System Center Orchestrator
A family of System Center products that provide an automation platform for orchestrating and integrating both Microsoft and non-Microsoft IT tools.
How do I get the migration.read.all scope to load to use orchestrator to complete a migration
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(134.4, 67%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
MarciS
0
Reputation points
Trying to complete a migration using orchestrator and are at this point:
All CTMM and CTIM validator scripts have come up clean/complete/successful and 'ready to migrate', but when we start the batches (validating per the link above), the batches fail. I am unable to load MgGraph w/the scope migration.read.all. So I cannot use the subsequent cmdlets and I have no way to see why the batches are failing (I have the cmdlets, but they are not recognized b/c I can't load the migration.read.all scope). I have both graph, and graph.beta installed/imported and connected, v2.34.0 (not 2.5, forcing 2.5 broke graph v1.0 entirely due to version conflicts and I had to reload all the graph modules). Beta works for all other scopes, but the migration scope is not present. I am a global admin in both tenants and a migration admin in both tenants.
When I go to use the migration.read.all scope (all other v1.0 and beta scopes load fine), I get this error:
"Error invalid_client error_description: AADSTS650053: The application 'Microsoft Graph Command Line Tools' asked for scope 'Migration.Read.All' that doesn't exist on the resource '00000003-0000-0000-c000-000000000000'. Contact the app vendor. Trace ID: b9b714f1-e5c6-47ee-aeac-0b91a3451100 Correlation ID: c2d02f07-677b-4e1b-b02d-84bcf30d4993 Timestamp: 2026-01-06 07:42:44Z"
From what I have read, the message indicates that the client app (Graph, "resource 00000003-0000-0000-c000-000000000000" ) is not allowed to request migration.read.all and Azure rejects the request. You cannot find or force the migration permissions via Graph Explorer...
How can I get migration.read.all to load in graph so I can see why my batches are failing and fix those problems so we can get migrated? TYIA!
Moderator note: Moved from Microsoft 365 and Office | Other
System Center Orchestrator
Sign in to answer