System Requirements
Refer to System Requirements and Access Rights document for the Migration Agent for Exchange (MAgE) requirements.
Required Permissions
The administrative accounts used for public folder synchronization requires the following minimal permissions
- Administrative account permissions required for target Office 365 organization
- Administrative account permissions required for target Exchange 2016/2019 organization
- Administrative account permissions required for source Exchange 2010 organization
- Administrative account permissions required for source Exchange 2013/2016/2019 organization
Target Office 365 Account
To set the target administrative account perform the following steps;
- Open Migration Manager Console
- Right click Target Exchange Organization node of the Migration Manager Console management tree.
- On General settings page specify Office 365 credentials to use as target administrative account.
|
|
IMPORTANT: The account assigned to be a target Office 365 administrative account used by Migration Agent for Exchange should meet the following requirements:
|
The following permissions are required for target Office 365 administrative account used by Migration Agent for Exchange during public folder synchronization:
|
Permission |
Used for | Used by | How to Grant |
|---|---|---|---|
| The Public Folders management role | Getting access permissions to perform public folder migration | MAgE and MMEX PowerShell module | Office 365 account: Granting the Public Folders Role |
| The View-Only Configuration management role | Getting organization configuration data | MAgE and MMEX PowerShell module (Get-OrganizationConfig) | Office 365 account: Granting the View-Only Configuration Role |
| Owner permission for each public folder you want to synchronize | Creating and syncing content and permissions (including Migration Manager Recycle Bin, if applicable) | MAgE and MMEX PowerShell module | Office 365 account: Granting Public Folder Owner Permission |
| CreateSubfolders and FolderVisible access rights to the root public folder folder (“\”) * | Creating Migration Manager Recycle Bin folder | MAgE and MMEX PowerShell module |
Office 365 account: Granting CreateSubfolders and FolderVisible access rights to the root folder |
| Mail Recipients and Mail Enabled Public Folders management roles | Syncing Mail Public Folders properties | MAgE and MMEX PowerShell module for Sync-MMExMailPublicFolder | Office 365 account: Granting the Mail Recipients and Mail Enabled Public Folders Roles |
| Distribution Groups management role | Syncing Public Folder Client permissions for Distribution Groups | MAgE and MMEX PowerShell module for Set-MMExGroupMatching | Office 365 account: Granting the Distribution Groups Role |
* it is required only to create Migration Manager Recycle Bin from MMEx PoSh scripts, but if admin created it manually, he/she can skip it. Make sure Exchange Organization Account has Owner client permission for Migration Manager Recycle Bin folder.
Notify your users that they should expect to see this account as the owner of their public folders. Consider setting an informative display name for this account.
Target Exchange 2013/2016/2019 Organization Account
To set the target administrative account perform the following steps;
- Open Migration Manager Console
- Right click Target Exchange Organization node of the Migration Manager Console management tree.
- In Add Target Organization Wizard on the Specify Active Directory Domain page provide or change, if necessary, the account credentials in the Logon As area and finish the wizard. This account will be used by MAgE for public folder synchronization.
|
|
Caution: Consider, in case you decide to change account in Mailbox Migration Job or Calendar Synchronization Job properties later, this account for access to Exchange will be used instead the target administrative account you specified using Add Source Organization Wizard. To avoid any issues, it is not recommended to use multiple administrative accounts. |
|
|
IMPORTANT: The account assigned to be a target administrative account used by Migration Agent for Exchange should have a mailbox. |
The following permissions are required for target Exchange account used by Migration Agent for Exchange during public folder synchronization:
|
Permission |
Used for | Used by | How to Grant |
|---|---|---|---|
| Read permission for the Microsoft Exchange container in the Configuration partition of source Active Directory (including all descendant objects) | Adding source Exchange organization using the Add Source Organization Wizard | MMEx console | Granting Read Permission to Microsoft Exchange Container |
| The Public Folders management role | Getting access permissions to perform public folder migration | MAgE and MMEX PowerShell module | Granting the Public Folders Role |
| The View-Only Configuration management role | Getting organization configuration data | MAgE and MMEX PowerShell module (Get-OrganizationConfig) |
|
| Owner permission for each public folder you want to synchronize | Creating and syncing content and permissions (including Migration Manager Recycle Bin, if applicable) | MAgE and MMEX PowerShell module | Granting Owner permissions for each Public Folder |
| CreateSubfolders and FolderVisible access rights to the root public folder folder (“\”) * | Creating Migration Manager Recycle Bin folder | MAgE and MMEX PowerShell module | Granting CreateSubfolders and FolderVisible access rights to the root folder |
| Mail Recipients and Mail Enabled Public Folders management roles | Syncing Mail Public Folders properties | MAgE and MMEX PowerShell module for Sync-MMExMailPublicFolder | Granting the Mail Recipients and Mail Enabled Public Folders Roles |
* It is required only to create Migration Manager Recycle Bin from MMEx PoSh scripts, but if admin created it manually, he/she can skip it. Make sure Exchange Organization Account has Owner client permission for Migration Manager Recycle Bin folder.
Notify your users that they should expect to see this account as the owner of their public folders. Consider setting an informative display name for this account.
Source Exchange 2010 Account
To set the source administrative account perform the following steps;
- Open Migration Manager Console
- Right click Source Exchange Organization node of the Migration Manager Console management tree.
- In Add Source Organization Wizard on the Specify Active Directory Domain page provide or change, if necessary, the account credentials in the Logon As area and finish the wizard. This account will be used by MAgE for public folder synchronization.
|
|
NOTE: Consider, in case you decide to change account in Mailbox Migration Job or Calendar Synchronization Job properties later, this account for access to Exchange will be used instead the source administrative account you specified using Add Source Organization Wizard. To avoid any issues, it is recommended to select one administrative account to use. |
|
|
IMPORTANT: The account assigned to be a source administrative account used by Migration Agent for Exchange should have a mailbox. |
The following permissions are required for source Exchange 2010 administrative account used by Migration Agent for Exchange during public folder synchronization:
|
Permission |
Used for | Used by | How to Grant |
|---|---|---|---|
| Read permission for the Microsoft Exchange container in the Configuration partition of the source Active Directory (including all descendant objects | Adding source Exchange organization using the Add Source Organization Wizard | MMEx console | Granting Read Permission to Microsoft Exchange Container |
| The Public Folders management role | Getting access permissions to perform public folder migration | MAgE and MMEX PowerShell module | Granting the Public Folders Role |
| Owner permission for each public folder you want to synchronize*. | Creating and syncing content and permissions (including Migration Manager Recycle Bin, if applicable) | MAgE and MMEX PowerShell module | Granting Owner Permission for Public Folders |
| Full access right to the root public folder folder (“\”) ** | Creating Migration Manager Recycle Bin folder | MAgE and MMEX PowerShell module | Granting Full Access Permission of public folder to an account |
|
|
TIP: * In case the one-way synchronization is selected, at least Read permission for each public folder you want to synchronize can be granted to make permissions more granular. ** It is required only to create Migration Manager Recycle Bin from MMEx PoSh scripts, but if admin created it manually, he/she can skip it. Make sure Exchange Organization Account has Owner client permission for Migration Manager Recycle Bin folder. |
Source Exchange 2013/2016/2019 Organization Account
To set the source administrative account perform the following steps;
- Open Migration Manager Console
- Right click Source Exchange Organization node of the Migration Manager Console management tree.
- In Add Source Organization Wizard on the Specify Active Directory Domain page provide or change, if necessary, the account credentials in the Logon As area and finish the wizard. This account will be used by MAgE for public folder synchronization.
|
|
NOTE: Consider, in case you decide to change account in Office 365 Mailbox Migration Job or Office 365 Calendar Synchronization Job properties later, this account for access to Exchange will be used instead the source administrative account you specified using Add Source Organization Wizard. To avoid any issues, it is recommended to select one administrative account to use. |
|
|
IMPORTANT: The account assigned to be a source administrative account used by Migration Agent for Exchange should have a mailbox. |
The following permissions are required for source Exchange 2013/2016/2019 administrative account used by Migration Agent for Exchange during public folder synchronization:
|
Permission |
Used for | Used by | How to Grant |
|---|---|---|---|
| Read permission for the Microsoft Exchange container in the Configuration partition of the source Active Directory (including all descendant objects) | Adding source Exchange organization using the Add Source Organization Wizard | MMEx console | Granting Read Permission to Microsoft Exchange Container |
| The Public Folders management role | Getting access permissions to perform public folder migration | MAgE and MMEX PowerShell module | Granting the Public Folders Role |
| Owner permission for each public folder you want to synchronize. | Creating and syncing content and permissions (including Migration Manager Recycle Bin, if applicable) | MAgE and MMEX PowerShell module | Granting Owner permissions for each Public Folder |
| The View-Only Configuration management role* | Creating and syncing content and permissions (including Migration Manager Recycle Bin, if applicable) | MAgE and MMEX PowerShell module | Granting the View-Only Configuration Role |
| CreateSubfolder and FolderVisible access rights to the root public folder (“\”) ** | Creating Migration Manager Recycle Bin folder | MAgE and MMEX PowerShell module |
Granting CreateSubfolders and FolderVisible access rights to the root folder |
|
|
TIP: * In case the one-way synchronization is selected, at least Read permission for each public folder you want to synchronize can be granted to make permissions more granular. ** It is required only to create Migration Manager Recycle Bin from MMEx PoSh scripts, but if admin created it manually, he/she can skip it. Make sure Exchange Organization Account has Owner client permission for Migration Manager Recycle Bin folder. |
Considerations
Refer to Specific Case Workarounds for instructions on how to resolve the specific cases related to public folder hierarchy changes.
- Before you migrate public folders to Microsoft Office 365 keep in mind the following cases:
- During synchronization of pubic folders with Microsoft Office 365 Exchange Online, MAgE is unable to set the message owner (creator) correctly for items in folders. The administrative account becomes the creator of the message instead of the actual mailbox owner. This causes unwanted effects on the target. For example, the user cannot modify and delete their own migrated messages unless they have Owner permissions on the containing folder. This behavior is a result of Exchange and Office 365 architecture aimed at preventing security risks.
- A single MAgE instance performs all migration to Office 365.
- To sync the source SMTP public folder address, you need to add a custom email domain as an accepted domain for your target Exchange organization. Then, you could sync proxy addresses using ProxyAddresses parameter of Sync-MMExMailPublicFolder.
- The migrated public folders always inherit the client permissions from this root folder. To avoid granting unnecessary privileges, make sure that the client permissions for the target root folder are granted to the administrative account only before starting the migration.
- MAgE cannot automatically handle the following change in public folder hierarchy in some specific cases. Refer to New top-level public folders added for details
Refer to Specific Case Workarounds for instructions on how to resolve the issues related to public folder hierarchy change.
- Public folders matched with deleted (soft or hard deleted) public folders by default are moved to source or target Migration Manager Recycle Bin public folders. If the Migration Manager Recycle Bin public folder does not exist , it will be created automatically. Refer to The public folder deleted for details.
- Mail-enabled source folders are synchronized as non-mail-enabled to Office 365. As a workaround, use Sync-MMExMailPublicFolder to make the target folders mail-enabled and set directory properties for them.
- To ensure permission synchronization you should set object matching for migrated by Quest Migration Manager for Active Directory (Microsoft Office 365) mail-enabled universal security distribution groups using Set-MMExGroupMatching cmdlet.
Public Folder Synchronization
This section help you to perform the following tasks related to the public folder synchronization using PowerShell cmdlet toolkit: