SharePoint Migration Identity Mapping Tool: Microsoft Entra Identity Scan

Overview

The Microsoft Entra Identity Scan looks up identities that were found in the source SharePoint environment in the Microsoft Entra ID that you authenticate to.

When the tool is performing look-ups, the pattern used for matching is listed in the table.

Users
ExactMatch	Source Identity is a Windows user with a Security Identifier [SID]. The target is the OnPremisesSecurityIdentifier in Microsoft Entra ID. Non-Windows accounts will never be able to have an ExactMatch.
PartialMatch	Source identity claim value equals the UserPrincipalName or Mail value in Microsoft Entra ID. or Source Identity Display Name equals the Display Name in Microsoft Entra ID.
NoMatch	Unable to perform neither ExactMatch or PartialMatch.

Groups
ExactMatch	Source Identity is a Windows group with a Security Identifier [SID]. The target is the OnPremisesSecurityIdentifier in Microsoft Entra ID. Non-Windows accounts will never have an ExactMatch.
PartialMatch	Source Identity Display Name equals the Display Name in Microsoft Entra ID.
NoMatch	Unable to perform neither ExactMatch or PartialMatch.

We use Microsoft Authentication Library to authenticate the operator to Microsoft Entra ID. This requires consent for the application to read the Microsoft Entra ID. In order to ensure there's consent prior to running the scans, the tool performs a preflight validation check that involves authenticating to Azure. This enables the operator to avoid running a long scan process if all the prerequisites haven't been met. See SharePoint Migration Identity Mapping Tool - Preflight validation checks for more information.