Migrating SharePoint permissions to another tenant

Permissions migrate last, once everything exists in the target: sites, lists, items, accounts. They depend entirely on how identities are translated.

Short answer

The tool recreates permission levels and SharePoint groups, then reproduces broken inheritance on sites, lists, folders and items. Each account is translated through a mapping table; an unknown account never receives someone else’s permissions.

What is migrated

Permission levels: built-in levels are matched by type, not by name, which works between a French and an English site; custom levels are recreated.
SharePoint groups: recreated with their members translated.
Broken inheritance: reproduced on sites, lists, folders and items.
Entra and Microsoft 365 groups: matched to an existing target group; never created by the tool.

The mapping table

A CSV file with three semicolon-separated columns:

Type;Source;Target
Domain;contoso.com;fabrikam.com
User;jdupont@contoso.com;jean.dupont@fabrikam.com
Group;11111111-1111-1111-1111-111111111111;22222222-2222-2222-2222-222222222222

Domain applies to every account not listed, guests included.
User translates an account whose address changes in another way.
Group pairs a source Entra group’s ObjectId with an existing target group’s.

Unknown accounts

A fallback account replaces unknown authors in metadata (Created by, Modified by) so the item can be written. It never receives the permissions of the user it replaces: a permission with no valid holder is reported, not transferred.

Before migrating: clean up

The more items with unique permissions, the longer the phase. SharePoint recommends staying under 5,000 unique permission scopes per list.
Permissions granted to accounts that left long ago need not be migrated: remove them at the source or let them be reported.
Sharing links are not migrated; direct sharing with people is.

OneDrive

A OneDrive has no permission levels or SharePoint groups. Unique permissions on folders and files, meaning sharing with people, are carried over; access to the OneDrive itself stays with its owner.

Frequently asked questions

Can permissions be migrated separately?

Yes. Each phase runs on its own: migrate the content, fix the identity table, then run the Permissions phase.

Are NTFS permissions from a file share migrated?

No. Files from a share take the permissions of the target library.

Test it on your own tenant

The 14-day trial migrates 10% of every library, with versions, metadata and permissions. After you subscribe, an incremental run migrates the rest.

Start the free trial See pricing