Mailboxes fail to migrate or back up due to lack of impersonation rights
When you are migrating mailboxes or running data backup or restore jobs by using CodeTwo software, you get the Failed mailbox message on the Bad news card with the following information:
The account does not have permission to impersonate the requested user.
This issue can be related to:
- EWS throttling in Exchange
- insufficient impersonation permissions
- inactive mailboxes on the target server.
One quick way to determine which solution works best for you is to create a new migration or backup/restore job for a single mailbox. Make sure to use the same settings as in the job that causes problems. In addition, the mailbox used in the new job needs to be one of those that failed to be migrated/backed up/restored previously. Once you run the new job and the mailbox is successfully migrated to the target server, backed up or restored, there is a high probability that the problem described in this article is caused by EWS throttling.
The limits set in the Exchange throttling policy, both in Exchange Online and on-premises Exchange server, may result in problems when too many mailboxes are being migrated concurrently. To fix that, you can try changing or disabling the limits in the throttling policy by following the steps outlined in this article.
If you are using CodeTwo migration software and the above solution doesn't work for you, reducing the number of simultaneously migrated mailboxes can also prevent throttling. The migration concurrency can be adjusted in CodeTwo software by using the Advanced settings step, accessed by editing a migration job. The default value set in the program is 5 mailboxes, so you can try to decrease it even further, e.g. to 2. On the other hand, if you have already changed this value to a higher one, for example 20, try changing it back to the default value. For more information on how this setting works, refer to the user’s manual.
To change this setting for your current migration job:
- Go to the Jobs tab.
- Select your migration job and click Edit (Fig. 1.). If it’s active, you need to stop it first.
- Go to the Advanced settings step.
- Change the value in Set the number of mailboxes that can be migrated at the same time to to a lower number, as explained earlier (Fig. 2.).
- Click Finish to save your changes.
You can now restart the migration job and see if the mailboxes in question are migrated without any issues.
If after decreasing the migration concurrency value you have noticed that the migration runs very slow, you might try increasing it again one by one, until the mailboxes start failing again. That way you can find the optimum setting for your server.
The admin account used in your CodeTwo migration or backup software may be lacking some impersonation permissions required to access other users' mailboxes. You can either set the required impersonation rights manually to that account (refer to this article to learn how to do so) or create a new account and let the program assign all the necessary roles to that account automatically. Whichever option you choose, use this account to reconfigure the connection used in your migration/backup/restore job that causes the problem. The links below will lead you to the relevant article on how to reconfigure a server connection in:
Once the reconfiguration is done, restart your migration/backup/restore job.
In some cases, mailboxes created on the target server are not fully active until their users sign in to Office 365 and set display language and time region of the mailbox in Outlook on the web (OWA) (Fig. 3.). In addition, you should also send a test email from the newly created mailbox.
After completing these steps, try running your migration/backup/restore job once again.
- How the Exchange throttling policy impacts CodeTwo software
- Create an RBAC-compliant account for CodeTwo Software
- How to manually assign management roles