How To: Grant Application Impersonation Rights in Office 365 (4350092)

To migrate data to Office 365, your administrator account must have ApplicationImpersonation rights to impersonate the users you are migrating. By default, no groups or users have ApplicationImpersonation rights in Office 365.

Below are two options to grant "ApplicationImpersonation" rights to your Office 365 migration admin account(s):

To grant ApplicationImpersonation rights via the Office 365 Portal:

1. Login to the Office 365 Portal as a Global Administrator. (http://portal.microsoftonline.com)
2. Click Admin.
3. Click Admin Centers | Exchange.
4. Select "Permissions" from the navigation tree on the left.
5. Click on "Admin Roles"
6. Click the "+" Icon to add a new role
7. In the role group dialog box Provide a name for your Role Group (ie. "ODME_Impersonation")
8. Under Roles, click the "+" icon to add an RBAC Role.
9. Highlight "ApplicationImpersonation", click "add ->" and then click OK.
10. Under Members click the "+" icon to add a new memeber to the RoleGroup
11. Highlight your migration admin user account(s) that will be performing the migrations, click "add ->", and then click OK.
12. Click Save

To grant ApplicationImpersonation rights via PowerShell:

1. Login to Office 365 via PowerShell.
2. Use the following sample PowerShell cmdlet to apply ApplicationImpersonation rights directly to your migration admin user account(s):

New-ManagementRoleAssignment -Role "ApplicationImpersonation" –User migadmin@tenant.onmicrosoft.com

3. Repeat the cmdlet for any additional migration admin user accounts.

Note: It can take up to 48 hours for these new "ApplicationImpersonation" rights to take effect in Office 365.