Prepare an Office 365 Tenant-to-Tenant Migration Plan using PowerShell (2024)

Comments

1. 

   Neal Z 10 Jun 2024Reply

   is there an additional pre-req (connect-msolservice, or something)?
   I run the .prepare script and get:
   Provisioning Entra App Registration for Tenant Migration Assessment Tool
   get-mgcontext : The term ‘get-mgcontext’ is not recognized as the name of a cmdlet, function, script file, or operable
   program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
   At C:\TenantAssessment\Prepare-TenantAssessment.ps1:73 char:12
   + $Context = get-mgcontext
   + ~~~~~~~~~~~~~
   + CategoryInfo : ObjectNotFound: (get-mgcontext:String) [], CommandNotFoundException
   + FullyQualifiedErrorId : CommandNotFoundException

   1. 

      Sean McAvinue 10 Jun 2024Reply

      The Microsoft Graph PowerShell SDK is a prereq and contains the command in your error.

2. 

   Vlad 22 Feb 2024Reply

   Hello Sean,

   Thank you for your great work! It seems like the script is not gathering the information any longer for the user mailbox size or anything related to the users. Any idea what could have triggered this?

   Thank you!

   Vlad

3. 

   Harry Donovan 29 Sep 2023Reply

   Is it possible to add more detailed information for the SPO sites? I’d like to see list of document libraries and sizes of document libraries? Site data consumption is easy to find from SPO admin center but data consumption and other details per document library would be nice feature

4. 

   Olaf Kehling 7 Jul 2023Reply

   Hi Sean,
   really great work! I really appreciate it. It helped us a lot to gather tenant information (also, if you don’t want to migrate it ;-)). It might make sense to add information, if a user/group/Mailbox was created in an on premises Active Directory Services Domain using Azure AD Connect.
   We did it for us, but maybe others find this also helpy

   1. 

      Sean McAvinue 7 Jul 2023Reply

      Hey Olaf,
      Great to hear it helped! Updating to check the sync status sounds like a good addition. I suggest you create a pull request with the additional code so you get the credit for adding it!

      See Also

      IM 151-8 PN/DP CPU interface module - EandM Public Sharepoint · 2012-05-15 · IM 151-8 PN/DP CPU interface module SIMATIC ET 200S distributed I/O IM 151-8 PN/DP CPU interface module - [PDF Document]La Voz de Austin May 2014 · Inside This Issue Free La Voz Gratis ... tor of the Latino Healthcare Forum in Austin, ... Experience Mexican American experience in Ne- - [PDF Document]Proceedings of the Fifth Biennial Conference of the Society for Implementation Research Collaboration (SIRC) 2019: where the rubber meets the road: the intersection of research, policy, and practice - part 2US Patent Application for CANNABIGEROL (CBG) PRODUCTS AND METHODS OF USE Patent Application (Application #20240082270 issued March 14, 2024)

5. 

   AusSupport 1 Jul 2023Reply

   Hi, Got this error?
   Error exporting report, check permissions and make sure the file is not open! Exception calling “Save” with “0” argument(s): “Error saving file C:\temp\TenantAssessment-1072023 110336 PM.xlsx”

   1. 

      Sean McAvinue 1 Jul 2023Reply

      The error is pretty clear. The output file couldn’t be saved. Does the C:/temp folder exist?

   2. 

      Farooq 21 Mar 2024Reply

      Hi,
      Did u find the issue i am local admin of temp folder but getting the same error, did u find solution

6. 

   samir 18 May 2023Reply

   Will it work if I want to migrate all rules associated with One tenant to another 5 tenants?

7. 

   Kung_Arthur_af_Sthlm 4 May 2023Reply

   Thank you for great content

8. 

   Alexander G 17 Mar 2023Reply

   HI Sean, or anyone else that might hae an issue with this,
   You need to update one line in the script, line 122 to:
   $Token = Get-MsalToken -ClientId $ClientId -TenantId $TenantId -ClientCertificate $Certificate -ForceRefresh -AzureCloudInstance 1. It Includes the “-AzureCloudInstance 1” at the end. It fixes a problem in the MSAL.

   If you get the error “The property ‘Authority’ cannot be found on this object. Verify that the property exists.” The above is you fix.

   Source https://github.com/AzureAD/MSAL.PS/issues/45

9. 

   Joel Hodges 19 Jan 2023Reply

   thanks for this script…very useful in planning

10. 

    Dean Niquette 12 Nov 2022Reply

    Extremely helpful tools here, saved me a bunch of time. Thanks!

11. 

    Paul Gordon 24 Oct 2022Reply

    Hi Sean – I’m struggling with the prepare script…. – NB I’m running it in a test tenant… I have no 365 subscription, only an AAD directory, if that’s relevant…
    I’m getting the error:
    New-AzureADApplication : Error occurred while executing NewApplication
    Code: Request_BadRequest
    Message: Cannot convert a primitive value to the expected type ‘Edm.Guid’. See the inner exception for more details.
    which is thrown by the New-AzureADApplication cmdlet on line 154… I’m assuming it’s a problem with one of the parameters, checking, I see that all the params have a value, the types are:
    $appname = String
    $appuri = system.array
    $permissions = RequiredResourceAccess
    $EXOapiPermission = RequiredResourceAccess
    Which on the face of it seems all good…
    I’m using an account which has Global Admin role (and ONLY that role)
    Any thoughts on where I might look to try to get past this?
    TIA

    1. 

       Sean McAvinue 13 Nov 2022Reply

       Hey Paul,
       The problem is likely the Exchange Online permissions with no Office 365 tenant associated. I don’t believe this will work without that

12. 

    Nanyo Nanev 20 Oct 2022Reply

    Hi Sean,

    Great job. You are a star!!! Highly appreciate what you did and shared.

    I have played with your T2T scripts, which work excellent for 3 tenants. I ran it against a fourth one and it created the excel report w/o any errors. The report is missing the MailboxItemCount and MailboxSizeGB data only (empty cells). If I run Get-MailboxStatistics [user] | ft DisplayName, TotalItemSize, I have the correct information for the particular user. All four tests are performed from the same laptop, software/modules versions. Are you aware if there is any variety of O365 tenants? I cannot explain to myself where is the difference and how the same script can fetch the data from three tenants but fails on the fourth. Did you have such an experience?

    1. 

       Sean McAvinue 13 Nov 2022Reply

       The item count and sizes come from the reports in 365 so I would check if your fourth tenant has obfuscated names in reports enabled.

       1. 

          Nanyo Nanev 26 Jan 2023Reply

          You were right! Thank you very much!

13. 

    Agile Admin 17 Oct 2022Reply

    I cannot get this to work versus a GCCH environment. What must I do to get this to authenticate properly? I will take a stab at it shortly, but I assume I am missing something easy

14. 

    Brian 12 Oct 2022Reply

    Sean, thank you for all of your work. I am running into an issue with the acquiring an access token:
    “Unable to acquire access token, check the parameters are correct
    The property ‘Authority’ cannot be found on this object. Verify that the property exists.”

    Any ideas?

15. 

    Ahmed 8 Oct 2022Reply

    Hi Team,

    We have migrated few mailboxes using tenant to tenant approach and we are facing a challenge with AIP encrypted emails. After the mailboxes migrated to the target tenant the recipients can no longer view AIP encrypted emails. We have tried multiple ways and also contacted Microsoft but there is no easy solution. We are also trying to leverage using of MIP API’s to see if the protection labels can be removed before migration but this is not an ideal solution. Have you come across this solution and is there a way we can achieve and help customers who can read the AIP protected emails post migration.

    1. 

       Sean McAvinue 13 Nov 2022Reply

       Hi Ahmed,
       Without modifying the protection or removing encryption this isn’t possible as far as I know.

16. 

    Dean Gilau 29 Aug 2022Reply

    Thanks so much for the Sean. I noticed the Export goes through fine but not updating the template… Any Advice?

    1. 

       Sean McAvinue 29 Aug 2022Reply

       Hi Dean,
       The script outputs to C:\temp\ with a new file. It doesn’t update the template. Make sure the folder exists before running.

    2. 

       Sean McAvinue 13 Nov 2022Reply

       Hi Dean,
       The template file does not get updated, a second file is created with the output

17. 

    Eduardo 9 Aug 2022Reply

    Hi!
    We have a large environment with many objects and the script is failing with the following error: “Invoke-RestMethod : The remote server returned an error: (401) Unauthorized”. The error starts after an hour of script execution, possibly the Access Token is expiring. Could help?

    1. 

       Sean McAvinue 29 Aug 2022Reply

       Hi Eduardo,
       Yes I imagine if this occurs after an hour then the token is expiring. It must be quite a large environment! You can always add in the Get-Msaltoken command from line 116 where you believe the token is expiring. I’ve run in environments with multiple thousand users without it taking that long but I didn’t come across one of that size.

18. 

    Shekhar Mistry 2 Aug 2022Reply

    I am attemtping to run throuh this process to prepare for a tenant to tenant migration. It doesnt look like I am receiving a Certificate Thumbprint from the Prepare Assessem*nt script. Am I doing something incorrectly?

    1. 

       Sean McAvinue 3 Aug 2022Reply

       Hi Shekar,
       Do you get a certificate created in your personal store? If not you may need to run PowerShell as admin

       1. 

          Shekhar Mistry 3 Aug 2022Reply

          Thanks for the reply. Checking to see. I did make sure to run Powershell as Admin. I then get this message when I try to run the Perfom Assessem*nt: “Unable to acquire access token, check the parameters are correct
          Cannot process argument transformation on parameter ‘ClientCertificate’. Cannot convert the “System.Security.Cryptograph
          y.X509Certificates.X509Store” value of type “System.Security.Cryptography.X509Certificates.X509Store” to type “System.Se
          curity.Cryptography.X509Certificates.X509Certificate2″.”

          1. 

             Shekhar Mistry 3 Aug 2022Reply

             This is the error I receive when running as local admin as well as Azure Global admin:

             New-AadApplicationCertificate : ERROR. Probably need to run as Administrator.
             At C:\Users\user\Desktop\PS\Prepare_Assesem*nt.ps1:196 char:15
             + … humbprint = New-AadApplicationCertificate -ClientId $appReg.AppId -Ce …
             + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
             + CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
             + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,New-AadApplicationCertificate

             1. 

                Shekhar Mistry 5 Aug 2022

                Was finally able to get it to work. Getting a new error during the Perform. Anyone else see this?

                Method invocation failed because [System.Object[]] does not contain a method named ‘op_Division’.
                At C:\Users\\desktop\PS\Perform_Assesem*nt.ps1:807 char:9
                + $user.OneDriveSizeGB = (((($OneDrive | ? { $_.’Owner Principa …
                + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                + CategoryInfo : InvalidOperation: (op_Division:String) [], RuntimeException
                + FullyQualifiedErrorId : MethodNotFound

          2. 

             Sean McAvinue 5 Aug 2022Reply

             Hi Shekhar,
             I have seen that error and will update to account for it. It occurs when one of the values in the Microsoft usage report is blank. You should still have the output file though

             1. 

                Shekhar Mistry 5 Aug 2022

                Thank you! This has been a huge help! Quick question is the One Drive Data Size in GB as well?

             2. 

                Sean McAvinue 5 Aug 2022

                Yes it’s in GB

19. 

    Henrique 28 Jul 2022Reply

    I tested the script in a small test environment and it worked perfectly, now I am testing it in a real environment with many teams and users and I am getting an error as the script takes hours to run.

    Error: Invoke-RestMethod : The remote server returned an error: (401) Not authorized.

20. 

    Clement B. 17 Jun 2022Reply

    Hello,
    Thanks for the scripts.
    I have an issue with the perform script.
    It stops when it tries to connect to Exchange and says there is a new update for the ExchangeOnlineManagement module. I had to install PowerShell 7.2.4 to be able to install the preview5 2.0.5

    Now the message is just “Error connecting to Exchange Online…Exiting…”
    I think Microsoft probably changed some commands with this new version of the module

    I also tested with the latest preview6 2.0.6 with same result.

    If you have an idea.

    Thanks

21. 

    Clement B 17 Jun 2022Reply

    Hello,
    First, thanks for your scripts.
    I’ve an issue running “Prepare-TenantAssessment.ps1”
    I have the following message :
    “App already exists – Please delete the existing ‘Tenant Assessment Tool’ app from Azure AD and rerun the preparation script to recreate, exiting”

    Unfortunately I can’t find the application when I go manually on the Azure web page with the same logins.

    If you have an idea ?

    Thanks

    1. 

       Sean McAvinue 17 Jun 2022Reply

       Make sure you search “All Applications” under “App Registrations” in Azure AD

    2. 

       Clement B 17 Jun 2022Reply

       You can delete this one, I didn’t saw there was a filter activated to only show Enterprise Apps..

22. 

    Gustavo Rodrigo 30 May 2022Reply

    Hi,

    When I try to Execute the prepare assessment script it give those errors:

    En C:\Tenant Assesment\Prepare-TenanatAssessment.ps1: 214 Carácter: 140
    + … rimary text-bold py-2″ data-analytics-event=”{"category":&q …
    + ~
    No se permite usar el carácter de Y comercial (&). El operador & está reservado para un uso futuro; encierre un símbolo de Y comercial entre comillas dobles (“&”) para pasarlo como
    parte de una cadena.

    Token ‘&’ inesperado en la expresión o la instrucción.
    No se notificaron todos los errores de análisis. Corrija los errores notificados e inténtelo de nuevo.
    + CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : AmpersandNotAllowed

    1. 

       Sean McAvinue 30 May 2022Reply

       Did you copy and paste the script or modify it? The GitHub script does not have a line 214?

23. 

    Ashley 18 May 2022Reply

    Hi, I get lots of errors when running the prepare script, some examples as below:

    ExpandArchiveHelper : Failed to create file ‘C:\temp\microsoft.identitymodel.clients.activedirectory.3.19.8\_rels\.rels’ while expanding the archive file ‘C:\temp\microsoft.identitymodel.clients.activedirectory.3.19.8.zip’ contents as the file ‘C:\temp\microsoft.identitymodel.clients.activedirectory.3.19.8\_rels\.rels’ already exists. Use the -Force parameter if you want to overwrite the existing directory ‘C:\temp\microsoft.identitymodel.clients.activedirectory.3.19.8\_rels\.rels’ contents when expanding the archive file. At C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\Microsoft.PowerShell.Archive.psm1:397 char:17

    1. 

       Sean McAvinue 18 May 2022Reply

       Looks like this may be related to the AzureAD PowerShell Module you are using. Check that it’s up to date and that it is loading correctly.

       1. 

          Ashley 18 May 2022Reply

          Thanks, I upgraded to the latest version and unfortunately still get the issue. I also tried manually connecting via the Azure AD module and that works fine.

          1. 

             Sean McAvinue 18 May 2022Reply

             Are you by any chance running the script here https://github.com/smcavinue/AdminSeanMc/blob/master/Planner/Prepare-PlannerPowerShell.ps1

             This is a Planner Migration Tool which is in the same repository and references those files (“C:\temp\microsoft.identitymodel.clients.activedirectory.3.19.8.zip”)

             The folder you want is here: https://github.com/smcavinue/AdminSeanMc/tree/master/Tenant%20Migration%20Assessment

             1. 

                Ashley 19 May 2022

                Thanks, this has now ran OK.

             2. 

                EM 7 Dec 2023

                Hi
                running the script Perform-TenantAssessment.ps1 from (https://github.com/smcavinue/AdminSeanMc/blob/master/Planner/Prepare-PlannerPowerShell.ps1) does not display the required parameters (ClientID, TenantID and CertificateThumbprint ) to run Perform-TenantAssessment.ps1.

24. 

    Glynn 16 May 2022Reply

    Thanks for the tips. There were no errors with -Verbose and I was able to run Connect-AzureAD no problem.

    Took me a couple of tries but now it’s working great.

    Sequence of events:

    1- Removed the requires statement to fix the error I posted.
    2- All was good until I got this message:

    “Unable to acquire access token, check the parameters are correct
    The property ‘Authority’ cannot be found on this object. Verify that the property exists.”

    3- Switched to a different workstation and started again. This time no errors encountered, not even the original one, and even though I had put the “Requires” statement back in as a test.

    4- Script appeared to be executing correctly until it detected that WinRM basic auth was disabled on workstation.

    5- No quick way to fix on that workstation so switched to a 3rd WS where basic auth was already enabled.

    6- Script executed flawlessly from beginning to end of your whole documented process and produced a detailed inventory of my tenant.

    So, had to jump through a couple of hoops but well worth it for the learning and the end result, which is a fantastic piece of documentation.

    Once again, thanks for releasing this to the community.

25. 

    Glynn 16 May 2022Reply

    Good day and thank you for all the hard work here.

    Look forward to using the script but I seem to have fallen at the first hurdle:

    PS C:\temp\PowerShell> Install-Module AzureAD
    PS C:\temp\PowerShell> Install-Module ExchangeOnlineManagement
    PS C:\temp\PowerShell> Install-Module ImportExcel
    PS C:\temp\PowerShell> Install-Module MSAL.PS

    PS C:\temp\PowerShell> .\Prepare-TenantAssessment.ps1

    .\Prepare-TenantAssessment.ps1 : The script ‘Prepare-TenantAssessment.ps1’ cannot be run because the following modules
    that are specified by the “#requires” statements of the script are missing: AzureAD.
    At line:1 char:1
    + .\Prepare-TenantAssessment.ps1
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : ResourceUnavailable: (Prepare-TenantAssessment.ps1:String) [], ScriptRequiresException
    + FullyQualifiedErrorId : ScriptRequiresMissingModules

    All required modules appeared to install without error.

    Any help to understand what I have missed is appreciated.

    Thanks!

    1. 

       Sean McAvinue 16 May 2022Reply

       The requires statement checks if the AzureAD module is installed but seems to not see the module on your machine.

       Do you get any errors running: “Import-Module AzureAD -Verbose”

       You could also check if you can run Connect-AzureAD to test the module if so then you can try run it after removing the Requires statement (line 22).

       1. 

          Glynn 16 May 2022Reply

          Thanks for the tips. There were no errors with -Verbose and I was able to run Connect-AzureAD no problem.

          Took me a couple of tries but now it’s working great.

          Sequence of events:

          1- Removed the requires statement to fix the error I posted.
          2- All was good until I got this message:

          “Unable to acquire access token, check the parameters are correct
          The property ‘Authority’ cannot be found on this object. Verify that the property exists.”

          3- Switched to a different workstation and started again. This time no errors encountered, not even the original one, and even though I had put the “Requires” statement back in as a test.

          4- Script appeared to be executing correctly until it detected that WinRM basic auth was disabled on workstation.

          5- No quick way to fix on that workstation so switched to a 3rd WS where basic auth was already enabled.

          6- Script executed flawlessly from beginning to end of your whole documented process and produced a detailed inventory of my tenant.

          So, had to jump through a couple of hoops but well worth it for the learning and the end result, which is a fantastic piece of documentation.

          Once again, thanks for releasing this to the community.

26. 

    Andy Wilson 15 May 2022Reply

    This looks excellent, thanks Sean! Looking forward to giving it a test drive.

27. 

    Łukasz 12 May 2022Reply

    Sean, great work, I appreciate the hard work you’ve done to make this happen!

28. 

    Julien 12 May 2022Reply

    Thanks for your huge work !

    First feedbacks:
    – User accounts => Missing data from the sizes while I have a mailbox at least (values are ok into shared mailboxes sheet)
    – Conditional Access => I think the construction of the table has an issue. I see PolicyName and the name of my policy as column.
    – M365 Apps Usage => Special caracter in the name of the first column

    1. 

       Sean McAvinue 12 May 2022Reply

       Thanks Julian,
       On the user accounts data, I have not seen this but as we use the Mailbox usage reports can you check if the user is missing from there also?

       Conditional Access – If I understand correctly you have a column for each policy and settings along the left (first) column. This is by design to try make it easier to read

       Apps usage – I did notice that also but it is a default Microsoft report It could be tidied up by trimming the variable

29. 

    Kannan 12 May 2022Reply

    When I try to Execute the prepare assessment script it give me an error:-

    Waiting for app to provision…
    Error creating new app reg:
    Cannot bind argument to parameter ‘ObjectId’ because it is null.
    Exiting…

    1. 

       Sean McAvinue 12 May 2022Reply

       Hi Kannan,
       Seems like it’s failing as the global reader role is not provisioned in your tenant. You should be able to assign the global reader role to any user then rerun. I may update with a check for this soon.

       1. 

          Sean McAvinue 12 May 2022Reply

          Script is now updated to provision the role if it’s missing so if you redownload it it should work even when you don’t already have the role provisioned.

          1. 

             Kannan R 16 May 2022Reply

             Thank you so much Sean, Cheers!