Migrator for Notes to Exchange 4.16.3 - SSDM User Guide

Step 5: Grant Exchange Admin accounts Full Access rights to created mailboxes

For MNE to connect to and write migrated content to each target mailbox, the Exchange account that is used to perform the migration must be granted Full Access rights to the mailbox. Unlike on-premises Exchange, Microsoft 365 does not allow you to grant access at the database level. You can only grant access at the mailbox level. The permissions of each mailbox in the user collection must be configured individually. Microsoft does not provide a method to configure permissions for a group of mailboxes in Microsoft 365 at once.

By default, MNE checks the configured permissions of each mailbox in the user collection at beginning of the migration. If permissions are insufficient, MNE grants the necessary permissions to perform the migration. However, Quest strongly recommends that you DO NOT rely on this built-in mechanism since there is a noticeable delay between granting mailbox permissions to a user and successful logins by that user. The delay before the permissions take effect is highly variable. It can be several seconds or several minutes, even as long as 30 minutes, adding unnecessary delay to the migration start.

If MNE must wait for the configured permissions to take effect, the wait time can lead to a failed migration. There is a maximum amount of time that MNE will wait for permissions to take effect, 30 minutes by default.

Quest strongly recommends that you grant the necessary permissions ahead of the scheduled migration at least one hour before the migration start time.

MNE provides the following PowerShell cmdlets in the MNE PowerShell library to assist with granting permissions:

Both cmdlets are run within the scope of a specific user collection, provided as a parameter when the cmdlet is run. The cmdlets configure Full Access rights for each mailbox within the user collection using the configuration information stored in the MNE database (or optionally within an external configuration file provided through a cmdlet parameter). See the MNE Administration Guide for details about the cmdlets.

If you are migrating using a pool of admin accounts, MNE grants permissions using the Role Group for the admin accounts. This ensures that MNE can access each mailbox regardless of which account in the pool is used to perform the migration.

When you perform the migration task, MNE does not know if you have pre-configured the mailbox permissions. As a result, it still takes time to verify the permissions on each mailbox within the collection. To eliminate the time taken to verify the permissions, you can also configure the [Exchange] AddFullAccessPermission INI setting to 0. Setting this parameter to 0 tells MNE that you have taken responsibility to ensure the mailboxes have the necessary permissions, and that MNE is not responsible for verification.

Step 6: Run the Data Migration Wizard to set Notes-to-Exchange mail forwarding and migrate data

IMPORTANT: If you are migrating data using file system access (rather than by server access): • Verify that all migrating users are logged off before running the MNE Data Migration Wizard. If the data is accessible through the Domino server, Quest recommends you use server access to locate and migrate the data. If server access is impossible or impractical, and you need to use file system access to locate and migrate the data, you must ensure that all users in the current collection are logged off the system. • Also, ensure the NSF file is not open in the server cache. The dbcache flush command closes all files being held open by the server for users that are no longer logged onto the server. Running the dbcache flush command prevents the server from blocking MNE access to the NSF files during the migration run.

Run the Data Migration Wizard again to:

See the Data Migration Wizard chapter of the Migrator for Notes to Exchange Administration Guide for complete instructions and application notes.

Step 7: Distribute .pst files

If the Data Migration Wizard migrates any data to Outlook Personal Folder (.pst) files, when the migration is complete you must either:

The Data Migration Wizard names any new .pst files using the common filename, if specified, or the specified filename format. if more than one file is generated per User ID, incremental numbers are appended to the filename. For example, Smith.pst, Smith-1.pst, Smith-2.pst, etc.

NOTE: The location of the PST files is reported in: • The User migration status per collection report, available from the View Summaries screen of Notes Migration Manager. • The Report Pack Report, available from the View Report Pack screen of Notes Migration Manager.

If this is not your last migration collection: Repeat this entire Batch migration process for the next collection. If this is your last migration collection, but you have more Notes users to be migrated individually by the SSDM: See the SSDM (per-desktop) migration chapter in this guide.

If this is your last migration collection and no users remain to be migrated by the SSDM (per-desktop) program, see Post-migration activities.

Post-migration activities

Groups are typically provisioned separately, after all users are migrated in the Batch migration process (the preceding section of this chapter). Since the only data associated with a group is its member list, group migration consists only of the group being provisioned into the target directory. Use the MNE Groups Provisioning Wizard to provision groups either directly from Notes to Microsoft 365, or to a local “staging” AD from which you can use Microsoft AD Sync tool to provision the groups from the local AD to Microsoft 365.

Before you run the Groups Provisioning Wizard, you can divide the groups into collections using the MNE Collection Wizard for convenient processing. If necessary, you can update group membership and attributes in the SQL database (via TSV export and import) prior to provisioning the groups into Active Directory. For instructions, see the Groups Provisioning Wizard chapter of the Migrator for Notes to Exchange Administration Guide.

NOTE: You must run the Microsoft AD Sync tool twice to completely provision nested Notes groups (i.e., Group A contains Group B) in Microsoft 365.

To provision groups before all Notes users are migrated, check the Message Delivery Restrictions for any Exchange group to which you want Notes users to be able to send messages. Any such Exchange group must be of the universal distribution type to be mail-enabled.