Step 1: Enable the Provisioning API
In the Google Apps control panel, go to Domain Settings tab > User settings > Enable Provisioning API section, and select Enable provisioning API. This API is required for validating users before the migration; therefore, only read-only access is required.
Step 2: Configure OAuth client access
You must configure OAuth Client access to migrate data. The steps for this task differ, depending on whether you want to migrate data into your primary domain only or to multiple domains.
If you re migrating data into the primary domain only:
1. In the Google Apps control panel, go to Advanced Tools tab > Authentication section, and click Manage OAuth Domain key.
Select Enable this consumer key.
Google Apps Migration for Microsoft
Exchange Administration Guide