Forum Discussion
Bare-minimum rights for Office 365 Migration Account
Hi everyone,
We have an account (Office 365 Migration User) which is used by Exchange and Exchange Online to do mailbox migrations. However this account seems to have every admin permission in existence--which seems to be a bit much for what it does.
Can you please advise and determine exactly what level of permissions this account should have? Do I have any clarifications may need for each group members? To reduce as much as possible this user's rights to.
Get-ADPrincipalGroupMembership -Identity O365MigUser | select Name
Name
----
Domain Users
Exchange Servers
Exchange Organization Administrators
Exchange Public Folder Administrators
Exchange Recipient Administrators
Exchange View-Only Administrators
Exchange Trusted Subsystem
Exchange All Hosted Organizations
Exchange Windows Permissions
Migration Admin
Domain Admins
Enterprise Admins
Exchange Domain Servers
Exchange Admins
Exchange Install Domain Servers
Exchange Services
Exchange Enterprise Servers
CSUserAdministrator
HungNguyen142112 Here is the article that lists the permissions required for least privileges: https://docs.microsoft.com/en-us/Exchange/permissions/feature-permissions/recipient-permissions?redirectedfrom=MSDN&view=exchserver-2019#mailbox-move-and-migration-permissions
thank you - Joe Stocker
But can you please advise more details about that, we saw many reference link inside this article and would not find my answer herein, unfortunately.
HungNguyen142112 see attached detailed instructions for creating least privilege migration accounts
