Troubleshooting ApplicationImpersonation role assignment

When configuring the connection to a source on-premises Exchange server, the connection wizard checks if the provided admin account is assigned the ApplicationImpersonation role. If the role is missing, the Configuration step fails (Fig. 1.), as the program is not able to access user mailboxes. You also get the following error:

Role 'ApplicationImpersonation' is not assigned to admin account

Fig. 1. The error displayed when your admin account is not assigned the required management role.

To continue with the configuration, the program will attempt to assign the ApplicationImpersonation role automatically (Fig. 2.), as well as other missing roles. Click Yes to proceed.

Fig. 2. Automatically assigning the missing management roles.

If the program is unable to assign the missing roles, it means that the provided account doesn't have appropriate rights to do so. You will be asked to enter credentials of an admin user who is a member of the Organization Management role group (Fig. 3.). If you are certain that this account belongs to that group, make sure that you typed the credentials correctly.

Fig. 3.  Providing credentials of an account that is a member of
the Organization Management role group.

Enter the UPN manually or click Browse to choose another account from the same domain. Provide a valid password and click OK. The missing roles will be assigned, and the Configuration step will finish successfully. 

If you don't want the program to assign any roles automatically, you can do it manually, following the steps described in this KB article.