Set up an Azure App Registration

Navigate to Azure Active Directory → App registrations → New registration.

• Name: use something descriptive, e.g. "TheMigrator – Source" or "TheMigrator – Destination".
• Supported account types: Accounts in this organizational directory only.
• Redirect URI: leave blank. Click Register.
• Copy the Application (client) ID and Directory (tenant) ID from the overview page.

In the app registration, go to Certificates & secrets → Client secrets → New client secret. Set an expiry and click Add. Copy the Value immediately — it will not be shown again after you navigate away.

• Recommended expiry: 24 months.
• Store the secret value in a password manager immediately.

Go to API permissions → Add a permission → Microsoft Graph → Application permissions. Add the permissions for every workload you intend to migrate.

• Email: Mail.ReadWrite, Calendars.ReadWrite, Contacts.ReadWrite, User.Read.All, Organization.Read.All
• SharePoint: Sites.FullControl.All, User.Read.All, Organization.Read.All
• OneDrive: Files.ReadWrite.All, User.Read.All, Organization.Read.All
• Teams Channels: TeamSettings.ReadWrite.All, ChannelMessage.Read.All, User.Read.All, Organization.Read.All
• Teams Chat (optional): add Chat.Read.All if you want to migrate private and group chat history

On the API permissions page, click "Grant admin consent for [your tenant]". This requires a Global Admin. Every permission should show a green tick with "Granted for [tenant]" status after clicking.

• If the button is greyed out, you are not signed in as a Global Admin.
• All permissions must show green ticks — any red or pending status means the migration will get 403 Forbidden errors.

In TheMigrator → Tenants → Connect tenant, choose "Use your own Azure App Registration". Enter the tenant domain, Client ID, and Client Secret from the steps above. Click Validate & Connect.

After connecting, TheMigrator will discover the tenant's users and sites. Confirm the mailbox count and site count are correct. If discovery shows 0 users, the permissions are missing or admin consent was not granted.