Home / Platform Considerations / M365 Authentication Options

EWS/Graph Modern Authentication (OAuth 2.0)

When migrating to or from Microsoft Exchange Web Services (EWS) or Graph with Modern Authentication (OAuth 2.0), you must create an application that Transend uses to perform an administrative driven migration. Below are instructions to create the application either programmatically via PowerShell or manually through the Entra admin center UI.

On this page:

• Programmatically create your application in PowerShell
• Manually create your application in Entra admin center

Programmatically create your application in PowerShell

If you are comfortable running PowerShell scripts, you can use the m365_initialize_app.ps1 script to programmatically create and configure the Microsoft Entra ID app that Transend products use to connect to Microsoft 365.

The script creates the app registration and service principal, assigns the Microsoft Graph, Exchange, and SharePoint permissions needed by the migration tools, grants admin consent, creates a client secret, and assigns the required directory role. Automating these steps reduces manual setup process (defined below) and helps ensure that the credentials supplied to the other Microsoft 365 scripts have the required access.

After you create your application, follow steps 25 and 26 below to enter the necessary Application ID and Application Secret into Transend Migration Console during configuration.

The script is available through TMCTools:

• Download TMCTools
• View Documentation

Manually create your application in Entra admin center

Manually create an application that is unique to your organization in order to receive an Application ID and Application Secret that you will input into Transend Migration Console during configuration.

Important: When inputting an email address as requested below, primary email addresses are required. If an alias email address is used, errors will occur.

1. Log into Microsoft Entra admin center as an administrator.

2. Click Entra ID > App registrations.

   

3. Click New registration.

   

4. Select any name for your app (i.e. Transend Migration Console for XYZ Corp).

5. Set the account type to Accounts in this organizational directory only. Do not enter a Redirect URL.

6. Click Register.

   

7. Once successfully registered, copy the Application (client) ID. You will eventually need to enter this into Transend Migration Console.

   

8. Click Manage > Certificates & Secrets.

9. Click New client secret.

   

10. Add a secret and expiration and click Add.

    

11. Copy your secret’s Value to notepad. You will eventually need to enter this into Transend Migration Console.

    

12. Click API Permissions > Add a permission.

    

13. Click the APIs my organization uses tab.

14. In the search bar, enter Office 365 and select Office 365 Exchange Online.

    

15. Click the Application permissions box.

    

16. Click the checkbox to add the following API Permissions:

    • Exchange > Exchange.ManageAsApp
    • Other Permissions > full_access_as_app
    • IMAP > IMAP.AccessAsApp

    

17. After checking the box of all the above referenced permissions, click Add permissions at the bottom of the page.

18. You will now see the selected permissions listed in the Office 365 Exchange Online section.

    

19. On the API Permissions page, select Microsoft Graph.

    Important: If Microsoft Graph has not previously been added, you must first add Microsoft Graph before completing Steps 20 – 23.

    

20. Select Microsoft Graph to open a “Request API permissions” screen. Select the Applications permissions box and then type Mail.Read into the Select permissions search field. Expand the Mail section and check the box for Mail.ReadWrite.

    

21. Click Update permissions at the bottom of the screen.

22. Follow the same steps to add the following permissions. You should be able to check them all and then click ‘Add permissions’ to add them all at once.

    • TeamSettings.ReadWrite.All
    • Mail.ReadWrite
    • User.ReadWrite.All
    • Directory.ReadWrite.All
    • MailboxItem.ReadWrite.All
    • MailboxFolder.Read.All
    • Contacts.ReadWrite
    • Sites.Manage.All
    • Files.ReadWrite.All
    • Mailboxitem.ImportExport.All
    • Calendars.ReadWrite
    • MailboxSettings.ReadWrite
    • Tasks.ReadWrite.All
    • Sites.FullControl.All

    

23. In the Configured permissions section, click Grant admin consent for [your organization], and then click Yes in the dialog box.

    

24. Congratulations! Admin consent has been successfully granted.

    

25. In Transend Migration Console, navigate to the Configuration Settings > Required screen.

26. Enter values into the following fields:

    • Primary Domain

    • Application (client) ID

    • Application Secret (Value)