Menu

Database Backup

Granting Impersonation Rights

Global administrators must have appropriate impersonation rights to backup and restore Office 365 exchange mailboxes.

You can assign impersonation rights from:
Assign Exchange impersonation rights for Office 365 Exchange Global administrator from Office 365 Exchange Admin:

To assign impersonation rights,

  1. Login to https://portal.office.com as Admin.
  2. Click and go to 'Admin’.
  3. Click 'Admin centers’ in the left navigation bar, and then click 'Exchange’.
  4. In the 'Exchange admin center' page, click 'Admin Roles' under 'Permissions'.
  5. To add a new role, click .
  6. Enter the name as 'Impersonationbackup' in the 'new role group' window.
  7. To add a role, click under 'Roles'.
  8. Select 'ApplicationImpersonation', and click 'add'. Click 'OK'.
  9. Click under 'Members' to add a new member to the role group.
  10. Select your admin account, and click 'add'. Click 'OK'.
  11. Click 'Save'.

Note: Along with impersonation rights, we recommend that you assign global administrators with discovery management rights. For information on assigning discovery management rights, refer discovery management FAQs.


Assign Exchange impersonation rights for Office 365 Exchange Global administrator from Windows Powershell:

Before granting impersonation rights, you must first connect to the Office 365 exchange server.

To assign impersonation rights,

  1. In the Administrator privilege mode, open ‘Windows Powershell’.
  2. Change the execution policy to remote-signed by executing the following command,:
    C:\Windows\system32> Set-ExecutionPolicy RemoteSigned
  3. Connect to exchange online server by executing the following command:

    C:\Windows\system32>$O365Cred = Get-Credential

    Note: Assign global administrator login credentials to a variable to ensure that the credentials are included in the connection command.

  4. Create a PSSession to Office 365 by executing the following command:

    C:\Windows\system32> $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $O365cred -Authentication Basic -AllowRedirection

  5. To import PSSession execute the following commands:

    C:\Windows\system32> Import-PSSession $Session

    C:\Windows\system32> Enable-OrganizationCustomization

  6. Assign the exchange impersonation rights to a global administrator, in the following format:
    New-ManagementRoleAssignment –Name: –Role:ApplicationImpersonation –User:

    For Example:

    C:\Windows\system32> New-ManagementRoleAssignment –Name:backupimpersonation –Role:ApplicationImpersonation –User: "admin@domain.com"
  7. Assign discovery management rights in the following format:

    Add-RoleGroupMember -Identity "Discovery Management" -Member "Shane@domain.com"

The overall command format is as follows:

PS C:\Windows\system32> Set-ExecutionPolicy RemoteSigned

PS C:\Windows\system32> $O365Cred = Get-Credential

PS C:\Windows\system32> $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $O365cred -Authentication Basic -AllowRedirection

PS C:\Windows\system32> Import-PSSession $Session

PS C:\Windows\system32> Enable-OrganizationCustomization

PS C:\Windows\system32> New-ManagementRoleAssignment –Name:backupimpersonation –Role:ApplicationImpersonation –User: "admin@domain.com"

PS C:\Windows\system32>Add-RoleGroupMember -Identity "Discovery Management" -Member "Shane@domain.com"