This is an archive version of the document. To get the most up-to-date information, see the current version.Microsoft Exchange Organizations
The following table lists required roles that must be assigned to the account that you want to use to add Microsoft Exchange organizations. The table lists roles required by Veeam Backup for Microsoft Office 365 when you add organizations using modern authentication with legacy authentication protocols or basic authentication.
Consider the following:
- The account you are using to add an organization must be a member of this organization.
- The account you are using to add an organization is not required to have a mailbox in such an organization.
Role | Description |
|---|---|
Role Management | Required to grant the ApplicationImpersonation role. |
ApplicationImpersonation | Required to back up Exchange data. |
Organization Configuration | Required to manage role assignments. |
View-Only Configuration | Required to obtain necessary configuration parameters. |
View-Only Recipients | Required to view mailbox recipients. |
Mailbox Search or Mail Recipients | Required to back up groups. |
Reviewer or Owner | Required to use impersonation to backup/restore public folders under the Default user. |
Granting ApplicationImpersonation via PowerShell
For On-Premises Microsoft Exchange Organizations
To grant the ApplicationImpersonation role for on-premises Microsoft Exchange organizations, do the following:
- Connect to the Exchange server, as described in this Microsoft article.
- Run the following cmdlet to grant the role.
New-ManagementRoleAssignment –Role ApplicationImpersonation –User "Administrator" |
For Microsoft Office 365 Exchange Organizations
To grant the ApplicationImpersonation role for Microsoft Office 365 Exchange organizations, do the following:
- Connect to the Exchange server:
- For Basic Authentication, see this Microsoft article.
- For Modern Authentication, see this Microsoft article.
- Run the following cmdlet to grant the role.
New-ManagementRoleAssignment –Role ApplicationImpersonation –User user.name@domain.com |
To obtain the list of users whom the ApplicationImpersonation role has already been granted, use the following cmdlet (for both on-premises and Online organizations).
Get-ManagementRoleAssignment -Role "ApplicationImpersonation" |
To remove the role, use the following cmdlet (for both on-premises and Online organizations).
Get-ManagementRoleAssignment -RoleAssignee "Administrator" -Role ApplicationImpersonation -RoleAssigneeType user | Remove-ManagementRoleAssignment |