In performing cross-tenant migration, we encountered some steps which could be be automated; hence this script.
This gives step by step process for migration mailbox from tenant to tenant
- Global admin access to both tenants
Target (destination): This where the mailbox will be moved to. o365Training
Source (origination): this is where the mailbox will be migrated from. GritDev
Migration App Creation and Permission Concert
-
Visit portal.azure.com > Click view under Manage Azure Active Directory
-
Select App registration > Select New registration
Provide Detail | Support account type:
Select "Accounts in any organizational directory (Any Azure AD directory - Multitenant)"
-
Select Register
-
Click App Registration > Under Owned applications, select the new app created.
-
Under ^Essentials,
Copy down the Application (client) ID, the will be used to create a URL for the target tenant.
-
Now, on the left navigation bar, click on API permissions to view permissions assigned to your app.
By default, User. Read permissions are assigned to the app you created,
- We do not require them for mailbox migrations,
- You can remove that permission by clicking the 3dots and Select remove permission
-
Assign require permission to the app
- To add permission for mailbox migration, select Add a permission
- In the Request API permissions windows, select APIs my organization users, and select for office 365 exchange online.
- Select Application permission
- Under Select permissions, expand Mailbox, and check Mailbox.Migration, and Add permissions
-
Certificates and Secretes
- Under Client secrets, select new client secret.
- Configure client secrete and expiration date > click add
- Make note of the secret and value
-
Grant Consent for the target tenant
- To consent to the application, go back to the Azure Active Directory landing page,
- click on Enterprise applications > Select your custom application
- Select permission in the navigation > Click on the Grant admin consent for [your tenant] button
-
Grant consent for Source Tenant using app id from target tenant
- Formulate the URL to send to your trusted partner (source tenant admin)
- https://login.microsoftonline.com/sourcetenant.onmicrosoft.com/adminconsent?client_id=\/**[application_id_of_the_app_you_just_created_from_the_target_tenant\]**&redirect_uri=https://office.com
- Paste the formulate URL in the browser
Needed:
- Application ID (target), password[secret] (target), source tenant default domain
- Also depending on the Microsoft 365 Cloud Instance you use your endpoint may be different
-
Connect Exchange Online PowerShell
Connect-exchangeOnline #sign in with admin account for target tenant -
Create a new migration endpoint
$AppId = "[guid copied from the migrations app created on target tenant]"
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $AppId, (ConvertTo-SecureString -String "[this is your secret password you saved in the previous steps on the target tenant]" -AsPlainText -Force)
New-MigrationEndpoint -RemoteServer outlook.office.com -RemoteTenant "sourcetenant.onmicrosoft.com" -Credentials $Credential -ExchangeRemoteMove:$true -Name "[the name of your migration endpoint]" -ApplicationId $AppId -
Create new or edit your existing organization relationship object to your source tenant
$sourceTenantId= "[tenant id of your trusted partner, where the source mailboxes are, source]"
$orgrels=Get-OrganizationRelationship
$existingOrgRel = $orgrels | ?{$_.DomainNames -like $sourceTenantId}
If ($null -ne $existingOrgRel) { Set-OrganizationRelationship $existingOrgRel.Name -Enabled:$true -MailboxMoveEnabled:$true -MailboxMoveCapability Inbound }
If ($null -eq $existingOrgRel) { New-OrganizationRelationship "[name of the new organization relationship]" -Enabled:$true -MailboxMoveEnabled:$true -MailboxMoveCapability Inbound -DomainNames $sourceTenantId }
Accept and Consent Migration App and configuring the organization relationship on Source (current mailbox location)
-
Formulate the URL to send to your trusted partner (source tenant admin)
-
Paste the formulate URL in the browser > Sign in with source tenant account > Accept the terms.
Application will be added your Azure Active Directory portal under Enterprise applications
-
Create new or edit organization relationship
$targetTenantId="[tenant id of your target tenant, where the mailboxes are being moved to]"$appId="[application id of the mailbox migration app you consented to]"
$scope="[name of the mail enabled security group that contains the list of users who are allowed to migrate (source)]"
$orgrels=Get-OrganizationRelationship
$existingOrgRel = $orgrels | ?{$_.DomainNames -like $targetTenantId}
If ($null -ne $existingOrgRel) {
Set-OrganizationRelationship $existingOrgRel.Name -Enabled:$true -MailboxMoveEnabled:$true -MailboxMoveCapability RemoteOutbound -OAuthApplicationId $appId -MailboxMovePublishedScopes $scope }
If ($null -eq $existingOrgRel) {
New-OrganizationRelationship "[name of your organization relationship]" -Enabled:$true -MailboxMoveEnabled:$true -MailboxMoveCapability RemoteOutbound -DomainNames $targetTenantId -OAuthApplicationId $appId -MailboxMovePublishedScopes $scope
}
- Example target (Destination) MailUser object:
> 
- Example source (origin) Mailbox object:
-
Test Endpoint server reachability
Test-MigrationServerAvailability -Endpoint "[the name of your cross-tenant migration endpoint]"
Test-MigrationServerAvailability -Endpoint T2TMailboxMigration
-
Test Migration Success for a source mailbox that must be migrated
Test-MigrationServerAvailability -Endpoint "[the name of your cross-tenant migration endpoint]" -TestMailbox "[email address of a source mailbox that is part of your migration scope]"
Test-MigrationServerAvailability -Endpoint T2TMailboxMigration -TestMailbox LaraN@o365TrainDev.onmicrosoft.com
The following happens if the LagacyExchangeDN to from the source mailbox has not been added as x500 proxy address on the target mail user.
