Preparing Migration 8.15 - System Requirements and Access Rights

Used To (By)	Where Specified	Rights and Permissions
Access local mailboxes and mail during migration to Microsoft Office 365	On the General>Connection page of the source Exchange server Properties in the Migration Manager for Exchange console	See the Source Accounts Used by Migration Manager for Exchange Agents topic.

Active Directory account

Used To (By)	Where Specified	Rights and Permissions
Work with the source Active Directory	On the General>Associated domain controller page of the source Exchange server Properties in the Migration Manager for Exchange console	See the Source Accounts Used by Migration Manager for Exchange Agents topic.

Office 365 administrative account

Used To (By)	Where Specified	Rights and Permissions
By Migration Agent for Exchange to access the corresponding Microsoft Office 365 tenant	For mailbox and calendar synchronization: during an Office 365 mailbox migration or calendar synchronization collection creation in the Migration Manager for Exchange console	User Management Administrator account ApplicationImpersonation role Mail Recipients role Microsoft Exchange Online license Default UPN
By legacy Migration Manager for Exchange agents to synchronize public folders with Office 365	For public folder synchronization: when adding Office 365 tenant in the Migration Manager for Exchange console	User Management Administrator account ApplicationImpersonation role Mail Recipients role Microsoft Exchange Online license Default UPN The account should be associated with the primary hierarchy public folder mailbox The account should be granted by Owner permissions on all public folders

Note: Rights and permissions for the agent host account used by Migration Agent for Exchange (MAgE) are listed in Agent Host Account Used by Migration Agent for Exchange (MAgE) topic.

Refer to the Migrating to Microsoft Office 365 document for more details.

Account Required for Migration Manager to Access Tenant Data

Migration Manager for Active Directory (Office 365) uses Microsoft Graph API to access Azure Active Directory. Administrative consent is required in order to grant the "Quest Migration Manager for Active Directory" application access to the tenant data.

Microsoft Graph account

Used To (By)	Where Specified	Rights and Permissions
Grant the application access to the tenant data.	Consent can be granted at the time of adding a Migration Pair or in advance using this hyperlink https://login.microsoftonline.com/###-####-###-####/adminconsent?client_id=8edd986e-2f01-4f62-84d2-34576b05fc01 where ###-#####-###-##### must be replaced with an actual tenant id (which can be obtained via the Azure Admin console).	Global Administrator or Privileged Role Administrator role Once the Application has been granted access, the Migration Manager service account can function with the following minimal set of roles: For Matching only: Exchange Administrator role For Migration, the following minimal set of roles: Exchange Administrator, Directory Readers, Directory Writers

Accounts Used by RUM Agent Service

Migration Manager RUM Agent service account

Used To (By)	Where Specified	Rights and Permissions
Run the Migration Manager RUM Agent service on the computers to be processed	For Migration Manager RUM agents installed using the Resource Updating Manager console, the Project \| Manage Domains Credentials option should be used. If the account is not specified, the Local System account (default) is used. When creating agents setup to deploy agents using Group Policy or SMS, specify this account using the Project \| Create Agent Setup option in the Resource Updating Manager console menu. If the account is not specified, the Local System account (default) is used.	You can use either the Local System account (default) or a specified account. If you specify an account explicitly, make sure that it has sufficient privileges to create and remove computer accounts as part of the move operation. One way to do this is to give the account administrative rights in both the source and target domains (membership in the Domain Admins group of the source domain and in the domain local Administrators group of the target domain, or vice versa). However, if you prefer privileges to be more granular, you can give the account the following specific permissions: Create All Child Objects on the target domain object Delete All Child Objects on the source domain object Important: If computer running Migration Manager RUM Controller Service (in fact, computer running Migration Manager console) and computers running Migration Manager RUM Agent Service (workstations and servers to be processed) are located in different domains of different forests without trusts established between them then you should specify account for Migration Manager RUM Agent service account explicitly. The Local System account (default) cannot be used.

Used To (By)

Where Specified

Rights and Permissions

Run the Migration Manager RUM Agent service on the computers to be processed

For Migration Manager RUM agents installed using the Resource Updating Manager console, the Project | Manage Domains Credentials option should be used. If the account is not specified, the Local System account (default) is used.

When creating agents setup to deploy agents using Group Policy or SMS, specify this account using the Project | Create Agent Setup option in the Resource Updating Manager console menu. If the account is not specified, the Local System account (default) is used.

You can use either the Local System account (default) or a specified account.

If you specify an account explicitly, make sure that it has sufficient privileges to create and remove computer accounts as part of the move operation. One way to do this is to give the account administrative rights in both the source and target domains (membership in the Domain Admins group of the source domain and in the domain local Administrators group of the target domain, or vice versa).

However, if you prefer privileges to be more granular, you can give the account the following specific permissions:

Create All Child Objects on the target domain object
Delete All Child Objects on the source domain object

Important: If computer running Migration Manager RUM Controller Service (in fact, computer running Migration Manager console) and computers running Migration Manager RUM Agent Service (workstations and servers to be processed) are located in different domains of different forests without trusts established between them then you should specify account for Migration Manager RUM Agent service account explicitly. The Local System account (default) cannot be used.

Accounts Used by RUM Controller Service

Migration Manager RUM Controller service account

Used To (By)	Where Specified	Rights and Permissions
Run the Migration Manager RUM Controller Service on the console computer Access a computer to install or uninstall the Resource Updating Agent (only if no other account is explicitly specified for domain using the Project \| Manage Domains Credentials option in the Resource Updating Manager console menu)	Project \| Manage Controller Credentials option in the Resource Updating Manager console menu.	Must be a member of the local Administrators group on the computer running the Resource Updating Manager. Must have Full Admin access rights on ADAM/AD LDS database.

Local account

Used To (By)	Where Specified	Rights and Permissions
This account must be created only if computer running Migration Manager RUM Controller Service (in fact, computer running Migration Manager console) and computers running Migration Manager RUM Agent Service (workstations and servers to be processed) are located in different domains of different forests without trusts established between them.	On computer running Migration Manager RUM Controller Service. Create local account with the same name and password as Migration Manager RUM Agent service account has.	Must be a member of the local Administrators group on the computer running the Resource Updating Manager.

Used To (By)

Where Specified

Rights and Permissions

This account must be created only if computer running Migration Manager RUM Controller Service (in fact, computer running Migration Manager console) and computers running Migration Manager RUM Agent Service (workstations and servers to be processed) are located in different domains of different forests without trusts established between them.

On computer running Migration Manager RUM Controller Service.

Create local account with the same name and password as Migration Manager RUM Agent service account has.

Must be a member of the local Administrators group on the computer running the Resource Updating Manager.

Seleziona il prodotto:

Per una maggiore efficacia, compilare l'Obiettivo della chat:

Soluzioni consigliate per il problema