Phase 1: Microsoft Entra ID (Azure) Application Setup
Before we can migrate mailboxes to Microsoft 365, we must register an application in Microsoft Entra ID (formerly Azure AD). This generates the Client ID and Client Secret needed for secure OAuth authentication, and enables the required IMAP permission.
Note: You only need to complete this phase once per Microsoft 365 tenant.
Phase 1: Register the Azure Application
1) Create the App
- Log into the Azure Portal: https://portal.azure.com
- Use the top search bar to find Microsoft Entra ID (formerly Azure AD), then click it.
- In the left sidebar, click App registrations, then click New registration.
- Set the following:
- Name: IMAPSync Migration Studio (or any name you prefer)
- Supported account types: Select the third option:
Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and personal Microsoft accounts
This is required to migrate external clients, not only users within your own tenant. - Redirect URI: Select Web and enter the exact URL where your app will live, ending in
oauth.php.
Example:https://linux.thexyz.com/start/oauth.php
The URL must match exactly. We will build this file in the next phase.
- Click Register.
2) Save Your Client ID
- On the Overview page that loads immediately after registration, copy the Application (client) ID.
- Save it in a secure notepad or password manager.
3) Generate Your Client Secret
- In the left sidebar, click Certificates & secrets.
- Click New client secret.
- Enter a description (for example:
Web App Key) and set the expiry to 24 months. - Click Add.
Critical: Immediately copy the value shown in the Value column and save it securely. Microsoft will permanently hide this value as soon as you leave the page. If you lose it, you must create a new secret.
4) Add the IMAP Permission
- In the left sidebar, click API permissions.
- Click Add a permission.
- Select the APIs my organization uses tab.
- Search for Office 365 Exchange Online and click it.
- Click Delegated permissions.
- Search for and check IMAP.AccessAsUser.All.
- Click Add permissions.
Important: After adding the permission, if you see an option to Grant admin consent, complete it. Without admin consent, OAuth sign-in may fail during migration.
Phase 1 Complete
You should now have the following saved securely:
- Application (client) ID
- Client Secret value
Next: Phase 2: OAuth Configuration and Authorization
