Tenant Environments

All Power365 Projects require at least 2 Office 365 Multi-Tenants or environments be added to your Power365 Project to establish at least one source and one target environment for migration and integration activities. Additional environments can be added for more complex migration scenarios.

 

What is a Tenant?

A “tenant” or “environment” is this context is referring to an Office 365 Worldwide subscription.

 

What should I prepare before adding a tenant?

Before creating your project, it is recommended that an Application Service Account be created in each of your Office 365 environments. This account will be used for the duration of the project or services requirement.

This account will be used to grant delegated permissions to Power365 on-behalf of the signed-in user. The administrator consents to the permissions that the app requests and the app has delegated permission to act as the signed-in user when making calls to Microsoft Graph. Some higher-privileged permissions require administrator consent. Power365 requires Global Administrator consent for 4 Graph permissions anytime a tenant is added or reconnected.

Follow these recommended steps to prepare your accounts for project setup:

  1. Create a cloud only Power365 Application Service Account in each environment.
  2. The recommended name of the account would be “Power365 App Services”.
  3. Set the account password expiration date to correspond with the project end date or set to “do not expire”.
  4. Assign Global Administrator Role to the account.
  5. Assign an Office 365 License to the user. The minimal subscription should include Exchange Online.
  6. Login to the account for the first time in Office 365 to verify access.
  7. Make the account information available to the authorized administrator for each client environment.

Please Note: It is acceptable to use an existing administrator account if that is preferred.

 

How do I add a tenant to my project?

During the start of your project setup you will be asked to add your tenants or environments. Follow these steps to complete the process.

  1. Login to Power365 with your Microsoft account.
  2. Click the Create Project button or open your existing project.
  3. Navigate through the setup wizard to the add a tenant step.
  4. Click the Add Tenant button.

  5. When you add a tenant, you will be prompted for your Microsoft account.
  6. Enter the credentials of an administrative account for this Office365 tenant.
  7. Read and accept the permission notice related to MS Graph permissions required to manage your migration and integration projects. For more details about required Graph permissions, see the Power365 Application Permission Requirements topic.

    (click to view larger)

  8. You will then be returned to the Add Tenant screen. You will repeat this process for each tenant that is part of the project.

 

What happens when I add a Tenant to my Project for the first time?

When setting up your project for the first time, a Binary Tree PowerShell account will be created in each tenant added to the project and the Power365 App will be installed. This account is used for PowerShell related tasks and to provide full access to the source and target mailboxes for migration purposes.

To complete this process, each tenant must have at least 1 available Office 365 license, so it may be assigned to the account. For more detail, please review the prerequisites documentation for more information.

  1. Power365 will use your Application Service Account you created to connect to Office 365. Credentials are never stored or transmitted between Power365 and Office 365.

  2. Power365 will add the Power365 App to your Tenant. See figure 2 below.

  3. Power365 will create a cloud only account in your Office 365 tenant for PowerShell.

  4. Power365 will license your new account with the available subscription that has the Exchange Online plan. A lower cost license will be used if available. For example, if you have both E3 and E1; E1 will be used if a license is available.

  5. Power365 by default will grant the Exchange and SharePoint Administrator Roles to this account.

    Figure 2: Example Power365 App (click to view larger)

 

What permissions am I granting to Power365?

Here is the list of minimal Graph permissions required to operate a Power365 project.

  1. Sign in and read user profile (User.Read)

  2. Read and write all users’ full profile (User.ReadWrite.All)

  3. Read and write all groups (Group.ReadWrite.All)

  4. Read and write directory data (Directory.ReadWrite.All)

  5. Access directory as the singed in user (Directory.AccessAsUser.All)

  6. Have full access to all files user can access (Files.ReadWrite.All)

  7. Send mail as user (Mail.Send)

For more details about the required Graph permissions, check out the Application Permission Requirements topic.

 

How are these permissions being used?

The following lists the basic need for each Graph permission. For more details about required Graph permissions, see the Power365 Application Permission Requirements topic.

  1. Sign in and read user profile (User.Read) - Used to connect a tenant.

  2. Read and write all users’ full profile (User.ReadWrite.All) - Used for OneDrive Sync.

  3. Read and write all groups (Group.ReadWrite.All) – Used for OneDrive Sync.

  4. Read and write directory data (Directory.ReadWrite.All) - Used to discover Azure directory and automate licensing.

  5. Access directory as the singed in user (Directory.AccessAsUser.All) - Used to provision the Binary Tree PowerShell account and assign the required roles.

  6. Have full access to all files user can access (Files.ReadWrite.All) – Used to read and write OneDrive files during Sync.

  7. Send mail as user (Mail.Send) - Used to send the User Cutover email notification.

 

Does Power365 save my account password?

Power365 will not ask you to save or transmit your administrator credentials in any cloud environment endpoint configuration.

 

What account roles are required to manage my project(s)?

For daily migration and integration operations and services, the minimum Office 365 administrator roles required are:

  1. Exchange Administrator (Mailboxes, Archives, PFs)
  2. SharePoint Administrator (OneDrive)

For complete details about the required account roles, check out the Prerequisites.

 

What account roles are required to add or reconnect a tenant to my project(s)?

Anytime a tenant is connected for the first time or reconnect later, the minimum Office 365 administrator role required is:

  1. Global Administrator

For complete details about the required account roles, check out the Prerequisites.

 

When should I reconnect my tenant?

There are a few reasons why you could be required to reconnect your Office 365 tenant to your Power365 project. The following lists the most common reasons this action is required.

  1. Office 365 OAuth Token has Expired – After 90 days a standard OAuth token will expire. So, if your project is running longer than 3 months, please be sure to update your token by reconnecting your tenant to your project.
  2. Before a Domain Cutover Event – Before a domain cutover event, it is required that you raise your application account’s role to Global Administrator to facilitate the domain move orchestration and automation.
  3. Application Account has Changed – If the Application Account is deleted, recreated or changed it will be required that you reconnect your tenant to the project to continue services.

 

Additional Information

Application Permission Requirements

Quick-Start Guide (PDF)

Prerequisites (PDF)

Domain Cutover