The account does not have permission to impersonate the requested user. ErrorCode = ErrorImpersonateUserDenied (4263243)

Global Administrator

Application Impersonation

The account does not have permission to impersonate the requested user.

ErrorCode = ErrorImpersonateUserDenied

Exchange Online services might be temporarily unavailable from one or both of M365 tenants due to :

1. Network throttling
2. Routine maintenance
3. Delay in Microsoft-managed Active Directory replication

Since this Application Impersonation Role needs to be taking effect on a whole M365 tenant basis, this is a Microsoft issue and so there is no fix from within ODM, customer can just only wait for both M365 tenants to recover back to working condition, then proceed to stop current ODM mailbox migration tasks, which are likely to have already hung, so will need to be restarted again.

To validate on integrity of both M365 tenants if their required mailbox authentication can be properly resolved online, Microsoft Remote Connectivity Analyzer Tool can be accessed at this URL :

Service Account Access (Developers)

A successful test result should look like this :

Connectivity Test Successful

Test Details

Exchange Web Services service account access verification

All tests completed successfully with the service account.

Test Steps

The Microsoft Connectivity Analyzer is attempting to test Autodiscover for user.name@contoso.onmicrosoft.com.

Autodiscover was tested successfully.

Test Steps

A new mail item is being created.

A mail item was created successfully.

Additional Details

ErrorImpersonateUserDenied, indicates that the specified Service account doesn't have the ms-Exch-EPI-May-Impersonate correct on the Act As Account it's trying to impersonate.