-
Title
The account does not have permission to impersonate the requested user. ErrorCode = ErrorImpersonateUserDenied -
Description
Both Migrator Service Accounts for On Demand Migration (ODM) at Source & Target Microsoft / Office 365 (M365) tenants have already been granted on these 2 privileged roles for more than a month ago :Global Administrator
Application Impersonation
ODM Mailbox Migration has been running successfully before, when all of a sudden, with no change to any attribute of ODM Migrator Service Accounts, all ODM Mailbox Migration tasks start to fail with this error encountered :
The account does not have permission to impersonate the requested user.
ErrorCode = ErrorImpersonateUserDenied
-
Cause
Exchange Online services might be temporarily unavailable from one or both of M365 tenants due to :
- Network throttling
- Routine maintenance
- Delay in Microsoft-managed Active Directory replication
-
Resolution
Since this Application Impersonation Role needs to be taking effect on a whole M365 tenant basis, this is a Microsoft issue and so there is no fix from within ODM, customer can just only wait for both M365 tenants to recover back to working condition, then proceed to stop current ODM mailbox migration tasks, which are likely to have already hung, so will need to be restarted again.
To validate on integrity of both M365 tenants if their required mailbox authentication can be properly resolved online, Microsoft Remote Connectivity Analyzer Tool can be accessed at this URL :
Service Account Access (Developers)
A successful test result should look like this :
Connectivity Test SuccessfulTest DetailsExchange Web Services service account access verificationAll tests completed successfully with the service account.Test StepsThe Microsoft Connectivity Analyzer is attempting to test Autodiscover for user.name@contoso.onmicrosoft.com.Autodiscover was tested successfully.Test StepsA new mail item is being created.A mail item was created successfully.Additional Details
Deleting an item.
An item was deleted successfully.Additional DetailsA failed test result should look like this :
ErrorImpersonateUserDenied, indicates that the specified Service account doesn't have the ms-Exch-EPI-May-Impersonate correct on the Act As Account it's trying to impersonate.