Required Permissions

Note: If you use end-user credentials for migration, you do not need to create an administrator account.

If you do not use the Use Modern Authentication option, your administrator account must have an Enterprise Microsoft 365 license and must be assigned to a Role-Based Access Control group that has Application Impersonation rights. By default, the ApplicationImpersonation role is not assigned to this group, which means the first step is to sign in as an organization administrator to the Microsoft 365 portal (http://portal.microsoftonline.com) and add this role to either an existing role group or to a new role group that you create. See Exchange Online documentation for more information on creating role groups and assigning rights.

It is recommended that you create a new role group named "Migration Impersonation" and assign the ApplicationImpersonation role to it.

Role groups are created in the Role Groups page of the Microsoft 365 portal. After logging in, go to the Options menu, select See All Options.... Then from the Options: Manage Myself menu, select My Organization. Lastly, select the Roles & Auditing item and click New.

You can use Modern Authentication to connect to Microsoft 365. The Use Modern Authentication option lets you grant consent to ODME instead of providing Administrative credentials with Application Impersonation rights. When the Use Modern Authentication option is enabled, the Forwarding section in a plan’s Options page contains additional fields where you need to specify the credentials of the account which has the permissions to modify forwarding settings. The Use Modern Authentication option is enabled for any newly created plan by default.

Note: The Use Modern Authentication option is supported for connections to the Microsoft 365 Worldwide. The option is not supported for connections to the Microsoft 365 hosted in the Germany, China or US Government environments (Microsoft 365 GCC High).

When connecting to your Microsoft 365 server in the Migration Settings screen, it is recommended you select the auto-discovery option, which uses your login credentials to automatically obtain the server name during a migration. You can also enter the name of your Microsoft 365 server manually as it appears in the address bar when you log in as an administrator to your account.

Note: If using the auto-discovery option, you need to have the proper DNS settings in place. See Exchange Online documentation for more information.

To perform mail forwarding, the administrator account must be assigned the "Recipient Management" role. See the section Setting Up Mail Routing for more information.

Upgrade Throttling Policies

In order to minimize Microsoft 365 throttling impact to migration and to raise the overall migration throughput, we highly recommend to upgrade your Microsoft 365 tenant throttling policies. Please contact Microsoft support with the request to raise the limits for the following throttling parameters to 'Unlimited':

• EwsMaxBurst
• EwsRechargeRate
• EwsCutoffBalance

The upgrade can be done for the time of your migration only.