Return
-
Title
ODM error: "Error creating target session. The account does not have permission to impersonate the requested user" -
Description
Attempting to migrate users mailboxes using On Demand Migration returned the following error:
Error creating target session. The account does not have permission to impersonate the requested user.(The account does not have permission to impersonate the requested user.)
The account does not have permission to impersonate the requested user.
-
Cause
The administrator account on the target tenant was missing the Application Impersonation role. -
Resolution
RESOLUTION:
1. Grant ApplicationImpersonation rights via the Office 365 Portal:
- Login to the Office 365 Portal as a Global Administrator. (http://portal.microsoftonline.com)
- Click Admin
- Click Admin Centers | Exchange.
- Select "Permissions" from the navigation tree on the left.
- Click on "Admin Roles"
- Click the "+" Icon to add a new role
- In the role group dialog box Provide a name for your Role Group (ie. "ODME_Impersonation")
- Under Roles, click the "+" icon to add an RBAC Role.
- Highlight "ApplicationImpersonation", click "add ->" and then click OK.
- Under Members click the "+" icon to add a new memeber to the RoleGroup
- Highlight your migration admin user account(s) that will be performing the migrations, click "add ->", and then click OK.
- Click Save
2. Grant ApplicationImpersonation rights via PowerShell:
- Login to Office 365 via PowerShell.
- Use the following sample PowerShell cmdlet to apply ApplicationImpersonation rights directly to your migration admin user account(s):
New-ManagementRoleAssignment -Role "ApplicationImpersonation" –User migadmin@tenant.onmicrosoft.com
Note: It can take up to 48 hours for these new "ApplicationImpersonation" rights to take effect in Office 365.