Articles in this section

Microsoft administrative permissions

Updated
Follow

You will need specific Microsoft administrative permissions to perform actions using ShareGate. These permissions are required to interact with the Microsoft APIs in your environment with a secure connection.

In this article, you will find details about each administrative permission required for your tasks.

For an example of how the app interacts with your environment, see our SharePoint to SharePoint migration diagram.

Note: Permissions granted through Azure PIM might not work or could cause unauthorized errors during an operation.

Index

Global admin and SharePoint admin (Microsoft 365)

Required to:

  • Connect to your Microsoft 365 SharePoint admin center.
  • Access all your site collections.
  • Access all your OneDrives.
  • Add/remove site collection admins.
  • Perform migrations of multiple site collections (requires a connection to your admin center).
  • Perform migrations of permissions.
Note: When working with the ShareGate migration tool, the only difference between global admin and SharePoint admin is that a global admin can consent to the Azure the ShareGate migration tool application. If you do not consent to the app, you will experience limitations with Teams and Microsoft 365 Groups, and you may experience throttling in Microsoft 365.

Site collection admin (Microsoft 365 and SharePoint on-premises)

Site collection admin permissions are also required when running most operations in the ShareGate migration tool, even if you have global admin or SharePoint admin permissions.

Without site collection admin permissions, many interactions with the SharePoint APIs will fail, causing unpredictable issues.

It is recommended to have site collection admin permissions at both the source and destination environments to:

It is recommended to have site collection admin permission at the destination environment to:

Auto-assign as site collection administrator

You can use a global admin or SharePoint admin account to enable Auto-assign as a site collection administrator when required in the migration tool security settings. This setting will automatically add you as a site collection admin when running procedures in Explorer or when running reports on your site collections and OneDrives.

This setting does not affect migrations.

Tip: To assign your account as site collection admin on many site collections for a migration, you can run a site collection report on your tenant with the auto-assign setting activated.

Notes:
  • Site collection admin is a different role than Site Owner.
  • For on-premises versions of SharePoint, you do not need site collection admin permissions if you have Full Control on the web application.
  • If you use SharePoint 2003, you must also have site owner permissions.

Teams admin (Microsoft 365)

In addition to SharePoint admin permissions, Teams admin is required to:

Teams admin is not required for team migrations if you have global admin permissions.

Note: SharePoint admin permissions are required to migrate the associated SharePoint site.

Farm admin (SharePoint on-premises)

Required to:

  • Connect to your SharePoint central admin and access your web apps in Explorer and Migration.
  • Access all your site collections.
  • Access all your MySites.
  • Access all your OneDrives for Business.
  • Add/remove site collection admins.
  • Perform migrations of multiple site collections (requires a connection to your central administration).

Term store admin

Required in the source and destination to:

  • Migrate managed metadata applied to your list items and documents.
  • Migrate Terms, term groups, and term sets.

Full control

Can replace site collection admin in the source and destination to:

Note: Full control permissions will only work if you have simple metadata and you will not be able to use Insane mode.

Manage user alerts permissions

Required in the source and destination to:

  • Copy user alerts in Migration (note that you must also have the server extension installed in the source and destination).

Read-only lock

While not a permission itself, the Read-only lock must be removed from SharePoint Central administration. You may require higher-level administrative credentials to clear the lock status. The read-only lock must be removed from your site collection(s) to:

  • Perform any migration action in the ShareGate migration tool.

Some SharePoint services do not respond correctly when your site collection has a read-only lock, and the requests will not be processed as intended. This can cause many unexpected issues. For more information, see Read-only lock.

 

Related articles