#Permissions Required by Source SharePoint Online

For the source connection used to retrieve data in the selected tenant, choose to use one of the following authentication methods:

• Fly app profile

• Custom app profile

• A service account and a Fly app profile

• A service account and a custom app profile

• A custom app profile and a custom delegated app profile

• A custom app profile and a Fly delegated app profile

• A Fly app profile and a custom delegated app profile

• A Fly app profile and a Fly delegated app profile

For the source connection used to run an Aviator job, choose to use one of the following authentication methods:

• Service account

• Fly app profile

• Custom app profile

• A service account and a Fly app profile

• A service account and a custom app profile

• Custom delegated app profile

• Fly delegated app profile

• A Fly app profile and a Fly delegated app profile

• A Fly app profile and a custom delegated app profile

• A custom app profile and a custom delegated app profile

• A custom app profile and a Fly delegated app profile

Refer to the following sections to view the permissions required by the authentication methods.

#Fly App Profile Permissions

With the Tenant Owner or Service Administrator role, you can create a Fly app profile in AvePoint Online Services > Management > App management to connect to the Microsoft 365 tenant using the Fly app.

Refer to Fly App Profile Permissions about how to create a Fly app profile and required permissions of the Fly app profile.

#Custom App Profile Permissions

With the Tenant Owner and Service Administrator role, you can create a custom app profile in AvePoint Online Services > Management > App management to connect to the Microsoft 365 tenant using a custom Azure app.

Refer to the following procedures to create a custom app profile:

1. Prepare a certificate in Microsoft Entra ID. Refer to Prepare a Certificate for the Custom Azure App for more information.

   You can ignore this step if you have a certificate.

2. Create a custom Azure app in Microsoft Entra ID. Refer to Create Custom Azure Applications for more information.

3. Connect your tenant to AvePoint Online Services.

4. Create an App Profile for a Custom Azure App in AvePoint Online Services.

Refer to the following tables to add API permissions required by Aviator for SharePoint Online to the custom Azure app.

For easy use, you can directly use the following commands to add required API permissions through Manifest for Microsoft 365 Commercial tenants.

"requiredResourceAccess": [
        {
            "resourceAppId": "870c4f2e-85b6-4d43-bdda-6ed9a579b725",
            "resourceAccess": [
                {
                    "id": "8b2071cd-015a-4025-8052-1c0dba2d3f64",
                    "type": "Role"
                }
            ]
        },
        {
            "resourceAppId": "00000012-0000-0000-c000-000000000000",
            "resourceAccess": [
                {
                    "id": "7347eb49-7a1a-43c5-8eac-a5cd1d1c7cf0",
                    "type": "Role"
                }
            ]
        },
        {
            "resourceAppId": "00000003-0000-0ff1-ce00-000000000000",
            "resourceAccess": [
                {
                    "id": "678536fe-1083-478a-9c59-b99265e6b0d3",
                    "type": "Role"
                },
                {
                    "id": "2a8d57a5-4090-4a41-bf1c-3c621d2ccad3",
                    "type": "Role"
                }
            ]
        },
        {
            "resourceAppId": "00000003-0000-0000-c000-000000000000",
            "resourceAccess": [
                {
                    "id": "5b567255-7703-4780-807c-7be8301ae99b",
                    "type": "Role"
                },
                {
                    "id": "483bed4a-2ad3-4361-a73b-c83ccdbdc53c",
                    "type": "Role"
                },
                {
                    "id": "df021288-bdef-4463-88db-98f22de89214",
                    "type": "Role"
                }
            ]
        }
    ],

#Service Account Permissions

The Tenant Owner and Service Administrators can also create a service account profile for Microsoft 365 to connect AvePoint Online Services to your Microsoft 365 tenant.

If you use both the app profile and service account authentications for the source, there are no permission requirements for the service account.

If you only use the service account authentication for the source, make sure the service account meets the following requirements:

• Site CollectionAdministrator

  NOTE

  If Fly detects that the service account is not the Site Collection Administrator, but the service account has the SharePoint Administrator or Global Administrator role, Fly will automatically add the service account as the Site Collection Administrator of the site collection.

• SharePoint Administrator is also required in the following cases:

  • To create new site collections in the destination during the Aviator job, the destination service account must be the SharePoint Administrator.

  • To use the scan profile to scan SharePoint Online site collections in AvePoint Online Services, the service account must be the SharePoint Administrator.

  NOTE

  If the SharePoint Administrator cannot access the SharePoint admin center, the Global Administrator is required.

• If the source or destination is a group site or modern site, make sure the Deny permission is removed from the source or destination site.

To remove the service account from the site collections, refer to the following steps:

1. Click here to download the Remove-SharePointOnlineUser.zip file. Then, extract the file.

2. In the extracted folder, configure the site collection URLs from which you want to remove the service account in the sites.csv file.

3. Install the SharePoint Online Management Shell on the Windows Server that can connect to your SharePoint Online. You can click the link to download the SharePoint Online Management Shell.

4. Open Windows PowerShell and enter the following commands in the Windows PowerShell window:

   . "file path"

   Replace file path with the full path of the Remove-SharePointOnlineUser.ps1 file in the extracted folder, and press Enter on the keyboard.

   

5. Enter the following commands, and press Enter on the keyboard:

   Remove-SharePointOnlineUser -LoginName "" -AdministrationCenterUrl "" -Path ""

   • LoginName " " – The service account you want to remove.

   • AdministrationCenterUrl " " – The SharePoint Online admin center URL.

   • Path " " – The full path of the CSV file where the site collection URLs are configured. If you want to remove the service account from all site collections in the admin center, you do not need to enter the -Path "" parameter.

#Delegated App Profile Permissions

Fly allows you to use the Fly delegated app profile or custom delegated app profile to connect to your workspace.

Note the following:

• The license and permission requirements for the consent user are the same as those for the service account. Refer to Service Account Permissions for details.

• If the consent user of the delegated app profile has Multi-Factor Authentication (MFA) enabled, you must authorize or re-authorize the delegated app profile after MFA is enabled. Otherwise, the migration jobs using the delegated app profile will fail.

• If you re-authorize the app profile, you need to wait about one hour before using the app profile for your migration to refresh the token when there are permissions updated.

To use the Fly delegated app profile with required permissions, refer to Fly Delegated App Profile Permissions.

To use a custom delegated app profile with required permissions, refer to the following steps:

1. After registering an app in Microsoft Entra ID, add the permissions in the table below to the app.

   API	Permission	Type	Purpose
   Microsoft Graph	User.Read.All (Read user profiles)	Delegated	Retrieve and migrate Microsoft 365 users.
   Microsoft Graph	RoleManagement.Read.Directory (Read directory RBAC settings)	Delegated	Retrieve and migrate Microsoft global groups.
   Microsoft Graph	Group.Read.All (Read all groups)	Delegated	Retrieve owners, members, and more details of Microsoft 365 Groups related to source site collections.
   SharePoint	AllSites.FullControl Have full control of all site collections	Delegated	Retrieve settings and permissions of SharePoint Online site collections.
   SharePoint	TermStore.Read.All (Read managed metadata)	Delegated	Retrieve settings and permissions of SharePoint Online site collections.
   Azure Rights Management Services For 21Vianet tenants, the API name is Microsoft Rights Management Services.	user_impersonation (Create and access protected content for users)	Delegated	Only required if you want to manage sensitivity labels of files/sites.
   Microsoft Information Protection Sync Service	UnifiedPolicy.User.Read (Read all unified policies of the tenant)	Delegated	Only required if you want to manage sensitivity labels of files/sites.

   For easy use, you can directly use the following commands to add required API permissions through Manifest for Microsoft 365 Commercial tenants.

   "requiredResourceAccess": [
           {
               "resourceAppId": "00000003-0000-0ff1-ce00-000000000000",
               "resourceAccess": [
                   {
                       "id": "a468ea40-458c-4cc2-80c4-51781af71e41",
                       "type": "Scope"
                   },
                   {
                       "id": "56680e0d-d2a3-4ae1-80d8-3c4f2100e3d0",
                       "type": "Scope"
                   }
               ]
           },
           {
               "resourceAppId": "00000003-0000-0000-c000-000000000000",
               "resourceAccess": [
                   {
                       "id": "5f8c59db-677d-491f-a6b8-5f174b11ec1d",
                       "type": "Scope"
                   },
                   {
                       "id": "741c54c3-0c1e-44a1-818b-3f97ab4e8c83",
                       "type": "Scope"
                   },
                   {
                       "id": "a154be20-db9c-4678-8ab7-66f6cc099a59",
                       "type": "Scope"
                   }
               ]
           },
           {
               "resourceAppId": "00000012-0000-0000-c000-000000000000",
               "resourceAccess": [
                   {
                       "id": "c9c9a04d-3b66-4ca8-a00c-fca953e2afd3",
                       "type": "Scope"
                   }
               ]
           },
           {
               "resourceAppId": "870c4f2e-85b6-4d43-bdda-6ed9a579b725",
               "resourceAccess": [
                   {
                       "id": "34f7024b-1bed-402f-9664-f5316a1e1b4a",
                       "type": "Scope"
                   }
               ]
           }
       ],

2. Click Authentication in the left navigation of the app.

3. Click Add a platform.

4. Select Web in the Configure platforms panel.

5. In the Configure Web panel, enter the AvePoint Online Services URL: https://www.avepointonlineservices.com for your commercial environment or https://usgov.avepointonlineservices.com for your U.S. Government environment in the Redirect URIs field.

   

6. Click Configure.

7. Select the Access tokens and ID tokens checkboxes on the Authentication page.

   

8. Click Save.

9. Create an app profile for the app using the Custom mode in AvePoint Online Services by referring to Consent to a Custom Azure App with Delegated Permissions.

   NOTE

   When consenting to the app, if you have granted the admin consent and allowed public client flows for the permissions, you can choose to use the Global Administrator consent or the User consent method. If not, you can only use the Global Administrator consent method.