Chat now with support
Chat with Support

Migrator for Notes 20.14.2 - User Guide for Office 365

Section 1. Introduction Section 2. Pre-migration Activities Section 3. User Provisioning Section 4. Email Repliability Section 5. Migrating Mail Files Section 6. Rooms and Resources Database Migration Section 7. Mail-in Database Migration Section 8. Setting Migration Status Section 9. Access and Delegation Migration Section 10. All Accounts Section 11. Customer Status Reports Section 12. Logs About us Technical support resources Appendix A: Staging Replicas Appendix B: Pre-Migration Troubleshooting Appendix C: Work with Files (Import/Export) Appendix D: Item Processing Results Appendix E: Migration Result Statuses Appendix F: Recovery Process Appendix G: Automatic Migration Restart Appendix H: Folder Processing Order

Section 9. Access and Delegation Migration

9.1 Access and Delegation Migration Overview

Delegation migration migrates access to Exchange mailboxes, such as Send As/Manager access and access to specific folders like Calendars and Contacts. Delegation migration attempts to set access control on objects in Exchange based on the Access Control List (ACL) in Notes which dictates overall access to the Exchange mailbox. The delegation migration can be run by a scheduled process or manually on selected documents.

The following is required for delegation migration:

  • Address translation must be fully populated. The SMTP address must match the primary SMTP in Exchange

  • PowerShell 5 must be installed on the workstation/server that the migration process is to run from

  • The Administration account for the CAS Server has the ApplicationImpersonation role in the domain

  • The EWS Application ID in Azure AD must have been set up and configured on the Settings document.

  • Exchange delegates must have domain accounts and be mailbox-enabled

 

  • Delegation migration to Mail-in databases are treated like other mail files

  • The access control for Rooms and Resources is not included in delegation migration

  • Automatic Forwarding settings in the Notes client are not migrated

  • For ACL Groups permissions migrations, Notes groups must migrate to a security mail-enabled group in Exchange and have an Internet Address assigned or be converted to Multi-Purpose groups

  • In hybrid Exchange installations, with both Office 365 and on-prem Exchange servers:

  • Delegation access can only be set for users on the same system; Office 365 users can set delegation access to the mailbox to other Office 365 users, but not to Exchange users; Exchange users can set delegation access to other Exchange accounts, but not to Office 365 users; Access delegation is not supported between Exchange on-prem users and Office 365 accounts

  • You must set application impersonation in each domain (once for the on-prem Exchange servers, and once in the Office 365 tenant); Impersonation in the on-prem servers does not automatically propagate to Office 365 because they are separate domains and AD object

 

Delegation also allows you to audit the user's mail files for database ACL and delegation data and send an email containing the user's current delegation settings, so the user can determine if the settings are valid for migration to Outlook.

9.1 Access and Delegation Migration Overview

Delegation migration migrates access to Exchange mailboxes, such as Send As/Manager access and access to specific folders like Calendars and Contacts. Delegation migration attempts to set access control on objects in Exchange based on the Access Control List (ACL) in Notes which dictates overall access to the Exchange mailbox. The delegation migration can be run by a scheduled process or manually on selected documents.

The following is required for delegation migration:

  • Address translation must be fully populated. The SMTP address must match the primary SMTP in Exchange

  • PowerShell 5 must be installed on the workstation/server that the migration process is to run from

  • The Administration account for the CAS Server has the ApplicationImpersonation role in the domain

  • The EWS Application ID in Azure AD must have been set up and configured on the Settings document.

  • Exchange delegates must have domain accounts and be mailbox-enabled

 

  • Delegation migration to Mail-in databases are treated like other mail files

  • The access control for Rooms and Resources is not included in delegation migration

  • Automatic Forwarding settings in the Notes client are not migrated

  • For ACL Groups permissions migrations, Notes groups must migrate to a security mail-enabled group in Exchange and have an Internet Address assigned or be converted to Multi-Purpose groups

  • In hybrid Exchange installations, with both Office 365 and on-prem Exchange servers:

  • Delegation access can only be set for users on the same system; Office 365 users can set delegation access to the mailbox to other Office 365 users, but not to Exchange users; Exchange users can set delegation access to other Exchange accounts, but not to Office 365 users; Access delegation is not supported between Exchange on-prem users and Office 365 accounts

  • You must set application impersonation in each domain (once for the on-prem Exchange servers, and once in the Office 365 tenant); Impersonation in the on-prem servers does not automatically propagate to Office 365 because they are separate domains and AD object

 

Delegation also allows you to audit the user's mail files for database ACL and delegation data and send an email containing the user's current delegation settings, so the user can determine if the settings are valid for migration to Outlook.

9.2 Migrate Delegation – Scheduled

The scheduled delegation migration and the scheduled delegation migration agent must be enabled in the Delegation settings. When enabled, the agent will attempt to migrate delegation data for all mailboxes that have been successfully migrated to an Exchange Server since the last delegation migration.

Scheduled delegation migration runs in the background locally in HCL Notes on a workstation. This requires a local replica of the Notes Migrator.nsf from the Domino server on the workstation and Notes must be running and background agents must be enabled on the client and background replication for the local replica.

When enabled the scheduled delegation migration agent runs once a day at 3:00 AM.  Note that if the agent is changed to run at a time interval that is too short, the PowerShell tasks may not have time to complete.

The status of the delegation migration can be viewed on the Delegation Migration view:

Delegation Migration View

The status for delegation migration can be successful, incomplete (partially migrated), or a failure. If the status is either incomplete or failed, the delegation migration will be retried until it reaches the successful status, or until the retry limit is exceeded. If the retry limit is exceeded, it will go in to suspended status, where it can be reset and re-queued for background processing.

The failure or incomplete status will occur if one or more delegates does not exist, because either the delegate does not exist as a mailbox-enabled AD account or security enabled group in the target domain.  


Failed scheduled delegation migrations will continue to be retried until successful or until the schedule migration is suspended.

For user delegation this will only be applied once the account that is a delegate has a mailbox. Not all delegation is expected to complete successfully until all Notes accounts are migrated.

It is recommended to schedule migrations for users and delegates who require access to email or calendar data in the same migration batch.

9.3 Enable and Suspend Scheduled Migration

Enable and suspend scheduled migration options are available under the Optional Actions button:

Select one or more mailboxes and click Optional Actions | Suspend scheduled migration to stop the scheduled delegation migration

Select one or more mailboxes and click Optional Actions | Enable scheduled migration to set the scheduled delegation migration attempts; you may want to use this option after attempting a manual delegation migration

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating