ShareGate requires that a global or privileged role admin consent to different permission scopes to perform some actions on your Microsoft 365 tenant.
These scopes enable ShareGate to identify itself to Microsoft 365 as running operations on your tenant through an access token, granting ShareGate rights to use specific Microsoft functionality.
For example, they enable ShareGate to run assessments on your tenant in ShareGate Protect and offer additional benefits, such as reducing throttling during migrations in ShareGate Migrate.
A global or privileged role admin has to consent once for all ShareGate users working on the tenant.
To learn how a global admin can grant consent to the permission scopes, see How a global or privileged role admin can consent to ShareGate's Microsoft 365 permission scopes.
Note: Re-consent can be necessary if the feature or app that requires consent to a permission scope gets an update that requires new permissions.
When a global or privileged role admin consents to a set of permissions, an Enterprise app is added to your Microsoft Entra ID portal.
ShareGate's Enterprise apps will not grant new access privileges to end-users in your tenant.
Enterprise apps (permission scopes)
These Enterprise apps (permission scopes) are:
ShareGate Migrate: Not required for all migration actions in Microsoft 365, but highly recommended.
ShareGate Migrate - Mailbox: Required for Copy mailboxes and Copy from Gmail.
ShareGate Migration assessment: Required to run Migration assessments.
ShareGate Migration assessment (EU): Required to run Migration assessments and keep the data at rest in Europe.
ShareGate Protect: Required to run Governance risk assessments.
ShareGate Protect (EU): Required to run Governance risk assessments and keep the data at rest in Europe.
ShareGate Protect remediation actions: Required to run governance actions in the Governance risk assessment.
ShareGate Protect remediation actions (EU): Required to run governance actions in the Governance risk assessment and keep the data at rest in Europe.
For more information about the required permissions of each Enterprise app, see Required Microsoft 365 Permissions for ShareGate.
A global or privileged role admin can revoke these permission scopes at any time by deleting the associated enterprise app from Entra ID. To learn how, see Revoke consent to Microsoft 365 permission scopes.