsoft GraphChannelMember.ReadWrite.All(Add and remove members from all channels)ApplicationOnly required if you use both the app profile and the service account in the source connection and the source service account is not the private/shared channel owner, to automatically add the service account as the channel owner.√ √   
    Microsoft GraphChannelMessage.Read.All(Read all channel messages)Application Retrieve all channel messages.√ √   
    Microsoft GraphTeamworkTag.Read.All(Allows the app to read tags in Teams without a signed-in user)Application  Retrieve tags.√     
    Microsoft GraphTeamMember.Read.All(Read the members of all teams)Application  Retrieve team members.√     
    Microsoft GraphTeamSettings.Read.All(Read all teams’ settings)ApplicationRetrieve and migrate team settings.√     
    Microsoft GraphChannelSettings.Read.All(Read the names, descriptions, and settings of all channels)ApplicationRetrieve and migrate channel settings.√ √   
    Microsoft GraphTeamsAppInstallation.ReadForTeam.All(Read installed Teams apps for all teams)ApplicationRetrieve and migrate Team apps.√     
    Microsoft GraphTeamsTab.Read.All(Read tabs in Microsoft Teams)ApplicationRetrieve and migrate team tabs.√ √   
    Microsoft GraphSchedule.Read.All(Read all schedule items)ApplicationRetrieve and migrate Teams Shifts app data.*Note: If the source is a GCC High or 21Vianet tenant, this permission is not required.√     
    Microsoft GraphReports.Read.All(Read all usage reports)ApplicationOnly required by tenant discovery.*Note: If the source is a 21Vianet tenant, this permission is not required.√ √   
    Microsoft GraphReportSettings.Read.All(Read all admin report settings)ApplicationRetrieve the Reports setting of the Microsoft 365 admin center.*Note: If the source is a 21Vianet tenant, this permission is not required.√ √   
    Microsoft GraphTasks.Read.All(Read all users’ tasks and tasklist)ApplicationRetrieve planners and data in planners.*Note: If the source is a 21Vianet tenant, this permission is not required.√   √ 
    Office 365 Exchange OnlineExchange.ManageAsApp(Manage Exchange As Application)Application Use Exchange PowerShell to retrieve mailbox permissions. √     
    Office 365 Exchange OnlineFull_access_as_app(Use Exchange Web Services with full access to all mailboxes)ApplicationRetrieve items from all mailboxes.*Note: If you do not want to add this permission to the app, you can create an RBAC assignment for the app to only access to specified mailboxes. Refer to the option 3 in the How to Migrate Mailboxes without the ApplicationImpersonation Role? section for details.√     
    SharePoint / Office 365 SharePoint OnlineSites.FullControl.All(Have full control of all site collections) ApplicationRetrieve settings and permissions of team sites.√  √   
    SharePoint / Office 365 SharePoint OnlineTermStore.ReadWrite.All(Read and write managed metadata)ApplicationRetrieve and migrate Managed Metadata Service.*Note: The TermStore.ReadWrite.All permission is required to migrate the term set used in the Managed Navigation. If you do not need to migrate the term set used in the Managed Navigation, you can replace the permission with TermStore.Read.All.√ √ 
    Azure Rights Management Services*Note: For 21Vianet tenants, the API name is Microsoft Rights Management Services.Content.SuperUser(Read all unified policies of the tenant.)ApplicationOnly required if you want to manage the sensitivity labels of files/emails/Teams.√ √ 
    Microsoft Information Protection Sync ServiceUnifiedPolicy.Tenant.Read(Read all protected content for this tenant)ApplicationOnly required if you want to manage the sensitivity labels of files/emails/Teams.√ √