#Source Permissions When Destination is Google Groups

#Fly App Profile Permissions

With the Tenant Owner or Service Administrator role, you can create a Fly app profile in AvePoint Online Services > Management > App management to connect to the Microsoft 365 tenant using the Fly app.

Refer to Fly App Profile Permissions about how to create a Fly app profile and the required permissions of the Fly app profile.

#Custom App Profile Permissions

With the Tenant Owner and Service Administrator role, you can create a custom app profile in AvePoint Online Services > Management > App management to connect to the Microsoft 365 tenant using a custom Azure app.

Refer to the following procedures to create a custom app profile:

1. Prepare a certificate in Microsoft Entra ID. Refer to Prepare a Certificate for the Custom Azure App for more information.

   You can ignore this step if you have a certificate.

2. Create a custom Azure app in Microsoft Entra ID. Refer to Create Custom Azure Applications for more information.

3. Connect your tenant to AvePoint Online Services.

4. Create an App Profile for a Custom Azure App in AvePoint Online Services.

Refer to the following tables to add API permissions required by Microsoft 365 Groups to Google Groups Migration to the custom Azure app.

For easy use, you can directly use the following commands to add required API permissions through Manifest for Microsoft 365 Commercial tenants.

"requiredResourceAccess": [
 {
   "resourceAppId": "00000003-0000-0ff1-ce00-000000000000",
   "resourceAccess": [
     {
       "id": "678536fe-1083-478a-9c59-b99265e6b0d3",
       "type": "Role"
     }
   ]
 },
 {
   "resourceAppId": "00000002-0000-0ff1-ce00-000000000000",
   "resourceAccess": [
     {
       "id": "dc890d15-9560-4a4c-9b7f-a736ec74ec40",
       "type": "Role"
     }
   ]
 },
 {
   "resourceAppId": "00000012-0000-0000-c000-000000000000",
   "resourceAccess": [
     {
       "id": "7347eb49-7a1a-43c5-8eac-a5cd1d1c7cf0",
       "type": "Role"
     }
   ]
 },
 {
   "resourceAppId": "00000003-0000-0000-c000-000000000000",
   "resourceAccess": [
     {
       "id": "dbb9058a-0e50-45d7-ae91-66909b5d4664",
       "type": "Role"
     },
     {
       "id": "5b567255-7703-4780-807c-7be8301ae99b",
       "type": "Role"
     },
     {
       "id": "62a82d76-70ea-41e2-9197-370581804d09",
       "type": "Role"
     },
     {
       "id": "19da66cb-0fb0-4390-b071-ebc76a349482",
       "type": "Role"
     },
     {
       "id": "230c1aed-a721-4c5d-9cb4-a90514e508ef",
       "type": "Role"
     },
     {
       "id": "ee353f83-55ef-4b78-82da-555bfa2b4b95",
       "type": "Role"
     },
     {
       "id": "483bed4a-2ad3-4361-a73b-c83ccdbdc53c",
       "type": "Role"
     },
     {
       "id": "332a536c-c7ef-4017-ab91-336970924f0d",
       "type": "Role"
     },
     {
       "id": "df021288-bdef-4463-88db-98f22de89214",
       "type": "Role"
     }
   ]
 },
 {
   "resourceAppId": "870c4f2e-85b6-4d43-bdda-6ed9a579b725",
   "resourceAccess": [
     {
       "id": "8b2071cd-015a-4025-8052-1c0dba2d3f64",
       "type": "Role"
     }
   ]
 }
],

#Service Account Permissions

If you only use service account authentication for source Groups, the service account must meet the following requirements:

• Licenses for Exchange Online

  NOTE

  To assign the licenses to the service account, go to the Microsoft 365 admin center > Users > Active users, and select Exchange Online under the Licenses and apps tab of the service account.

• Group owner of source Groups

  You can manually add the service account as the group owner. For easy use, if you grant Groups Administrator or Global Administrator for the service account, Fly can automatically add the service account as the group owner.

  After the migration, you can remove the service account from the group owner using PowerShell or block the service account directly. To remove the account, refer to Remove the Service Account for details. To block the account, go to Microsoft 365 Admin Center > Users and click the display name of the user. Click the Block this user icon, select Block the user from signing in, and save the changes.

• If the service account is SharePoint Administrator or Global Administrator, during the full migration job, the service account will be automatically added as Site Collection Administrator of the team sites of source Groups. After the migration, you can remove the service account from the team sites.

• Service account pool is no longer available in migrations. If you have used the service account pool for the source before, and you want to continue using the service account pool, you can select multiple service accounts when creating Groups connections, and make sure all selected service accounts meet the requirements mentioned above.

What permissions are required if I also use an app profile?

If you use both service account and app profile authentications for source Groups, the service account must meet the following requirements:

• Licenses for Exchange Online

  NOTE

  To assign the licenses to the service account, go to the Microsoft 365 admin center > Users > Active users, and select Exchange Online under the Licenses and apps tab of the service account.

• Group owner of source Groups.

  You can manually add the service account as the group owner. For easy use, if you provide both a service account and app profile using the default Fly app or custom app with required permissions, Fly can automatically add the service account as the group owner.

  After the migration, you can block the service account directly. To block the account, go to Microsoft 365 Admin Center > Users and click the display name of the user. Click the Block this user icon, select Block the user from signing in, and save the changes.

• During the full migration job, the service account will be automatically added as Site Collection Administrator of the team sites of source Groups. After the migration, you can remove the service account from the team sites.

• Service account pool is no longer available in migrations. If you have used the service account pool for the source before, and you want to continue using the service account pool, you can select multiple service accounts when creating Groups connections, and make sure all selected service accounts meet the requirements mentioned above.

#Delegated App Profile Permissions

Fly allows you to use the Fly delegated app profile or custom delegated app profile to connect to your workspace.

To use the Fly delegated app profile with required permissions, refer to Fly Delegated App Profile Permissions.

To use a custom delegated app profile with required permissions, refer to the following steps:

1. After registering an app in Microsoft Entra ID, add the permissions in the table below to the app.

   API	Permission	Type	Purpose
   Microsoft Information Protection Sync Service	UnifiedPolicy.User.Read	Delegated	Only required if you want to manage the sensitivity labels of files/emails/Groups.
   Microsoft Graph	Domain.Read.All	Delegated	Retrieve tenant domain.
   Microsoft Graph	RoleManagement.Read.Directory	Delegated	Retrieve directory roles.
   Microsoft Graph	Group.Read.All	Delegated	Retrieve Microsoft 365 Groups and group members.
   Microsoft Graph	Group.ReadWrite.All	Delegated	Required if you only use the delegated app profile and the consent user is not the group owner of source Groups. Meanwhile, the consent user must have the Groups Administrator role. This can automatically add the consent user as the group owner. If the consent user is already the group owner, you can change this permission to Group.Read.All.
   Microsoft Graph	Sites.Read.All	Delegated	Retrieve files of team sites.
   Microsoft Graph	User.Read.All	Delegated	Retrieve information of Microsoft 365 user profiles.
   Azure Rights Management Services *Note: For 21Vianet tenants, the API name is Microsoft Rights Management Services.	user_impersonation	Delegated	Only required if you want to manage the sensitivity labels of files/emails/Groups.
   Office 365 Exchange Online	EWS.AccessAsUser.All	Delegated	Use Exchange Web Services with full access to user data via impersonation.
   SharePoint/Office 365 SharePoint Online	AllSites.FullControl	Delegated	Retrieve settings and permissions of team sites.

   For easy use, you can directly use the following commands to add required API permissions through Manifest for Microsoft 365 Commercial tenants.

   "requiredResourceAccess": [
     {
       "resourceAppId": "00000003-0000-0ff1-ce00-000000000000",
       "resourceAccess": [
         {
           "id": "56680e0d-d2a3-4ae1-80d8-3c4f2100e3d0",
           "type": "Scope"
         }
       ]
     },
     {
       "resourceAppId": "00000002-0000-0ff1-ce00-000000000000",
       "resourceAccess": [
         {
           "id": "3b5f3d61-589b-4a3c-a359-5dd4b5ee5bd5",
           "type": "Scope"
         }
       ]
     },
     {
       "resourceAppId": "00000012-0000-0000-c000-000000000000",
       "resourceAccess": [
         {
           "id": "c9c9a04d-3b66-4ca8-a00c-fca953e2afd3",
           "type": "Scope"
         }
       ]
     },
     {
       "resourceAppId": "00000003-0000-0000-c000-000000000000",
       "resourceAccess": [
         {
           "id": "2f9ee017-59c1-4f1d-9472-bd5529a7b311",
           "type": "Scope"
         },
         {
           "id": "5f8c59db-677d-491f-a6b8-5f174b11ec1d",
           "type": "Scope"
         },
         {
           "id": "4e46008b-f24c-477d-8fff-7bb4ec7aafe0",
           "type": "Scope"
         },
         {
           "id": "741c54c3-0c1e-44a1-818b-3f97ab4e8c83",
           "type": "Scope"
         },
         {
           "id": "205e70e5-aba6-4c52-a976-6d2d46c48043",
           "type": "Scope"
         },
         {
           "id": "a154be20-db9c-4678-8ab7-66f6cc099a59",
           "type": "Scope"
         }
       ]
     },
     {
       "resourceAppId": "870c4f2e-85b6-4d43-bdda-6ed9a579b725",
       "resourceAccess": [
         {
           "id": "34f7024b-1bed-402f-9664-f5316a1e1b4a",
           "type": "Scope"
         }
       ]
     }
   ],

2. Click Authentication in the left navigation of the app.

3. Click Add a platform.

4. Select Web in the Configure platforms panel.

5. In the Configure Web panel, enter the AvePoint Online Services URL: https://www.avepointonlineservices.com for your commercial environment or https://usgov.avepointonlineservices.com for your U.S. Government environment in the Redirect URIs field.

6. Select the Access tokens and ID tokens checkboxes in the Implicit grant and hybrid flows field.

   

7. Click Configure.

8. Click Save.

9. Create an app profile for the app using the Custom mode in AvePoint Online Services by referring to Consent to a Custom Azure App with Delegated Permissions.

   NOTE

   When consenting to the app, if you have granted the admin consent and allowed public client flows for the permissions, you can choose to use the Global Administrator consent or the User consent method. If not, you can only use the Global Administrator consent method.