Create M365 App Registration

Microsoft requirement: App Registration for programmatic access

You need to complete 3 steps:

  1. Create a self-signed certificate — this is what proves your identity to Azure
  2. Create an App Registration — this is the Azure identity your application will run as
  3. Grant permissions — this controls what the App Registration is allowed to do

—-

Step 1 — Create a self-signed certificate

The certificate is used to authenticate your App Registration without a password. You will generate two files: a .pfx (private key, kept secret) and a .cer (public key, uploaded to Azure).

  • Open PowerShell ISE or VSCode as Administrator
  • Paste the script below
  • Replace c:\dev\MyCert.pfx with your preferred output path
  • Replace MyPassword with a password of your choice
  • Run the script
# Create the certificate
$mycert = New-SelfSignedCertificate -DnsName "MyDomain.com" -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(5) -KeySpec KeyExchange -KeyFriendlyName MyKeyName -FriendlyName MyFriendlyName

# Export private key to .pfx (keep this secret)
$mycert | Export-PfxCertificate -FilePath c:\dev\MyCert.pfx -Password $(ConvertTo-SecureString -String "MyPassword" -AsPlainText -Force)

# Export public key to .cer (this gets uploaded to Azure)
$mycert | Export-Certificate -FilePath c:\dev\MyCert.cer
  • MyDomain.com — any identifier, does not need to be a real domain
  • MyKeyName and MyFriendlyName — descriptive names to identify the cert in the Windows certificate store

You can also install the certificate on the computer, but this adds complexity and is not required.

—-

Step 2 — Create an App Registration

The App Registration is the Azure AD identity that SMART Migration will authenticate as. You link the certificate to it so Azure knows to trust it.

  • Go to the Azure portal and open Azure Active Directory / Microsoft Entra ID
  • Copy and save your Tenant ID (shown on the overview page) — you will need this in SMART Migration
  • Click App registrations in the left panel
  • Click New registration — default settings are fine
  • Once created, go to Certificates & secrets (top-right area)
  • Click Upload certificate, select your .cer file, and click Add
  • Copy and save the Application (client) ID — you will also need this in SMART Migration


—-

Step 3 — Grant permissions

Permissions define what data the App Registration can access. You grant them here and then an admin approves them (“consents”) for the whole organisation.

  • Click API Permissions in the left panel
  • Click Add a permission → select SharePoint → select Application permissions
  • Add the permissions listed below
  • Click Grant admin consent for [Your Organization] — this activates the permissions

.

.

.

.

Advanced Configuration

Microsoft Graph permissions (4)

Permission Type Required for Why
Files.ReadWrite.All Application OneDrive Read and write files in all site collections
Group.ReadWrite.All Application OneDrive & Teams Read and write all groups — needed for Teams provisioning
Sites.ReadWrite.All Application Teams Read and write items in all site collections
User.Read.All Application Both Read full user profiles — needed for user and OneDrive discovery

SharePoint permissions (3)

Permission Type Why
Sites.FullControl.All Application Full control of all site collections — required for migration
TermStore.Read.All Application Read managed metadata — needed to preserve metadata during migration
TermStore.ReadWrite.All Application Read and write managed metadata — needed if migrating or transforming metadata

—-

Connect to SMART Migration

Once the App Registration is configured in Azure, enter the details into your M365 connection in SMART Migration.

  • Open your M365 connection in SMART Migration
  • Enter the Application (client) ID and Tenant ID you saved in Step 2
  • Provide the path to your @.pfx@ file and its password

—-

Restricting access to specific sites only

By default, the permissions above grant access to all SharePoint sites. If you need tighter control — for example in a production environment — use Sites.Selected instead.

This limits the App Registration to only the sites you explicitly assign it to, reducing your attack surface significantly. See: Sites.Selected Permissions — what it is and how to use it

Microsoft Graph permission reference

Add only what you need:

Permission When you need it
Files.Read.All Accessing files larger than 2 GB
Sites.Read.All Discovering SharePoint sites
Users.Read.All Discovering users and OneDrive locations
Group.ReadWrite.All Provisioning Teams for Content Governance
Sites.Selected Restricting access to specific sites only

—-

Reading AD User Information

SMART Migration can read M365 user data (display name, department, OneDrive URL, etc.) from Active Directory via the virtual list Tenant users.

Required Graph API permission — add one of the following depending on which user fields you need:

  • User.Read.All — full user profile access
  • User.ReadBasic.All — basic fields only (name, email, photo)

Filter performance:

  • = and IN operators → server-side filter — fast, recommended for tenants with 3,000+ users
  • BeginsWith and Contains → client-side filter — slower on large tenants