Configurer l'application Azure pour une migration avancée

1. En tant qu'administrateur, connectez-vous au portail Azure.
2. Cliquez sur Cloud Shell PowerShell.
3. Si vous y êtes invité, créez un compte de stockage et acceptez les paramètres par défaut.
4. Pour créer l'application, saisissez la commande suivante, puis cliquez sur Entrée :

   Install-Module Microsoft.Graph -Scope CurrentUser

5. Si vous êtes invité à installer à partir d'un dépôt non approuvé, saisissez Y, puis cliquez sur Entrée.
6. Copiez le bloc de code suivant, collez-le dans PowerShell, puis cliquez sur Entrée.

       <#
       .SYNOPSIS
       Automates the creation of a Single-Tenant Entra ID App for Workspace Migration.
       Strictly forces account selection and verifies specific Admin roles.
       #>
   
       # Check if the module is missing
       if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Authentication)) {
       Write-Host "Microsoft Graph module is NOT installed." -ForegroundColor Yellow
       $UserResponse = Read-Host "Would you like to try installing Microsoft Graph? (Y/N)"
   
       if ($UserResponse -ieq "Y") {
           try {
               # Use only native cmdlets, no .NET property setting
               Install-Module -Name Microsoft.Graph -Scope CurrentUser -Force -AllowClobber
               Write-Host "Installation complete!" -ForegroundColor Green
           }
           catch {
               Write-Error "Policy is blocking installation. Please contact IT to install Microsoft.Graph module."
               Read-Host "Press Enter to exit"; exit
           }
       }
       else {
           exit
       }
       } else {
       Write-Host "Microsoft Graph modules detected. Proceeding..." -ForegroundColor Green
       }
   
       # --- STEP 0: THE "DEEP" LOGOUT ---
       Write-Host "Forcing session cleanup..." -ForegroundColor Gray
       Disconnect-MgGraph -ErrorAction SilentlyContinue
   
       # Force clear the local token cache folder if it exists
       $CachePath = "$env:USERPROFILE\.mg"
       if (Test-Path $CachePath) {
       try { Remove-Item $CachePath -Recurse -Force -ErrorAction SilentlyContinue } catch {}
       }
   
       Write-Host "Opening Microsoft Login... (Please select the correct account)" -ForegroundColor Cyan
   
       $RequiredScopes = @(
       "Application.ReadWrite.All", 
       "AppRoleAssignment.ReadWrite.All", 
       "Directory.Read.All", 
       "RoleManagement.Read.Directory"
       )
   
       try {
       # In v2, -ContextScope Process is the most reliable way to force account selection
       # and prevent the session from saving to the machine permanently.
       Connect-MgGraph -Scopes $RequiredScopes -ContextScope Process
   
        $Context = Get-MgContext
       if ($null -eq $Context) { throw "Login was cancelled or failed." }
   
       $UserPrincipal = $Context.Account
       Write-Host "Logged in as: $UserPrincipal" -ForegroundColor Green
   
       # --- ROLE VALIDATION ---
       Write-Host "Verifying Directory Roles..." -ForegroundColor Gray
       $UserRoles = Get-MgUserMemberOf -UserId $Context.Account -All | Where-Object { $_.AdditionalProperties.displayName -ne $null }
       
       $Authorized = $false
       $RequiredRoles = @("Global Administrator", "Privileged Role Administrator")
   
       foreach ($role in $UserRoles) {
           $roleName = $role.AdditionalProperties.displayName
           if ($roleName -in $RequiredRoles) {
               $Authorized = $true
               Write-Host "Access Granted: $roleName" -ForegroundColor Green
               break
           }
       }
   
       if (-not $Authorized) {
           Write-Host "`nCRITICAL ERROR: Insufficient Privileges." -ForegroundColor Red
   
        Write-Host "Account must be 'Global Administrator' or 'Privileged Role Administrator'." -ForegroundColor Yellow
           Disconnect-MgGraph
           Read-Host "`nPress Enter to exit"; exit
       }
   
       } catch {
       Write-Error "Login failed: $_"
       Read-Host "Press Enter to exit"; exit
       }
   
       # --- USER INPUT ---
       Write-Host "`n--- APPLICATION SETUP ---" -ForegroundColor Cyan
       $InputName = Read-Host "Enter the name for your new Entra ID Application (Default: Workspace Migration App)"
       $AppName = if ([string]::IsNullOrWhiteSpace($InputName)) { "Workspace Migration App" } else { $InputName }
   
       # --- CONFIGURATION ---
       $PermissionMap = @{
       "calendar.read"  = "Calendars.Read"     
       "mail.read"      = "Mail.Read"
       "contacts.read"  = "Contacts.Read"
       "directory.read" = "Directory.Read.All"
       }
   
       $TenantId = $Context.TenantId
       $GraphAppId = "00000003-0000-0000-c000-000000000000"
   
       try {
       # --- STEP 1: REGISTER APPLICATION ---
       Write-Host "Creating Application: $AppName..." -ForegroundColor Cyan
       $Application = New-MgApplication -BodyParameter @{
           displayName = $AppName
           signInAudience = "AzureADMyOrg"
       }
       
       # --- STEP 2: PREPARE SERVICE PRINCIPAL ---
       $NewServicePrincipal = New-MgServicePrincipal -BodyParameter @{ appId = $Application.AppId }
   
       Write-Host "Waiting 10 seconds for replication..." -ForegroundColor DarkGray
       Start-Sleep -Seconds 10
   
       # --- STEP 3: CONFIGURE & GRANT PERMISSIONS ---
       Write-Host "Configuring API Permissions & Granting Admin Consent..." -ForegroundColor Cyan
       $GraphSP = Get-MgServicePrincipal -Filter "AppId eq '$GraphAppId'" | Select-Object -First 1
       
       $ResourceAccessList = @()
   
       foreach ($key in $PermissionMap.Keys) {
           $RealRoleName = $PermissionMap[$key]
           $Role = $GraphSP.AppRoles | Where-Object { $_.Value -eq $RealRoleName }
   
           if ($Role) {
               $ResourceAccessList += @{ id = $Role.Id; type = "Role" }
   
               New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $NewServicePrincipal.Id -BodyParameter @{
                   principalId = $NewServicePrincipal.Id
                   resourceId  = $GraphSP.Id
                   appRoleId   = $Role.Id
               } | Out-Null
               Write-Host " - Granted: $RealRoleName" -ForegroundColor Gray
           }
       }
   
       Update-MgApplication -ApplicationId $Application.Id -RequiredResourceAccess @(@{
           resourceAppId  = $GraphAppId
           resourceAccess = $ResourceAccessList
       })
   
       # --- STEP 4: CREATE CLIENT SECRET ---
       Write-Host "Generating Client Secret..." -ForegroundColor Cyan
       $ExpiryDate = (Get-Date).AddYears(2).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
       $PasswordCred = Add-MgApplicationPassword -ApplicationId $Application.Id -BodyParameter @{
           passwordCredential = @{
               displayName = "MigrationToolSecret"
               endDateTime = $ExpiryDate
           }
       }
   
       # --- OUTPUT ---
       Write-Host "`n-------------------------------------------------------" -ForegroundColor Yellow
       Write-Host "        SETUP COMPLETE - SAVE THESE DETAILS" -ForegroundColor Yellow
       Write-Host "-------------------------------------------------------" -ForegroundColor Yellow
       Write-Host "Application Name        : $AppName"
       Write-Host "Application (Client) ID : $($Application.AppId)"
       Write-Host "Client Secret Value     : $($PasswordCred.SecretText)"
       Write-Host "Directory (Tenant) ID   : $TenantId"
       Write-Warning "IMPORTANT: Copy the Client Secret Value immediately."
   
       }
       catch {
       Write-Error "Operation failed: $_"
       }
   
       # --- FINAL DISCONNECT ---
       Disconnect-MgGraph
       Read-Host "`nPress Enter to close this window"
       

7. Notez les identifiants suivants et stockez-les de manière sécurisée. Si les identifiants sont divulgués, les pirates informatiques peuvent accéder à toutes vos données Exchange Online.
   • Code secret du client
   • ID (client) de l'application
   • ID de l'annuaire (locataire)

1. Sous Windows, créez un fichier texte brut et nommez-le migration_app_creator.ps1.
2. Copiez le bloc de code suivant, collez-le dans le nouveau fichier, puis cliquez sur Exécuter avec PowerShell.

    <#
    .SYNOPSIS
    Automates the creation of a Single-Tenant Entra ID App for Workspace Migration.
    Strictly forces account selection and verifies specific Admin roles.
    #>

    # Check if the module is missing
    if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Authentication)) {
    Write-Host "Microsoft Graph module is NOT installed." -ForegroundColor Yellow
    $UserResponse = Read-Host "Would you like to try installing Microsoft Graph? (Y/N)"

    if ($UserResponse -ieq "Y") {
        try {
            # Use only native cmdlets, no .NET property setting
            Install-Module -Name Microsoft.Graph -Scope CurrentUser -Force -AllowClobber
            Write-Host "Installation complete!" -ForegroundColor Green
        }
        catch {
            Write-Error "Policy is blocking installation. Please contact IT to install Microsoft.Graph module."
            Read-Host "Press Enter to exit"; exit
        }
    }
    else {
        exit
    }
    } else {
    Write-Host "Microsoft Graph modules detected. Proceeding..." -ForegroundColor Green
    }

    # --- STEP 0: THE "DEEP" LOGOUT ---
    Write-Host "Forcing session cleanup..." -ForegroundColor Gray
    Disconnect-MgGraph -ErrorAction SilentlyContinue

    # Force clear the local token cache folder if it exists
    $CachePath = "$env:USERPROFILE\.mg"
    if (Test-Path $CachePath) {
    try { Remove-Item $CachePath -Recurse -Force -ErrorAction SilentlyContinue } catch {}
    }

    Write-Host "Opening Microsoft Login... (Please select the correct account)" -ForegroundColor Cyan

    $RequiredScopes = @(
    "Application.ReadWrite.All", 
    "AppRoleAssignment.ReadWrite.All", 
    "Directory.Read.All", 
    "RoleManagement.Read.Directory"
    )

    try {
    # In v2, -ContextScope Process is the most reliable way to force account selection
    # and prevent the session from saving to the machine permanently.
    Connect-MgGraph -Scopes $RequiredScopes -ContextScope Process

     $Context = Get-MgContext
    if ($null -eq $Context) { throw "Login was cancelled or failed." }

    $UserPrincipal = $Context.Account
    Write-Host "Logged in as: $UserPrincipal" -ForegroundColor Green

    # --- ROLE VALIDATION ---
    Write-Host "Verifying Directory Roles..." -ForegroundColor Gray
    $UserRoles = Get-MgUserMemberOf -UserId $Context.Account -All | Where-Object { $_.AdditionalProperties.displayName -ne $null }
    
    $Authorized = $false
    $RequiredRoles = @("Global Administrator", "Privileged Role Administrator")

    foreach ($role in $UserRoles) {
        $roleName = $role.AdditionalProperties.displayName
        if ($roleName -in $RequiredRoles) {
            $Authorized = $true
            Write-Host "Access Granted: $roleName" -ForegroundColor Green
            break
        }
    }

    if (-not $Authorized) {
        Write-Host "`nCRITICAL ERROR: Insufficient Privileges." -ForegroundColor Red

     Write-Host "Account must be 'Global Administrator' or 'Privileged Role Administrator'." -ForegroundColor Yellow
        Disconnect-MgGraph
        Read-Host "`nPress Enter to exit"; exit
    }

    } catch {
    Write-Error "Login failed: $_"
    Read-Host "Press Enter to exit"; exit
    }

    # --- USER INPUT ---
    Write-Host "`n--- APPLICATION SETUP ---" -ForegroundColor Cyan
    $InputName = Read-Host "Enter the name for your new Entra ID Application (Default: Workspace Migration App)"
    $AppName = if ([string]::IsNullOrWhiteSpace($InputName)) { "Workspace Migration App" } else { $InputName }

    # --- CONFIGURATION ---
    $PermissionMap = @{
    "calendar.read"  = "Calendars.Read"     
    "mail.read"      = "Mail.Read"
    "contacts.read"  = "Contacts.Read"
    "directory.read" = "Directory.Read.All"
    }

    $TenantId = $Context.TenantId
    $GraphAppId = "00000003-0000-0000-c000-000000000000"

    try {
    # --- STEP 1: REGISTER APPLICATION ---
    Write-Host "Creating Application: $AppName..." -ForegroundColor Cyan
    $Application = New-MgApplication -BodyParameter @{
        displayName = $AppName
        signInAudience = "AzureADMyOrg"
    }
    
    # --- STEP 2: PREPARE SERVICE PRINCIPAL ---
    $NewServicePrincipal = New-MgServicePrincipal -BodyParameter @{ appId = $Application.AppId }

    Write-Host "Waiting 10 seconds for replication..." -ForegroundColor DarkGray
    Start-Sleep -Seconds 10

    # --- STEP 3: CONFIGURE & GRANT PERMISSIONS ---
    Write-Host "Configuring API Permissions & Granting Admin Consent..." -ForegroundColor Cyan
    $GraphSP = Get-MgServicePrincipal -Filter "AppId eq '$GraphAppId'" | Select-Object -First 1
    
    $ResourceAccessList = @()

    foreach ($key in $PermissionMap.Keys) {
        $RealRoleName = $PermissionMap[$key]
        $Role = $GraphSP.AppRoles | Where-Object { $_.Value -eq $RealRoleName }

        if ($Role) {
            $ResourceAccessList += @{ id = $Role.Id; type = "Role" }

            New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $NewServicePrincipal.Id -BodyParameter @{
                principalId = $NewServicePrincipal.Id
                resourceId  = $GraphSP.Id
                appRoleId   = $Role.Id
            } | Out-Null
            Write-Host " - Granted: $RealRoleName" -ForegroundColor Gray
        }
    }

    Update-MgApplication -ApplicationId $Application.Id -RequiredResourceAccess @(@{
        resourceAppId  = $GraphAppId
        resourceAccess = $ResourceAccessList
    })

    # --- STEP 4: CREATE CLIENT SECRET ---
    Write-Host "Generating Client Secret..." -ForegroundColor Cyan
    $ExpiryDate = (Get-Date).AddYears(2).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
    $PasswordCred = Add-MgApplicationPassword -ApplicationId $Application.Id -BodyParameter @{
        passwordCredential = @{
            displayName = "MigrationToolSecret"
            endDateTime = $ExpiryDate
        }
    }

    # --- OUTPUT ---
    Write-Host "`n-------------------------------------------------------" -ForegroundColor Yellow
    Write-Host "        SETUP COMPLETE - SAVE THESE DETAILS" -ForegroundColor Yellow
    Write-Host "-------------------------------------------------------" -ForegroundColor Yellow
    Write-Host "Application Name        : $AppName"
    Write-Host "Application (Client) ID : $($Application.AppId)"
    Write-Host "Client Secret Value     : $($PasswordCred.SecretText)"
    Write-Host "Directory (Tenant) ID   : $TenantId"
    Write-Warning "IMPORTANT: Copy the Client Secret Value immediately."

    }
    catch {
    Write-Error "Operation failed: $_"
    }

    # --- FINAL DISCONNECT ---
    Disconnect-MgGraph
    Read-Host "`nPress Enter to close this window"
    

Pour des raisons de sécurité, nous vous recommandons d'enregistrer la nouvelle application en tant qu'application à locataire unique.

1. En tant qu'administrateur, connectez-vous au portail Azure.
2. Dans Azure Active Directory (Azure AD), accédez à Inscriptions d'applications.
3. Cliquez sur New Registration (Nouvel enregistrement), puis saisissez un nom pour votre application (par exemple, "Advanced migration app").
4. Pour Supported account types (Types de comptes compatibles), cliquez sur Accounts in this organizational directory only (Comptes dans cet annuaire organisationnel uniquement) pour créer une application à locataire unique.
5. Cliquez sur S'inscrire.

Choisissez l'une des options suivantes :

Option 1 : Ajouter manuellement des autorisations

1. Sur le côté, sous Gérer, cliquez sur Autorisations de l'API.
2. Cliquez sur Ajouter une autorisationAPI MicrosoftMicrosoft Graph.
3. Pour les autorisations d'application, sélectionnez :
   • calendars.read
   • mail.read
   • contacts.read
   • Directory.read.all
4. Cliquez sur Accorder le consentement administrateur pour votre organisation.

Option 2 : Modifier le fichier manifeste de l'application

1. Ouvrez le fichier manifeste de l'application.
2. Accédez à "resourceAccess" : [ ] et choisissez une option :
   • Si "resourceAccess" : [ ] a déjà une valeur, ajoutez une virgule, puis collez le bloc de code suivant.
   • Si "resourceAccess" : [ ] n'a pas de valeur, copiez et collez le bloc de code suivant.

   { "id": "089fe4d0-434a-44c5-8827-41ba8a0b17f5", "type": "Role" },

   { "id": "810c84a8-4a9e-49e6-bf7d-12d183f40d01", "type": "Role" },

   { "id": "7ab1d382-f21e-4acd-a863-ba3e13f7da61", "type": "Role" },

   { "id": "798ee544-9d2d-430c-a058-570e29e34338", "type": "Role" }

3. Cliquez sur Accorder le consentement administrateur pour votre organisation.

1. Sur le côté, sous Gérer, cliquez sur Certificats et codes secretsNouveau code secret du client.
2. Saisissez une description, sélectionnez une période d'expiration, puis cliquez sur Ajouter.
3. Copiez la valeur du code secret du client et stockez-la de manière sécurisée. La valeur n'est affichée qu'une seule fois.

Important : Stockez les identifiants de l'application de manière sécurisée. Si les identifiants sont divulgués, les pirates informatiques peuvent accéder à toutes vos données Exchange.

Cliquez sur Aperçu et notez les identifiants suivants de manière sécurisée :

• ID (client) de l'application
• ID de l'annuaire (locataire)