Home > Perform Microsoft Teams Migrations > Required Permissions for Microsoft Teams Migration > Source Permissions When Destination is Google Chat Space
Export to PDFSource Permissions When Destination is Google Chat Space
Fly App Profile Permissions
With the Tenant Owner or Service Administrator role, you can create a Fly app profile in AvePoint Online Services > Management > App management to connect to the Microsoft 365 tenant using the Fly app.
Refer to Fly App Profile Permissions about how to create a Fly app profile and the required permissions of the Fly app profile.
Custom App Profile Permissions
With the Tenant Owner and Service Administrator role, you can create a custom app profile in AvePoint Online Services > Management > App management to connect to the Microsoft 365 tenant using a custom Azure app.
Refer to the following procedures to create a custom app profile:
-
Prepare a certificate in Microsoft Entra ID. Refer to for more information.
You can ignore this step if you have a certificate.
-
Create a custom Azure app in Microsoft Entra ID. Refer to for more information.
-
.
-
in AvePoint Online Services.
*Note: After you re-authorize the app profile, you need to wait about one hour before using the app profile for your migration to refresh the token if there are permissions updated.
Refer to the following tables to add API permissions required by Microsoft Teams Migration to the custom Azure app.
| API | Permission | Type | Purpose |
|---|---|---|---|
| Microsoft Graph | Domain.Read.All (Read domains) | Application | Retrieve the tenant domain. |
| Microsoft Graph | RoleManagement.Read.Directory (Read all directory RBAC settings) | Application | Retrieve directory roles. |
| Microsoft Graph | Group.Read.All (Read all groups) | Application | Retrieve Microsoft 365 Groups and Group members. |
| Microsoft Graph | Group.ReadWrite.All(Read and write all groups) | Application | Only required if you use both the app profile and the service account in the source connection and the source service account is not the team owner, to automatically add the service account as the team owner. |
| Microsoft Graph | Sites.Read.All (Read items in all site collections) | Application | Retrieve channel folders and files of team sites and private channels’ site collections. |
| Microsoft Graph | User.Read.All (Read all users’ full profiles) | Application | Retrieve information of Microsoft 365 user profiles. |
| Microsoft Graph | ChannelMember.Read.All(Read the members of all channels) | Application | Retrieve private/shared channel members. |
| Microsoft Graph | ChannelMember.ReadWrite.All(Add and remove members from all channels) | Application | Only required if you use both the app profile and the service account in the source connection and the source service account is not the private/shared channel owner, to automatically add the service account as the channel owner. |
| Microsoft Graph | ChannelMessage.Read.All(Read all channel messages) | Application | Retrieve all channel messages. |
| Microsoft Graph | TeamMember.Read.All(Read the members of all teams) | Application | Retrieve Team members. |
| Microsoft Graph | Reports.Read.All(Read all usage reports) | Application | Only required by tenant discovery. |
| Microsoft Graph | ReportSettings.Read.All(Read all admin report settings) | Application | Retrieve the Reports setting of the Microsoft 365 admin center. |
| SharePoint/Office 365 SharePoint Online | Sites.FullControl.All (Have full control of all site collections) | Application | Retrieve settings and permissions of team sites. |
For easy use, you can directly use the following commands to add required API permissions through Manifest.
"requiredResourceAccess": [
{
"resourceAppId": "00000003-0000-0000-c000-000000000000",
"resourceAccess": [
{
"id": "35930dcf-aceb-4bd1-b99a-8ffed403c974",
"type": "Role"
},
{
"id": "7b2449af-6ccd-4f4d-9f78-e550c193f0d1",
"type": "Role"
},
{
"id": "dbb9058a-0e50-45d7-ae91-66909b5d4664",
"type": "Role"
},
{
"id": "62a82d76-70ea-41e2-9197-370581804d09",
"type": "Role"
},
{
"id": "230c1aed-a721-4c5d-9cb4-a90514e508ef",
"type": "Role"
},
{
"id": "ee353f83-55ef-4b78-82da-555bfa2b4b95",
"type": "Role"
},
{
"id": "483bed4a-2ad3-4361-a73b-c83ccdbdc53c",
"type": "Role"
},
{
"id": "332a536c-c7ef-4017-ab91-336970924f0d",
"type": "Role"
},
{
"id": "660b7406-55f1-41ca-a0ed-0b035e182f3e",
"type": "Role"
},
{
"id": "df021288-bdef-4463-88db-98f22de89214",
"type": "Role"
}
]
},
{
"resourceAppId": "00000003-0000-0ff1-ce00-000000000000",
"resourceAccess": [
{
"id": "678536fe-1083-478a-9c59-b99265e6b0d3",
"type": "Role"
}
]
}
],
Service Account Permissions
If you only use service account authentication for source Teams, the service account must meet the following requirements:
*Note: Users with Multi-Factor Authentication (MFA) enabled cannot be used as the service account to perform migrations. You can use a delegated app profile instead.
Additionally, Microsoft has updated API permissions for Microsoft Teams migration. Once the old permissions are deprecated, you can use a delegated app profile to migrate conversations and other Teams data.
What permissions are required if I also use an app profile?
If you use both service account and app profile authentications for source Teams, the service account must meet the following requirements:
*Note: Users with Multi-Factor Authentication (MFA) enabled cannot be used as the service account to perform migrations. You can use a delegated app profile instead.
Delegated APP Profile Permissions
Fly allows you to use the Fly delegated app profile or custom delegated app profile to connect to your workspace.
*Note: The license and permission requirements for the consent user are the same as those for the service account. For details, refer to Service Account Permissions.
*Note: If the consent user of the delegated app profile has Multi-Factor Authentication (MFA) enabled, you must authorize or re-authorize the delegated app profile after MFA is enabled. Otherwise, the migration jobs using the delegated app profile will fail.
*Note: If you re-authorize the app profile, you need to wait about one hour before using the app profile for your migration to refresh the token when there are permissions updated.
To use the Fly delegated app profile with required permissions, refer to Fly Delegated App Profile Permissions.
To use a custom delegated app profile with required permissions, refer to the following steps:
-
After registering an app in Microsoft Entra ID, add the required permissions to the app. The following sections show the required permissions of different tenants.
-
Click Authentication in the left navigation of the app.
-
Click Add a platform.
-
Select Web in the Configure platforms panel.
-
In the Configure Web panel, enter the AvePoint Online Services URL: for your commercial environment or for your U.S. Government environment in the Redirect URIs field.
-
Select the Access tokens and ID tokens checkboxes in the Implicit grant and hybrid flows field.
-
Click Configure.
-
Click Save.
-
Create an app profile for the app using the Custom mode in AvePoint Online Services by referring to .
*Note: When consenting to the app, if you have granted the admin consent and allowed public client flows for the permissions, you can choose to use the Global Administrator consent or the User consent method. If not, you can only use the Global Administrator consent method.
Custom Delegated App Profile
Make sure the custom delegated app has the following permissions.
| API | Permission | Type | Purpose |
|---|---|---|---|
| SharePoint/Office 365 SharePoint Online | AllSites.FullControl(Have full control of all site collections) | Delegated | Retrieve settings and permissions of team sites. |
| Microsoft Graph | Domain.Read.All(Read domains) | Delegated | Retrieve the tenant domain. |
| Microsoft Graph | RoleManagement.Read.Directory(Read directory RBAC settings) | Delegated | Retrieve directory roles. |
| Microsoft Graph | Group.Read.All(Read all groups) | Delegated | Retrieve Microsoft 365 Groups and Group members. |
| Microsoft Graph | Group.ReadWrite.All(Read and write all groups) | Delegated | Required if you only use the delegated app profile and the source consent user is not the Team owner to automatically add the consent user as the Team owner. |
| Microsoft Graph | Sites.Read.All(Read items in all site collections) | Delegated | Retrieve channel folders and files of team sites and private channels’ site collections. |
| Microsoft Graph | User.Read.All(Read all users’ full profiles) | Delegated | Retrieve information of Microsoft 365 user profiles. |
| Microsoft Graph | ChannelMember.Read.All(Read the members of all channels) | Delegated | Retrieve private/shared channel members. |
| Microsoft Graph | ChannelMember.ReadWrite.All(Add and remove members from all channels) | Delegated | Only required the source consent user is not the private/shared channel owner to automatically add the consent user as the channel owner. |
| |Microsoft Graph|ChannelMessage.Read.All(Read all channel messages)|Delegated|Retrieve all channel messages.|
For easy use, you can directly use the following commands to add required API permissions through Manifest.
"requiredResourceAccess": [
{
"resourceAppId": "00000003-0000-0ff1-ce00-000000000000",
"resourceAccess": [
{
"id": "56680e0d-d2a3-4ae1-80d8-3c4f2100e3d0",
"type": "Scope"
}
]
},
{
"resourceAppId": "00000003-0000-0000-c000-000000000000",
"resourceAccess": [
{
"id": "0c3e411a-ce45-4cd1-8f30-f99a3efa7b11",
"type": "Scope"
},
{
"id": "767156cb-16ae-4d10-8f8b-41b657c8c8c8",
"type": "Scope"
},
{
"id": "2f9ee017-59c1-4f1d-9472-bd5529a7b311",
"type": "Scope"
},
{
"id": "4e46008b-f24c-477d-8fff-7bb4ec7aafe0",
"type": "Scope"
},
{
"id": "741c54c3-0c1e-44a1-818b-3f97ab4e8c83",
"type": "Scope"
},
{
"id": "205e70e5-aba6-4c52-a976-6d2d46c48043",
"type": "Scope"
},
{
"id": "a154be20-db9c-4678-8ab7-66f6cc099a59",
"type": "Scope"
}
]
}
],