Impact of Application Impersonation Role Retirement on On Demand Migration (ODM) (4378193)

Impact of Application Impersonation Role Retirement on On Demand Migration (ODM)

Microsoft has announced that the Application Impersonation role in Exchange Online will be retired in February 2025. This role has traditionally been used for migration tools to access mailboxes during Exchange migrations. Customers using Quest ODM have expressed concerns about the potential impact of this change on their ongoing or upcoming migrations.

The Application Impersonation role will no longer be assignable or usable in Exchange Online as part of Microsoft's efforts to streamline and secure permissions.

Quest ODM is unaffected by the retirement of the Application Impersonation role.

1. Permissions Used by ODM:

   • ODM does not directly rely on the Application Impersonation role.
   • Instead, it uses the full_access_as_app permission, which provides application-level access to all mailboxes within a customer’s organization.

2. Support from Microsoft:

   • The full_access_as_app permission is supported through Microsoft’s Application Access Policy for Exchange Web Services (EWS).
   • During account discovery, ODM assigns its application service principal to the built-in Entra role of Exchange Administrator, equivalent to ExchangeServiceAdmins in Exchange.

3. Testing and Validation:

   • Internal testing has confirmed that ODM’s functionality is unaffected by the removal of the Application Impersonation role.
   • Group mailbox migrations and other related processes work seamlessly without requiring this role.

Customers can proceed with their migration projects without the need for any changes related to the retirement of this role.

For the official announcement from Microsoft regarding the retirement of the Application Impersonation role, refer to their blog post: https://techcommunity.microsoft.com/blog/exchange/critical-update-applicationimpersonation-rbac-role-deprecation-in-exchange-onlin/4295762 If further updates or changes arise, Quest will communicate them promptly via Alerts & Notifications: https://support.quest.com/on-demand-migration/all/alerts-notifications