MigrateX connects to a Microsoft 365 tenant the way Microsoft recommends for tools like this: a Global Administrator approves the MigrateX application once, and MigrateX then works with application permissions. No user signs in, no password is shared, no license is needed.
Before you click
- You need to be a Global Administrator of the tenant you are connecting. Exchange Administrator alone is not enough for consent.
- If your tenant requires admin approval for apps, you are the admin — the consent screen is that approval.
- For the second tenant, open a private browser window, or Microsoft will quietly sign you into the first one.
Step by step
- Press Connect source tenant (or target)On the project Overview. MigrateX sends you to Microsoft's sign-in page.
- Sign in as the Global AdministratorOf the tenant you are connecting. Check the tenant name in the top right of Microsoft's page before you continue.
- Read the permissions and press AcceptMicrosoft lists what MigrateX asks for. The list matches your project's scope — mail permissions only if mail is in scope, and so on.
- Sign in once more to confirmMicrosoft sends you straight back to a sign-in for the same tenant. This is MigrateX making sure the person connecting really administers that tenant: it verifies the sign-in and checks the account holds the Global Administrator role. Use the same account; it takes a few seconds.
- Back in MigrateX, watch the checkYou land on the project page. The tenant node shows the name, domain, tenant ID and "18 of 18 permissions" (or however many your scope needs).
What each permission is for
| Permission | Used for | In scope when |
|---|---|---|
User.Read.All, Directory.Read.All | Reading users, domains and usage reports for the assessment and matching | Always |
Mail.ReadWrite, MailboxSettings.ReadWrite | Reading and writing mailboxes, folders, rules and signatures | Mailboxes |
Calendars.ReadWrite, Contacts.ReadWrite | Calendars and contacts | Mailboxes |
Files.ReadWrite.All, Sites.FullControl.All | OneDrive files and sharing; SharePoint sites and libraries | OneDrive, SharePoint |
Group.ReadWrite.All, Team.Create, Teamwork.Migrate.All | Groups, Teams in migration mode, channel history import | Teams, Groups |
Exchange.ManageAsApp + Exchange Administrator role | Shared mailbox rights, aliases, distribution lists through Exchange Online PowerShell | Shared mailboxes & aliases |
What to prepare in each tenant
Nothing is installed and no service account is created. What helps is having these ready before you connect:
- A Global Administrator at each end. Nothing else works — Exchange or SharePoint admins cannot grant application consent.
- Target accounts for everyone who is moving, each with a mailbox license. The assessment lists who is missing; create them in the target's admin center and run Auto-match again.
- Usage reports not anonymised in the source (Microsoft 365 admin center → Settings → Org settings → Reports → untick Display concealed user, group and site names), so the assessment can show mailbox and drive sizes per person.
- For shared mailbox rights, aliases and distribution lists: the MigrateX app also needs the Exchange Administrator role in that tenant (Entra ID → Roles and administrators → Exchange Administrator → Add assignment → search the MigrateX app). Without it those objects are listed for manual handling; everything else still migrates.
- For cutover: someone with access to the domain's DNS records.
Does MigrateX need delegated permissions?
No. Everything runs on application permissions with a certificate credential — no user signs in for the migration, no password is shared, no admin account needs a license. The only delegated permission on the app is User.Read, used once for the confirmation sign-in above; it reads nothing beyond that administrator's own basic profile. A tenant admin can see this under Entra ID → Enterprise applications → MigrateX → Permissions.
"Permissions pending" or "N of M granted"
Right after consent, Microsoft needs a minute before the new permissions are active. MigrateX waits for that during the connection and, if some are still pending, the project page keeps re-checking by itself for a few minutes — you can leave it open. Permissions that stay red after that are ones the administrator did not grant (or that the MigrateX app registration does not offer yet); press Grant consent again once they are available.
Consent sometimes takes a minute to propagate, and an administrator can consent to a subset. On the project page open Manage → Show permissions: missing ones are marked. Press Re-check after a minute; if some are still missing, press Grant consent again and accept the full list.
Revoking access
In the tenant: Entra ID → Enterprise applications → MigrateX → Delete. Access ends immediately. In MigrateX: Manage → Disconnect forgets the tokens. Nothing in the tenant is touched by either.