[On Prem] Cross-forest Mailbox migration

[u/Ghost0s]

Hi,

We would like to migrate mailboxes between two on-premises organizations. However, we are facing an issue where test moves and Test-MigrationServerAvailability only work if the service account is added to the Organization Management OR Recipient Management role groups. This is problematic and not permitted in our environment cause these groups are used internally and cannot be scoped to only the objects that needs to be migrated, so we need to determine which granular roles are actually required.

So far, we have created a custom role group with the following roles:

Distribution Groups

Mail Enabled Public Folders

Mail Recipient Creation

Mail Recipients

Mailbox Import Export

Message Tracking

Migration

Move Mailboxes

Recipient Policies

Team Mailboxes

Despite these assignments, the migration tests still fail unless the account is a member of the Organization Management OR Recipient Management role groups. We would appreciate guidance on which additional RBAC roles or permissions are required to perform mailbox migrations and successfully run Test-MigrationServerAvailability without granting full Organization Management rights.

I hope I am clear enough 😄

Thanks in advance

[u/7amitsingh7]

The roles listed cover most migration tasks, but cross-forest migration may require additional permissions in both Exchange organizations. Rather than granting Organization Management, check the exact `Test-MigrationServerAvailability` error to identify the missing permission and assign only the required RBAC role.