How to register the CodeTwo migration application
in Azure AD
Problem:
You want to manually register CodeTwo Office 365 Migration / CodeTwo Exchange Migration in your
Azure Active Directory tenant.
Solution:
Starting version 3.2.x, the CodeTwo migration application connects to Office 365 by using the
secure OAuth 2.0 authentication. To enable this connection, first you need to register CodeTwo
Office 365 Migration / CodeTwo Exchange Migration in Azure AD for all Office 365 tenants that will
be used in the migration process. Next, to allow the application to access your mailboxes and
perform the necessary migration tasks, you also need to grant the necessary permissions to that
application.
Important
Keep in mind that the CodeTwo migration application can perform the registration automatically.
You simply need to provide an Office 365 global admin credentials in the source/target server
connection wizard. To learn more, see the user's manual:
CodeTwo Exchange Migration
CodeTwo Office 365 Migration (source server connection)
CodeTwo Office 365 Migration (target server connection)
Use the links below for guidelines on how to register the CodeTwo migration application in Azure
AD:
1. Register a new application in Azure AD
2. Configure application permissions
3. Assign certificates / secrets to an app in Azure
Registering a new application in Azure AD
1. Sign in to your Azure Active Directory admin center.
2. Navigate to Azure Active Directory > App registrations and click New
registration (Fig. 1.). This opens the Register an application page.
Fig. 1. The App registration page in Azure AD.
3. Enter a name for the application (e.g. CodeTwo Migration app) and
click Register (Fig. 2.). You can leave the other options to their defaults.
Fig. 2. Registering the CodeTwo migration application with Azure AD.
Configuring application permissions
1. On the application Overview page, click View API permissions (Fig. 3.). The API
permissions page will open.
Fig. 3. Accessing the API permissions page.
2. Click the Add a permission button and select Exchange (Fig. 4.).
Fig. 4. Selecting Exchange-related permissions.
3. Click Application permissions, select full_access_as_app, and then click Add
permission (Fig. 5.).
Fig. 5. Adding new permissions in Azure AD.
4. Click Add a permission again and this time select Microsoft Graph.
4. Click Application permissions and select the following permissions:
o [Link]
o [Link]
o [Link]
o [Link]*
o [Link]*
* Important
The [Link] and [Link] permissions ale
necessary only for target Office 365 connections.
6. Back on the API permissions page, click the Grant admin consent button (once it
becomes available) and then click Yes to confirm (Fig. 6.).
Fig. 6. Granting the necessary consents.
Assigning certificates / secrets in Azure AD
You need to assign a certificate or client secret (app password) to the newly added application. This
will allow the OAuth protocol to prove the application’s identity. Follow the steps below to assign a
certificate or add a client secret to the CodeTwo migration application in Azure AD.
1. Navigate to Azure Active Directory > App registrations and select the newly added
application (in this case: CodeTwo Migration app).
2. In the navigation menu, click Certificates & secrets (Fig. 7.). Now, you need to assign
either a certificate or client secret to the CodeTwo migration application.
Fig. 7. Accessing the Certificates & secrets page.
1. 3a To assign a certificate, click the Upload certificate button, select your certificate file
and click Add (Fig. 8.). The certificate needs to be signed with a key size of 2048 bits.
Fig. 8. Assigning a certificate in Azure AD.
1. 3b To add a client secret, click the New client secret, enter a short description
(e.g. CodeTwo Migration app), select the expiration time (whichever suites your needs), and
click Add (Fig. 9.).
Important
Make sure to copy the client secret value to clipboard or use it in your CodeTwo migration
application straightaway, because once you refresh the page, you will not be able to view that
value again. You will have to create another client secret.
Fig. 9. Crating a new client secret for an application registered in Azure AD.
Once done, the application registration process is completed. You can now configure a connection
to Office 365 in your CodeTwo migration tool. All the information that you need to provide in
the Application details step of the server connection wizard (Fig. 10.) is provided in Azure AD
either on the application overview page (Application (client) ID and Directory (tenant) ID; refer
to Fig. 3. above) or on the Certificates & secrets page (Certificate thumbprint or Client secret).
Important
If you have used a certificate to identify the application, you can enter the Certificate
thumbprint only if the certificate associated with the CodeTwo migration application has been
added to the CurrentUser\Personal store on the same machine, where the application is
installed. If not, use the Import button to add the necessary certificate to that store.
Fig. 10. Providing the registration details in the Office 365 server connection wizard.