On Demand Migration – PowerShell API – New Feature Spotlight

Quest is excited to announce that an On Demand Migration (ODM) PowerShell API module is now available in the PowerShell gallery. You can use the ODM API to manage many migration activities outside of the ODM UI, including collection management, account discovery, mail migration, OneDrive migration, task management, and more.

Getting Started with the ODM API

Below is the high-level process for connecting to a Project using the ODM API. Detailed instructions are available in the  ODM User Guide Appendix A: Using PowerShell.

  1. Install the OdmApi module from the PS Gallery
  2. Connect to the ODM service using a Microsoft account that has a valid Role in your ODM project
    1. Interactive: Authenticate using Microsoft’s standard authentication prompt; supports MFA
    2. Unattended: Populate your account credentials in a script that can run unattended
    3. Note: Specify a region if your OrgID does not belong to the US ODM region
  3. Select an OrgID within the designated region
  4. Select a Project ID within the designated OrgID
    1. Tip: Use Get-OdmProject to view available Projects
  5. (Optional) Select a ProjectWorkload ID within the Project
    1. Tip: Use Get-OdmProjectWorkload -Project [ProjectID] to view individual ProjectWorkloadIDs

Example:

  • Install-Module OdmApi -Repository PSGallery
  • Connect-OdmService [-Region EU]
  • Select-OdmOrganization -OrganizationId '6a072d6e-e27b-478b-acba-8b08e9caa430'
  • Select-OdmProject 'Elf813YBfQYAK6Q42Kun'
  • Select-OdmProjectWorkload -ProjectWorkloadId bRnIRooBSDBGOxbk4X70

Configuring access to the ODM API

ODM Roles

Users who are assigned the default Migration Administrator role in ODM can run all the commands available in the ODM API module.

Users that have been assigned a custom ODM role will only be able to perform the actions selected in that role.  For example, if you are assigned a Read-Only role that only allows viewing projects and reports in the UI, you will not be able to create a migration task using the API.

Granting Tenant Consent

When you authenticate to the ODM API for the first time, you may be prompted to grant consent for Quest On Demand to view basic information from your company’s tenant. 

Depending on your company’s tenant configuration, you may be allowed to consent on behalf of your organization, or you may need to wait for your tenant admin to approve the consent request.

What are the available commands in the ODM API?

The API allows you to perform most of the activities that are available in the ODM UI and is regularly updated to support new features and functionality that is added to ODM.

Once you have installed the API module, view the complete list of available commands as follows:

  • Get-Command -Module OdmApi

Add “Get-Help” to the above to view the syntax and available parameters for all available commands:

  • Get-Command -Module OdmApi | Get-Help

Use Get-Help to view additional details for a specific command, such as Add-OdmObject:

  • Get-Help Add-OdmObject -examples
  • Get-Help Add-OdmObject -detailed
  • Get-Help Add-OdmObject -full

What are some use cases for the ODM API?

You can start by using the API to run common tasks like discovery, migration, and task monitoring, as described in the post ODM API Example Scripts. Once you become more familiar with the API, you can create advanced scripts that utilize the ODM API to run more complex migration activities, such as the following:

  • Create collections and add/remove objects in the collections
  • Monitor migration status for a collection of objects and export results to generate custom reports
  • Create a Discovery task in an unattended script that runs weekly to identify newly objects in the source tenant and creates a Collect Statistics task for those objects
  • Create a Switch Applications task for DUA for users whose mailbox and OneDrive migration status is Complete

Further Information

For more information on this and many other features within On Demand Migration, check out the complete On Demand Migration User Guide. We welcome your feedback and suggestions below and invite you to visit us at Quest.com.

  • Excited to find this and use it--but our project isn't using Microsoft Entra IDs yet, and we're still waiting for M365 admins to authorize the Quest application for our tenant. Are there any plans to support other ways to connect with OdmApi? Using a managed identity or certificate-based authentication could be more secure and easier for automated jobs.

  • No and in fact a of today, there is only 25 days until On Demand only has an option to log on using Entra ID only. Using Entra ID to log on to OD uses the same consent you are waiting for your admins to authorize. So the clock is ticking. 

  • Yes, I am thankfully aware of that. It does seem unfortunate that we were given less than 30 days' notice to prepare for this change, though. I received the email on May 7th, which is a pretty short window to consider when we have to rely on other teams (sometimes other organizations) to go through the change and approval process. It's a good thing that email didn't get FPed by our spam filter! Sweat smile