Konfigurera en Azure-app för OneDrive och SharePoint Online

1. Logga in på Azure-portalen som administratör.
2. Klicka på Cloud Shell Powershell.
3. Skapa ett lagringskonto om du blir ombedd att göra det och godkänn standardinställningarna.
4. Skapa appen genom att ange följande kommando och trycka på Retur:

   Install-Module Microsoft.Graph -Scope CurrentUser

5. Om du ser en uppmaning om att installera från en obetrodd lagringsplats anger du Y tryck på Retur.
6. Kopiera följande kodblock, klistra in det i PowerShell och klicka på Retur.

   <#    
   .SYNOPSIS    
   Automates the creation of a Single-Tenant Entra ID App for Workspace Migration.
   Strictly forces account selection and verifies specific Admin roles.
   #>
   
   # Check if the module is missing
   if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Authentication)) {
       Write-Host "Microsoft Graph module is NOT installed." -ForegroundColor Yellow
       $UserResponse = Read-Host "Would you like to try installing Microsoft Graph? (Y/N)"
   
       if ($UserResponse -ieq "Y") {
           try {
               # Use only native cmdlets, no .NET property setting
               Install-Module -Name Microsoft.Graph -Scope CurrentUser -Force -AllowClobber
               Write-Host "Installation complete!" -ForegroundColor Green
           }
           catch {
               Write-Error "Policy is blocking installation. Please contact IT to install Microsoft.Graph module."
               Read-Host "Press Enter to exit"; exit
           }
       }
       else {
           exit
       }
   } else {
       Write-Host "Microsoft Graph modules detected. Proceeding..." -ForegroundColor Green
   }
   
   # --- STEP 0: THE "DEEP" LOGOUT ---
   Write-Host "Forcing session cleanup..." -ForegroundColor Gray
   Disconnect-MgGraph -ErrorAction SilentlyContinue
   
   # Force clear the local token cache folder if it exists
   $CachePath = "$env:USERPROFILE\.mg"
   if (Test-Path $CachePath) {
       try { Remove-Item $CachePath -Recurse -Force -ErrorAction SilentlyContinue } catch {}
   }
   
   Write-Host "Opening Microsoft Login... (Please select the correct account)" -ForegroundColor Cyan
   $RequiredScopes = @(
       "Application.ReadWrite.All",
       "AppRoleAssignment.ReadWrite.All",
       "Directory.Read.All",
       "RoleManagement.Read.Directory")
   
   try {
       # In v2, -ContextScope Process is the most reliable way to force account selection
       # and prevent the session from saving to the machine permanently.
       Connect-MgGraph -Scopes $RequiredScopes -ContextScope Process
   
       $Context = Get-MgContext
       if ($null -eq $Context) { throw "Login was cancelled or failed." }
   
       $UserPrincipal = $Context.Account
       Write-Host "Logged in as: $UserPrincipal" -ForegroundColor Green
   
       # --- ROLE VALIDATION ---
       Write-Host "Verifying Directory Roles..." -ForegroundColor Gray
       $UserRoles = Get-MgUserMemberOf -UserId $Context.Account -All | Where-Object { $_.AdditionalProperties.displayName -ne $null }
       
       $Authorized = $false
       $RequiredRoles = @("Global Administrator", "Privileged Role Administrator")
   
       foreach ($role in $UserRoles) {
           $roleName = $role.AdditionalProperties.displayName
           if ($roleName -in $RequiredRoles) {
               $Authorized = $true
               Write-Host "Access Granted: $roleName" -ForegroundColor Green
               break
           }
       }
   
       if (-not $Authorized) {
           Write-Host "`nCRITICAL ERROR: Insufficient Privileges." -ForegroundColor Red
           Write-Host "Account must be 'Global Administrator' or 'Privileged Role Administrator'." -ForegroundColor Yellow
           Disconnect-MgGraph
           Read-Host "`nPress Enter to exit"; exit
       }
   } catch {
       Write-Error "Login failed: $_"
       Read-Host "Press Enter to exit"; exit
   }
   
   # --- USER INPUT ---
   Write-Host "`n--- APPLICATION SETUP ---" -ForegroundColor Cyan
   $InputName = Read-Host "Enter the name for your new Entra ID Application (Default: Workspace Data Import App)"
   $AppName = if ([string]::IsNullOrWhiteSpace($InputName)) { "Workspace Data Import App" } else { $InputName }
   
   # --- CONFIGURATION ---
   # Updated Map containing only the requested Graph permissions
   $PermissionMap = @{
       "licenseassignment.read.all"  = "LicenseAssignment.Read.All"     
       "application.read.all"        = "Application.Read.All"
   }
   
   $TenantId = $Context.TenantId
   $GraphAppId = "00000003-0000-0000-c000-000000000000"
   $SpoAppId   = "00000003-0000-0ff1-ce00-000000000000"
   
   try {
       # --- STEP 1: REGISTER APPLICATION ---
       Write-Host "Creating Application: $AppName..." -ForegroundColor Cyan
       $Application = New-MgApplication -BodyParameter @{
           displayName = $AppName
           signInAudience = "AzureADMyOrg"
       }
       
       # --- STEP 2: PREPARE SERVICE PRINCIPAL ---
       $NewServicePrincipal = New-MgServicePrincipal -BodyParameter @{ appId = $Application.AppId }
   
       Write-Host "Waiting 10 seconds for replication..." -ForegroundColor DarkGray
       Start-Sleep -Seconds 10
   
       # --- STEP 3: CONFIGURE & GRANT PERMISSIONS ---
       Write-Host "Configuring API Permissions & Granting Admin Consent..." -ForegroundColor Cyan
       
       # 1. Process Microsoft Graph Permissions
       $GraphSP = Get-MgServicePrincipal -Filter "AppId eq '$GraphAppId'" | Select-Object -First 1
       $GraphResourceAccessList = @()
   
       foreach ($key in $PermissionMap.Keys) {
           $RealRoleName = $PermissionMap[$key]
           $Role = $GraphSP.AppRoles | Where-Object { $_.Value -eq $RealRoleName }
   
           if ($Role) {
               $GraphResourceAccessList += @{ id = $Role.Id; type = "Role" }
   
               New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $NewServicePrincipal.Id -BodyParameter @{
                   principalId = $NewServicePrincipal.Id
                   resourceId  = $GraphSP.Id
                   appRoleId   = $Role.Id
               } | Out-Null
               Write-Host " - Granted (Graph): $RealRoleName" -ForegroundColor Gray
           }
       }
   
       # 2. Process SharePoint Online Permissions
       $SpoSP = Get-MgServicePrincipal -Filter "AppId eq '$SpoAppId'" | Select-Object -First 1
       $SpoResourceAccessList = @()
       $SpoRole = $SpoSP.AppRoles | Where-Object { $_.Value -eq "Sites.FullControl.All" }
   
       if ($SpoRole) {
           $SpoResourceAccessList += @{ id = $SpoRole.Id; type = "Role" }
   
           New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $NewServicePrincipal.Id -BodyParameter @{
               principalId = $NewServicePrincipal.Id
               resourceId  = $SpoSP.Id
               appRoleId   = $SpoRole.Id
           } | Out-Null
           Write-Host " - Granted (SharePoint): Sites.FullControl.All" -ForegroundColor Gray
       }
   
       Update-MgApplication -ApplicationId $Application.Id -RequiredResourceAccess @(
           @{ resourceAppId = $GraphAppId; resourceAccess = $GraphResourceAccessList },
           @{ resourceAppId = $SpoAppId; resourceAccess = $SpoResourceAccessList }
       )
   
       # --- STEP 4: CREATE CLIENT SECRET ---
       Write-Host "Generating Client Secret..." -ForegroundColor Cyan
       $ExpiryDate = (Get-Date).AddYears(2).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
       $PasswordCred = Add-MgApplicationPassword -ApplicationId $Application.Id -BodyParameter @{
           passwordCredential = @{
               displayName = "MigrationToolSecret"
               endDateTime = $ExpiryDate
           }
       }
   
       # --- OUTPUT ---
       Write-Host "`n-------------------------------------------------------" -ForegroundColor Yellow
       Write-Host "        SETUP COMPLETE - SAVE THESE DETAILS" -ForegroundColor Yellow
       Write-Host "-------------------------------------------------------" -ForegroundColor Yellow
       Write-Host "Application Name        : $AppName"
       Write-Host "Application (Client) ID : $($Application.AppId)"
       Write-Host "Client Secret Value     : $($PasswordCred.SecretText)"
       Write-Host "Directory (Tenant) ID   : $TenantId"
       Write-Warning "IMPORTANT: Copy the Client Secret Value immediately."
   
   } catch {
       Write-Error "Operation failed: $_"
   }
   
   # --- FINAL DISCONNECT ---
   Disconnect-MgGraph
   Read-Host "`nPress Enter to close this window"
   
      

7. Anteckna följande användaruppgifter och förvara dem på ett säkert ställe. Om användaruppgifterna läcker kan hackare få åtkomst till all din OneDrive- eller SharePoint Online-data.
   • Klientlösenord
   • App-id (klient-id)
   • Katalog-id (klient)

1. Skapa en ny fil med vanlig text i Windows och ge den namnet migration_app_creator.ps1.
2. Kopiera följande kodblock, klistra in det i den nya filen och klicka på Kör med Powershell.

    <#
       .SYNOPSIS
       Automates the creation of a Single-Tenant Entra ID App for Workspace Migration.
       Strictly forces account selection and verifies specific Admin roles.
   #>
   
   # Check if the module is missing
   if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Authentication)) {
       Write-Host "Microsoft Graph module is NOT installed." -ForegroundColor Yellow
       $UserResponse = Read-Host "Would you like to try installing Microsoft Graph? (Y/N)"
   
       if ($UserResponse -ieq "Y") {
           try {
               # Use only native cmdlets, no .NET property setting
               Install-Module -Name Microsoft.Graph -Scope CurrentUser -Force -AllowClobber
               Write-Host "Installation complete!" -ForegroundColor Green
           }
           catch {
               Write-Error "Policy is blocking installation. Please contact IT to install Microsoft.Graph module."
               Read-Host "Press Enter to exit"; exit
           }
       }
       else {
           exit
       }
   } else {
       Write-Host "Microsoft Graph modules detected. Proceeding..." -ForegroundColor Green
   }
   
   # --- STEP 0: THE "DEEP" LOGOUT ---
   Write-Host "Forcing session cleanup..." -ForegroundColor Gray
   Disconnect-MgGraph -ErrorAction SilentlyContinue
   
   # Force clear the local token cache folder if it exists
   $CachePath = "$env:USERPROFILE\.mg"
   if (Test-Path $CachePath) {
       try { Remove-Item $CachePath -Recurse -Force -ErrorAction SilentlyContinue } catch {}
   }
   
   Write-Host "Opening Microsoft Login... (Please select the correct account)" -ForegroundColor Cyan
   $RequiredScopes = @(
       "Application.ReadWrite.All",
       "AppRoleAssignment.ReadWrite.All",
       "Directory.Read.All",
       "RoleManagement.Read.Directory"
   )
   
   try {
       # In v2, -ContextScope Process is the most reliable way to force account selection
       # and prevent the session from saving to the machine permanently.
       Connect-MgGraph -Scopes $RequiredScopes -ContextScope Process
   
       $Context = Get-MgContext
       if ($null -eq $Context) { throw "Login was cancelled or failed." }
   
       $UserPrincipal = $Context.Account
       Write-Host "Logged in as: $UserPrincipal" -ForegroundColor Green
   
       # --- ROLE VALIDATION ---
       Write-Host "Verifying Directory Roles..." -ForegroundColor Gray
       $UserRoles = Get-MgUserMemberOf -UserId $Context.Account -All | Where-Object { $_.AdditionalProperties.displayName -ne $null }
       
       $Authorized = $false
       $RequiredRoles = @("Global Administrator", "Privileged Role Administrator")
   
       foreach ($role in $UserRoles) {
           $roleName = $role.AdditionalProperties.displayName
           if ($roleName -in $RequiredRoles) {
               $Authorized = $true
               Write-Host "Access Granted: $roleName" -ForegroundColor Green
               break
           }
       }
   
       if (-not $Authorized) {
           Write-Host "`nCRITICAL ERROR: Insufficient Privileges." -ForegroundColor Red
           Write-Host "Account must be 'Global Administrator' or 'Privileged Role Administrator'." -ForegroundColor Yellow
           Disconnect-MgGraph
           Read-Host "`nPress Enter to exit"; exit
       }
   } catch {
       Write-Error "Login failed: $_"
       Read-Host "Press Enter to exit"; exit
   }
   
   # --- USER INPUT ---
   Write-Host "`n--- APPLICATION SETUP ---" -ForegroundColor Cyan
   $InputName = Read-Host "Enter the name for your new Entra ID Application (Default: Workspace Data Import App)"
   $AppName = if ([string]::IsNullOrWhiteSpace($InputName)) { "Workspace Data Import App" } else { $InputName }
   
   # --- CONFIGURATION ---
   # Application Permissions mapped to their respective API App IDs
   $ApiConfigurations = @{
       "00000003-0000-0000-c000-000000000000" = @("LicenseAssignment.Read.All", "Application.Read.All") # Microsoft Graph
       "00000003-0000-0ff1-ce00-000000000000" = @("Sites.FullControl.All")                              # SharePoint Online
   }
   
   $TenantId = $Context.TenantId
   
   try {
       # --- STEP 1: REGISTER APPLICATION ---
       Write-Host "Creating Application: $AppName..." -ForegroundColor Cyan
       $Application = New-MgApplication -BodyParameter @{
           displayName = $AppName
           signInAudience = "AzureADMyOrg"
       }
       
       # --- STEP 2: PREPARE SERVICE PRINCIPAL ---
       $NewServicePrincipal = New-MgServicePrincipal -BodyParameter @{ appId = $Application.AppId }
   
       Write-Host "Waiting 10 seconds for replication..." -ForegroundColor DarkGray
       Start-Sleep -Seconds 10
   
       # --- STEP 3: CONFIGURE & GRANT PERMISSIONS ---
       Write-Host "Configuring API Permissions & Granting Admin Consent..." -ForegroundColor Cyan
       
       $RequiredResourceAccess = @()
   
       foreach ($ApiAppId in $ApiConfigurations.Keys) {
           $ApiSP = Get-MgServicePrincipal -Filter "AppId eq '$ApiAppId'" | Select-Object -First 1
           $ResourceAccessList = @()
           
           foreach ($RoleName in $ApiConfigurations[$ApiAppId]) {
               $Role = $ApiSP.AppRoles | Where-Object { $_.Value -eq $RoleName }
               
               if ($Role) {
                   $ResourceAccessList += @{ id = $Role.Id; type = "Role" }
                   
                   New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $NewServicePrincipal.Id -BodyParameter @{
                       principalId = $NewServicePrincipal.Id
                       resourceId  = $ApiSP.Id
                       appRoleId   = $Role.Id
                   } | Out-Null
                   Write-Host " - Granted: $RoleName" -ForegroundColor Gray
               }
           }
           
           if ($ResourceAccessList.Count -gt 0) {
               $RequiredResourceAccess += @{
                   resourceAppId  = $ApiAppId
                   resourceAccess = $ResourceAccessList
               }
           }
       }
   
       Update-MgApplication -ApplicationId $Application.Id -RequiredResourceAccess $RequiredResourceAccess
   
       # --- STEP 4: CREATE CLIENT SECRET ---
       Write-Host "Generating Client Secret..." -ForegroundColor Cyan
       $ExpiryDate = (Get-Date).AddYears(2).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
       $PasswordCred = Add-MgApplicationPassword -ApplicationId $Application.Id -BodyParameter @{
           passwordCredential = @{
               displayName = "MigrationToolSecret"
               endDateTime = $ExpiryDate
           }
       }
   
       # --- OUTPUT ---
       Write-Host "`n-------------------------------------------------------" -ForegroundColor Yellow
       Write-Host "        SETUP COMPLETE - SAVE THESE DETAILS" -ForegroundColor Yellow
       Write-Host "-------------------------------------------------------" -ForegroundColor Yellow
       Write-Host "Application Name        : $AppName"
       Write-Host "Application (Client) ID : $($Application.AppId)"
       Write-Host "Client Secret Value     : $($PasswordCred.SecretText)"
       Write-Host "Directory (Tenant) ID   : $TenantId"
       Write-Warning "IMPORTANT: Copy the Client Secret Value immediately."
   
   }
   catch {
       Write-Error "Operation failed: $_"
   }
   
   # --- FINAL DISCONNECT ---
   Disconnect-MgGraph
   Read-Host "`nPress Enter to close this window"
   
      

3. Anteckna följande användaruppgifter och förvara dem på ett säkert ställe. Om användaruppgifterna läcker kan hackare få åtkomst till all din OneDrive- eller SharePoint Online-data.
   • Klientlösenord
   • App-id (klient-id)
   • Katalog-id (klient)

1. Logga in på Azure-portalen som administratör.
2. Öppna App registrations i Azure Services.
3. Klicka på New Registration och ange ett namn på appen (till exempel Advanced import app).
4. Klicka på Endast konton i den här organisationskatalogen för Kontotyper som stöds för att skapa en app med en klient.
5. Klicka på Registrera.

Välj ett av följande alternativ:

Alternativ 1: Lägg till behörigheter manuellt

1. Klicka på API permissions under Manage på sidan.
2. Klicka på Lägg till en behörighet och klicka på SharePoint på fliken Microsoft API:er.
3. Klicka på Appbehörigheter Webbplatser och markera rutan Sites.FullControl.All.
4. Klicka på Lägg till behörighet.
5. Gå tillbaka till Lägg till en behörighet och klicka på Microsoft Graph.
6. Klicka på Appbehörigheter och välj följande behörigheter:
   • LicenseAssignment.Read.All
   • Application.Read.All
7. Klicka på Lägg till behörighet.
8. Klicka på Ge administratörssamtycke för organisationen.

Alternativ 2: Redigera applikationsmanifestet

1. Öppna appmanifestet.
2. Gå till "resourceAccess" : [ ] och välj ett alternativ:
   • Om "resourceAccess" : [ ] redan har ett värde lägger du till ett kommatecken och klistrar sedan in följande kodblock.
   • Om "resourceAccess" : [ ] inte har något värde kopierar och klistrar du in följande kodblock.

        "requiredResourceAccess": [
         {
             "resourceAppId": "00000003-0000-0000-c000-000000000000",
             "resourceAccess": [
                 {
                     "id": "e2f98668-2877-4f38-a2f4-8202e0717aa1",
                     "type": "Role"
                 },
                 {
                     "id": "9a5d68dd-52b0-4cc2-bd40-abcf44ac3a30",
                     "type": "Role"
                 }
             ]
         },
         {
             "resourceAppId": "00000003-0000-0ff1-ce00-000000000000",
             "resourceAccess": [
                 {
                     "id": "678536fe-1083-478a-9c59-b99265e6b0d3",
                     "type": "Role"
                 }
             ]
         }
     ]
        

3. Klicka på Ge administratörssamtycke för organisationen.

1. Klicka på Certifikat och hemligheter Ny klienthemlighet för Hantera på sidan.
2. Ange en beskrivning, välj en utgångsperiod och klicka på Lägg till.
3. Kopiera värdet för klientlösenordet och lagra det på ett säkert sätt. Värdet visas bara en gång.

Viktigt! Spara appuppgifterna på ett säkert sätt. Om användaruppgifterna läcker kan hackare få åtkomst till all din OneDrive- eller SharePoint Online-data.

Klicka på Översikt och anteckna följande användaruppgifter på ett säkert sätt:

• App-id (klient-id)
• Katalog-id (klient)