Home > Aviator > Aviator for SharePoint Online > Permissions Required by Destination SharePoint Online > Custom App Profile Permissions
Export to PDFCustom App Profile Permissions
With the Tenant Owner and Service Administrator role, you can create a custom app profile in AvePoint Online Services > Management > App management to connect to the Microsoft 365 tenant using a custom Azure app.
Refer to the following procedures to create a custom app profile:
-
Prepare a certificate in Microsoft Entra ID. Refer to for more information.
You can ignore this step if you have a certificate.
-
Create a custom Azure app in Microsoft Entra ID. Refer to for more information.
-
*Note: If the destination is a multi-geo tenant, and the destination Microsoft 365 Groups need to be created in a defined location, you need to assign the SharePoint administrator role to the custom Azure app. Refer to the How to Assign the SharePoint Administrator role to an App? section below for instructions.
-
.
-
in AvePoint Online Services.
*Note: After you re-authorize the app profile, you need to wait about one hour before using the app profile for your Aviator job to refresh the token if there are permissions updated.
| API | Permission | Type | Purpose |
|---|---|---|---|
| Microsoft Graph | User.Read.All (Read all users' full profiles) | Application | Retrieve and migrate Microsoft 365 users. |
| Microsoft Graph | RoleManagement.Read.Directory(Read all directory RBAC settings) | Application | Retrieve and migrate Microsoft global groups. |
| Microsoft Graph | Files.Read.All(Read files in all site collections) | Application | Retrieve channel folders in destination team sites. |
| Microsoft Graph | Group.ReadWrite.All | ||
| (Read and write all groups) | Application | Retrieve and migrate Microsoft 365 Groups and Group members. *Note: The permission is required in the following situations when running Aviator for SharePoint Online jobs:● Create Microsoft 365 groups and add group members when migrating source team sites related to Microsoft 365 Groups.● Map source SharePoint Groups (Owners/Members/Visitors) to destination Microsoft 365 Groups and add users to the Microsoft 365 Groups as owners or members when migrating team sites without Microsoft 365 Groups to team sites related to Microsoft 365 Groups. If you want to use Microsoft 365 Groups Migration to migrate the Microsoft 365 Groups to which the team sites belong, you can remove this permission. | |
| SharePoint/Office 365 SharePoint Online | Sites.FullControl.All (Have full control of all site collections) | Application | Retrieve settings and permissions of SharePoint Online site collections. |
| SharePoint/Office 365 SharePoint Online | TermStore.ReadWrite.All(Read and write managed metadata) | Application | Retrieve and migrate Managed Metadata Service. |
| Azure Rights Management Services*Note: For 21Vianet tenants, the API name is Microsoft Rights Management Services. | Content.DelegatedWriter(Create protected content on behalf of a user) | Application | Only required if you want to manage sensitivity labels of files/sites. |
| Azure Rights Management Services*Note: For 21Vianet tenants, the API name is Microsoft Rights Management Services. | Content.Writer(Create protected content) | Application | Only required if you want to manage sensitivity labels of files/sites. |
| Microsoft Information Protection Sync Service | UnifiedPolicy.Tenant.Read(Read all unified policies of the tenant.) | Application | Only required if you want to manage sensitivity labels of files/sites. |
For easy use, you can directly use the following commands to add required API permissions through Manifest for Microsoft 365 Commercial tenants.
"requiredResourceAccess": [
{
"resourceAppId": "00000012-0000-0000-c000-000000000000",
"resourceAccess": [
{
"id": "006e763d-a822-41fc-8df5-8d3d7fe20022",
"type": "Role"
},
{
"id": "d13f921c-7f21-4c08-bade-db9d048bd0da",
"type": "Role"
}
]
},
{
"resourceAppId": "00000003-0000-0ff1-ce00-000000000000",
"resourceAccess": [
{
"id": "678536fe-1083-478a-9c59-b99265e6b0d3",
"type": "Role"
},
{
"id": "c8e3537c-ec53-43b9-bed3-b2bd3617ae97",
"type": "Role"
}
]
},
{
"resourceAppId": "00000003-0000-0000-c000-000000000000",
"resourceAccess": [
{
"id": "01d4889c-1287-42c6-ac1f-5d1e02578ef6",
"type": "Role"
},
{
"id": "62a82d76-70ea-41e2-9197-370581804d09",
"type": "Role"
},
{
"id": "483bed4a-2ad3-4361-a73b-c83ccdbdc53c",
"type": "Role"
},
{
"id": "df021288-bdef-4463-88db-98f22de89214",
"type": "Role"
}
]
},
{
"resourceAppId": "870c4f2e-85b6-4d43-bdda-6ed9a579b725",
"resourceAccess": [
{
"id": "8b2071cd-015a-4025-8052-1c0dba2d3f64",
"type": "Role"
}
]
}
],
How to Assign the SharePoint Administrator role to an App?
To assign the SharePoint administrator role to an app, refer to the following steps:
-
Log in to Microsoft Entra admin center (or Azure portal) and navigate to Microsoft Entra ID.
-
Click Roles & admins (or Roles and administrators) in the left pane, and click SharePoint Administrator.
-
On the Assignments page, click Add assignments. The Add assignments panel appears.
Enter the app name in the search box to search for the app to which you want to assign the role.
-
Select the app, and click Add to assign the role. Note that the assigned role will take effect in about 30 minutes.
If your Microsoft interface is updated and different from the above screenshots, refer to the following steps to assign the SharePoint administrator role to an app:
-
Log in to Microsoft Entra admin center (or Azure portal) and navigate to Microsoft Entra ID.
-
Click Roles & admins (or Roles and administrators) in the left pane, and click SharePoint Administrator.
-
-
On the Assignment page, click Add assignments. The Add assignments page appears.
-
Click No member selected in the Selected member(s) section. The Select a member panel appears and enter the app name in the search box to search for the app to which you want to assign the role.
-
-
Click the app, and click Select to select the app.
-
Click Next.
-
Select Active in the Assignment type section and enter the justification in the Enter justification text box.
-
-
Click Assign to assign the role. Note that the assigned role will take effect in about 30 minutes.