MFG 4.5 and later have been enhanced with a new parameter to workaround this issue.
An admin can now control how long the Migration Wizard will wait after setting admin permissions on an Office 365 mailbox before proceeding with the migration. A new program parameter in gwmigapp.ini lets you specify a number of seconds for the Wizard to wait:
[PowerShell]
PropagationDelay=<##>
For example, the default PropagationDelay=40 tells the Wizard to wait 40 seconds before proceeding. This can be helpful to resolve permissions issues resulting from an O365 Powershell-Exchange propagation delay.
Note: If the [PowerShell] heading does not yet exist, then it should be created at the bottom of the gwmigapp.ini file.
In most cases, setting this parameter to 6 minutes provides the best results:
[PowerShell]
PropagationDelay=360
Recently, customers have been reporting that this this value may need to be increased to 15 minutes (900) on up to 30 minutes (1800):
[PowerShell]
PropagationDelay=900
Note: Office 365 is a dynamic environment and delays may change with transient workload. We would recommend contacting Microsoft directly for recommendations on how long it takes for permissions, set via PowerShell, to take effect in Office 365.
The following is a customer provided solution that may allow you to work around this issue and is provided for informational purposes only. This procedure is not supported by Quest:
Workaround 1 - If you are not using the Admin Account Pool feature:
1.) Use a PowerShell script, or some other method outside of to assign the NME Office 365 migration admin user “FullAccess” rights to all users that are being migrated 20-30 minutes prior to starting the migration.
Workaround 2 – If you are using the NME Admin Pool feature:
1.) Assign all Admin Pool accounts an Exchange Online license.
2.) Create a mail-enabled security group in Exchange Online called "PermissionDelayWorkaround".
3.) Add all Admin Pool accounts to the "PermissionDelayWorkaround" group.
4.) Grant full permissions to "PermissionDelayWorkaround" for all mailboxes.
5.) It may be possible to remove the Exchange Online licenses from the Admin Pool accounts after they have been added to the mail-enabled security group.
To help determine the best value to add to the PropagationDelay for your environment/tenant create an Outlook Profile on the MNE server as the account you specified in MNE on the Exchange Server screen and disable cache mode. Then grant this account full access to another users mailbox in Office 365 using Powershell. Then see how long after running the command to grant these permissions it takes to be able to see this users mailbox in Outlook and be able to browse the folders without errors. This should give you a base line of where you can set the PropagationDelay value, it is recommended to give a little extra time, for example 2 extra minutes. Below is an example of the commands that need to be ran to complete this test: • $Credential = Get-Credential • $Session = New-PSSession -Credential $Credential -AllowRedirection -ConnectionUri https://ps.outlook.com/PowerShell -Authentication Basic
