Move-CsUser for SfB to Teams failing when using -AccessTokens parameter

Question

Move-CsUser for SfB to Teams failing when using -AccessTokens parameter

Steiner, Stephan (sunrise-upc) 0

I'm trying to move users from a Skype for Business OnPremise deployment to Teams. The move is supposed to work as a background process, and due to MFA requirements, I cannot use the -Credentials parameter.

I have an App Registration on EntraID that has the requisite permissions (including Teams Admin) that I'm already using for the TeamsPowershell Module (connect-microsoftTeams -AccessTokens xxx) and that I'd like to re-use for the move.

So I'm trying

move-csuser identity-of-user -target Target sipfed.online.lync.com -AccessTokens @("$graphToken", "$teamsToken")

(where $graphToke and $teamsToken) are fetched in the same way as for the MicrosofTeams Module

But, when I run this, all I'm getting is

move-csuser : Index was outside the bounds of the array.

At line:1 char:1

+ move-csuser ``[Moderator note: personal info removed]`` -AccessTokens @("$graphToken", "$team ...

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : InvalidOperation: (CN=AUDM Test 5,...DC=``[Moderator note: personal info removed]``,DC=ch:OCSADUser) [Move-CsUser], IndexOutO

fRangeException

+ FullyQualifiedErrorId : MoveError,Microsoft.Rtc.Management.AD.Cmdlets.MoveOcsUserCmdlet

I tried with just one token and am being told I have to provide both graph and Teams token, so I'm reasonably sure I'm using the correct tokens. So.. what can I do here? This is on Microsoftteams Module 6.2 since newer ones seem to lack the code to move at all (verified by calling

move-csuser identity-of-user -target Target sipfed.online.lync.com -Credentials $cred

). So.. am I doing something wrong, or is the -AccessTokens parameter not working.

0 comments

1 answer

Your answer

Answer 1

Please note that Q&A forum is a public platform, and moderators will modify the question to hide personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data.

Dear Steiner, Stephan (sunrise-upc)

Thank you for your detailed explanation.

The Move‑CsUser cmdlet does not interact with Microsoft Graph or Teams administrative endpoints. Instead, it relies on the Skype for Business Hybrid Migration pipeline, which communicates with the legacy Hosted Migration Service endpoint to move the user’s home pool from on‑premises to the Microsoft 365 cloud.

Additionally, Move‑CsUser requires delegated administrative authentication via the hybrid trust relationship between the on‑premises SfB deployment and Microsoft 365. At this time, it does not support application‑only authentication, including tokens obtained via Entra ID app registrations (such as Microsoft Graph or Teams access tokens).

As documented by Microsoft, administrator accounts used to perform Move‑CsUser operations should be excluded from MFA or Conditional Access policies to support automated bulk migration scenarios.

You may consider trying the following approach to see if this helps bypass the limitation:

1> Create a dedicated cloud‑only admin account

2> Assign the following roles:

Teams Administrator
Skype for Business Administrator
User Administrator

3> Exclude this account from:

MFA
Conditional Access

After that, you may attempt automation using a scripted approach such as:

$cred = Get-Credential
 
Import-Csv users.csv |
foreach {
Move-CsUser -Identity $_.UPN 
-Target sipfed.online.lync.com 
-Credential $cred 
-HostedMigrationOverrideUrl $url
}

You may test this setup to see whether it allows the migration to proceed successfully.
Hope this helps, please feel free to share any updates from your testing.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Anonymous

2026-04-14T13:24:35.5366667+00:00

Dear Steiner, Stephan (sunrise-upc)

just following up to see if the information above was helpful. If you have any updates or further questions, feel free to share them here.