Add or edit a SharePoint connection

Important: These steps apply to Google Workspace Migrate versions earlier than 2.4.24.0. If you are using a newer version of Google Workspace, go to the steps for Google Workspace Migrate version later than 2.4.24.0.

1. In the Google Workspace Migrate platform, click New Connection.
2. Under Name, specify a connection name.
3. For Type, select your version of SharePoint.

   If you're migrating from OneDrive, select SharePoint Online.

4. For URL, specify the URL of your SharePoint site collection.

   If you're only migrating from OneDrive, enter your SharePoint site collection URL with -my added to the subdomain (for example, example-my.sharepoint.com).

5. For Account, choose an option:
   • Select an existing SharePoint administrator account.
   • Click Add a new account.
     • If you're connecting to SharePoint Server, specify the administrator’s account username and password.
     • If you're connecting to SharePoint Online, specify a client ID and client secret for your SharePoint site. For details on how to generate a client ID and client secret for SharePoint Online, go to Create app-based credentials for SharePoint Online.
6. If you’re defining a list of site collections or OneDrive accounts for migration, for List, select your location list. For details, go to Create a location list.

   Note: If you want to migrate only the single site collection defined by the URL in step 4, you can skip this step.

7. Click Create.

Troubleshoot connection errors

If you get a 401 (Unauthorized) error when setting up the SharePoint connection, open Microsoft PowerShell and try these troubleshooting options:

• Make sure you're signed in as the SharePoint Online administrator or Global Administrator and enter Connect-SPOService -Url https://<SharePoint-site> to connect to a SharePoint Online connection.

  For details, go to Connect-SPOService.

• Enter Set-spotenant -DisableCustomAppAuthentication $false to enable custom app authentication.

  For details, go to Granting access using SharePoint App-Only.

• Enter Set-SPOTenant -IsSharePointAddInsDisabled $false to enable app add-ins. 
  For details, go to IsSharePointAddInsDisabled.

• PowerShell 7.4.4 or later—Necessary for PnP.Framework
• Access to an Entra ID account—Necessary for granting administrator consent for permissions
• SharePoint Online Certificate file (.pfx)—Generated when you create a source connection

1. In the Google Workspace Migrate platform, click New Connection.
2. For Name, specify a connection name.
3. For Type, select your version of SharePoint.

   If you're migrating from OneDrive, select SharePoint Online.

4. For URL, specify the URL of your SharePoint site collection.

   If you're only migrating from OneDrive, enter your SharePoint site collection URL with -my added to the subdomain (for example, example-my.sharepoint.com).

5. For Account, choose an option:
   • Select an existing SharePoint administrator account.
   • Click Add a new account.
     • To use one command go to Set up a SharePoint source connection with one command.
     • To connect manually, go to Manually set up a SharePoint source connection.
6. For Client ID, enter the Application (client) ID found on the Overview page in your registered application.
7. For Tenant ID, enter the Directory (tenant) ID found on the Overview page in your registered application.
8. Under Certification Password, enter the password that corresponds to the service certificate you created.
9. Under Service certificate, add the .pfx file you created.
10. If you’re defining a list of site collections or OneDrive accounts for migration, for List, select your location list. For details, go to Create a location list.
    Note: If you want to migrate only the single site collection defined by the URL in step 4, you can skip this step.
11. Click Create.

Follow these steps to register the application, get a certificate, and grant required permissions with one command.

1. Open a PowerShell terminal and create 2 new folders:
   • mkdir Certificates_Folder
   • cd Certificates_Folder
2. Run Install-Module PnP.PowerShell -AllowPrerelease - SkipPublisherCheck-Force to be sure you installed the nightly build.
3. Run Import-Module PnP.PowerShell.
4. Update the following command with the name of your registered application and the address of your tenant page, and then run it.

   $result = Register-PnPEntraIDApp -ApplicationName "Your-new-registered-app-name-here" -Tenant yourtenantpage.com -CertificatePassword (Read-Host -AsSecureString -Prompt "Enter Certificate Password") -OutPath .\ -DeviceLogin

5. Enter a password for the certificate.
6. Sign in with your Entra ID to create the application.
7. Grant administrator consent to the required permissions.

   Note: You can remove unnecessary permissions here.

8. Go to cd Certificates_Folder and locate the new .pfx file. The file is your service certificate.
9. Return to Create a connection and complete the remaining steps.

1. Go to https://entra.microsoft.com/#home and log in with your administrator credentials.
2. For App Registrations, click New registration.
3. Enter a name for the application and don’t change any other fields.
4. Click Register.
5. For App registrations, click the new application.
6. Click API permissionsAdd a PermissionSharePoint.
7. Click API permissionsSites.FullControll.AllAdd permissions.
8. Click Grant admin consentYes to confirm. 
9. Open PowerShell as an administrator.
10. If you created a specific folder for the certificates, enter cd <path> to change your working directory.
11. Run this command and replace the values:

    $cert = New-PnPAzureCertificate -CommonName "my-certificate-common-name" -OutPfx .\my-certificate.pfx -OutCert .\my-certificate.cer -ValidYears 2 -CertificatePassword (Read-Host -AsSecureString -Prompt "Enter Certificate Password")

    This command creates 2 certificate files:

    • my-certificate.pfx
    • my-certificate.cer
12. Run the following command to retrieve the certificate thumbprint: $cert.Thumbprint.

    If you want to retrieve it from the user interface, follow these steps:

    1. Go back to the Microsoft Entra sign-in page and log in with your administrator credentials.
    2. Go to the App registrations page and click the newly registered application.
    3. For Certificates & secrets, click Upload certificate.
    4. Upload the .cer file and click Add.
    5. When the upload is complete, retrieve the thumbprint from the list.
13. Return to Create a connection and complete the remaining steps.