MigrationWiz - Credentials & Authentication - FAQ

This article provides instructions for testing mailbox access, verifying credentials, and requesting credentials, and answers common questions about credentials and authentication.

Credentials
MigrationWiz will accept two forms of credentials, which are outlined below.

Administrative Credentials: You can configure a single set of administrative credentials to access all mailboxes. This is configured on the mailbox connector.
End User Credentials:​ We accept end user credentials to be configured on each individual mailbox configuration. See below for steps to request end user credentials.
Testing Mailbox Access for Migration
Note: In addition to all the specific steps detailed below, Microsoft provides a very useful tool too: Microsoft Remote Connectivity Tool.

Exchange Server 2003
To test mailbox access on the Exchange Server 2003, perform the following:

Open the browser to https://mail.example.com/exchange
Ideally, we recommend opening this URL from a non-domain-joined machine on a different network than the Exchange Server.
example.com is the DNS name of the OWA server.
When prompted for credentials, enter the username and password of the account to be used to access the mailbox.
This can be either the credentials of the end user mailbox itself or administrative credentials.
To migrate using administrative credentials, enter administrative credentials into OWA.
The Inbox of the end user's mailbox or administrator's mailbox should be visible once logged in.
If using administrative credentials, change the URL to https://mail.example.com/exchange/[e-mail]
[e-mail] is the primary SMTP address of the mailbox being accessed.
The result is that the Inbox of the mailbox [e-mail] should be visible.
Ex​change Server 2007+
​To test mailbox access on Exchange Server 2007+, perform the following:

Open the browser to https://mail.example.com/owa
Ideally, we recommend opening this URL from a non-domain-joined machine on a different network than the Exchange Server.
​mail.example.com is the DNS name of the OWA server.
When prompted for credentials, enter the username and password of the account to be used to access the mailbox.
This can be either the credentials of the end user mailbox itself or administrative credentials.
If you want to migrate using administrative credentials, enter administrative credentials into OWA.
The Inbox of the end user's mailbox or administrator's mailbox should be visible once logged in.
If using administrative credentials, confirm that they have sufficient permissions to log in to the end users' mailboxes:
Click on the name in the top right corner.
Click on Open mailbox.
Enter the primary SMTP address of the mailbox being accessed.
Click on Open.
Make sure it is possible to view the Inbox of the end user's mailbox.
If it fails:
Make sure the email address is resolved to an end user by clicking on the Check Names button when composing a new message.
Grant permissions to the ​​​​​administrative account​
​Microsoft Office 365
To test mailbox access on Microsoft Office 365, perform the following:

Open the browser to https://portal.microsoftonline.com​.
When prompted for credentials, enter the username and password of the account to be used to access the mailbox.
This can be either the credentials of the end user mailbox itself or administrative credentials.
To migrate using administrative credentials, enter administrative credentials into OWA.
The result is a successful login to the Office 365 portal.
Click on the Outlook link at the top right of the page.
The Inbox should be visible.
If using administrative​​ credentials, change the URL so that it looks like the following https://mail.office365.com/owa/[e-mail]
Only change the portion of the URL after the OWA virtual directory by replacing it with the primary SMTP address of the mailbox.
[e-mail] is the primary SMTP address of the mailbox being accessed.
The Inbox of the mailbox [e-mail] should be visible​​​.
Microsoft Live@Edu
To test mailbox access to Microsoft Live@Edu, perform the following:

Open the browser to https://outlook.com/example.com where example.com is your domain.
When prompted for credentials, enter the username and password of the account to be accessed.
This can be either the credentials of the mailbox itself or administrative credentials.
To migrate using administrative credentials, enter administrative credentials into OWA.
The Inbox should be visible.
Change the URL so that it looks like the following https://mail.office365.com/owa/[e-mail]
Only change the portion of the URL after the OWA virtual directory by replacing it with the primary SMTP address of the mailbox.
[e-mail] is the primary SMTP address of the mailbox being accessed.
The Inbox of the mailbox [e-mail] should be visible​.
IMAP Server​​
Please use this third-party tool to test the IMAP mailbox credentials: https://pingability.com/mailtest.jsp.

Verifying Credentials
You may verify the credentials of items in MigrationWiz without migrating data or consuming any licenses.

​Sign in to your MigrationWiz account​.
Open the Project containing items you wish to validate​.
Select the items you wish to validate.
Click on the Start button in your dashboard.
Select Verify Credentials from the drop-down list.
Once complete, the results of the verification will be shown in the Status section.​

Running a Migration without Administrative Access
There are two ways to set up a migration in cases where you either do not have an administrator account to use or the environment does not support an administrator account. Both options are listed below with links to the steps to use for a migration project.

Automatically requesting user credentials
This option allows you to set up the project and tell MigrationWiz that you do not know the username or passwords for the users. MigrationWiz will then send an email to each user in the project with a link to grant access.

Requesting Credentials
Sign in to your MigrationWiz account.
Open your Project to see its items.
Click on the name of the mailbox you wish to request credentials for.
Click on the Edit Item icon (this is the pencil icon on the far right).
Select I don't know the username or password for the Source or Destination.
Click on Save Item.
If you need to re-request credentials and don’t know the password, follow the steps above.

If you do know the password, follow steps 1-4, then Uncheck “I don’t know the username or password to this mailbox” and enter the username and password.

Bulk Access Request
Sign in to your MigrationWiz account.
Create a MigrationWiz mailbox migration project. When entering the Source information, do not click on the checkbox to enter admin credentials.
Click on the green bar for Bulk Add.
Click on the checkbox labeled I don't know the login name and password for the Source mailboxes.
Click on the Upload
Click on the Choose File Select and upload your CSV file that contains the list of mailbox names.
Click on the Save
After following the steps above, submit the migration. MigrationWiz will perform the following steps automatically.

You submit the item for migration.
Email is sent to the email address configured with a secure link to provide the credentials.
The end user clicks on the provided link, which opens a secure web page.
The end user provides their credentials directly to our system.
The credentials are verified.
The item is immediately submitted for migration.
The status of the migration will remain as "Waiting for End User" until the end user provides their credentials to the system.

Notes:

You cannot directly delete the mailbox from your dashboard while it is in the "Waiting for End User" state. If you want to delete the mailbox, you need to select the mailbox(by clicking on the checkbox next to the username), and then click on the Stop button at the top of your dashboard. This will restore the mailbox license to your account. You can then delete the mailbox in the normal manner (by clicking on the checkbox next to the username and then clicking on the Delete Items icon at the top of your dashboard).
Unfortunately, due to changes in the Google Security policy, migrating any Google free accounts is not supported.
To Resubmit Credentials
If the user enters​ the password incorrectly, the link will no longer be available for them to enter their password again.

To send another email to the user, you will need to:

Go back to MigrationWiz.
Select the user.
At the top of the dashboard, select Clear Credentials.
Authenticate again.
Manually entering user credentials
This option is to manually enter the user credentials. The easiest way to do this is to use the Bulk Add option for adding users to your project. It is also possible to edit each user to add user logins and passwords individually. This option does require you to either gather the passwords from users or reset the user mailboxes to something that you know and control.

To use the Bulk Add option, see How do I import mailboxes into the system without entering them one at a time?

Note: The only columns required in the Bulk Add CSV are the Source Email and Destination Email. For adding user credentials, you will only need to include the Login Name and Password for the environment that you will not be using an administrator account for. This may be just the Source or just the destination, or both.

To add user logins and passwords individually follow these steps:

Open your Project to see the list of items to be migrated.
For each account that you wish to edit, click on the Edit Items button (the pencil icon on the far-right side of the screen).
Add the user login and password for the environments that need them. This may be the Source or the Destination or both.
Click on Save Items.

Removing Administrative Access After Migration
To automatically remove administrative access after migration is complete, perform these steps (no licenses will be used):

Edit your Project and click on Advanced Options.
Click on Show Advanced Options.
In Support Only Options, set RevokeAdminPermissions=1.
Select mailboxes from which you want to revoke permissions.
Click on Start.
Select Verify Credentials.
Click on Start.
Note: Do not remove the permissions until the migration is complete. If this is done during the migration process, the migration will fail and not all items will be migrated over to the new mailbox.

Two-Factor & Multifactor Authentication
MigrationWiz will not work directly with any account that is set up to use two-factor or multi-factor authentication. However, a workaround for migration is to migrate using an admin account that is set up without the extra authentication requirements.

When creating your MigrationWiz Mailbox project, enter the credentials for this admin account under Use Administrator Login.
This account needs to be set up with full access permissions to each mailbox.
Add your user mailboxes in the normal manner.

Note: DeploymentPro will not work when two-factor or multi-factor authentication is in place. We advise disabling two-factor or multi-factor authentication during profile configuration. Once complete, it could be re-enabled, but users would then have to provide the application password before they could connect via their Outlook profiles. Different Outlook versions have different processes to follow for this. Refer to Microsoft TechNet articles for more information.​

How do I create an administrator account for login?
This article provides detailed steps to create an administrator account for the services listed below. Click a link to jump to the steps for that service.

Exchange 2003
Exchange 2007
Exchange 2010
Exchange 2013 and Exchange 2016
Office 365
Live@Edu
Zimbra
Notes:

Any user account that is a part of the domain administrator, schema administrator, or enterprise administrator groups will not have any administrative rights to mailboxes no matter how many permissions are granted. A security default of Exchange Server is to explicitly deny any user that is a member of these groups. This is why we recommend creating a new user account specific for migration. Note: This does not apply to Exchange Online (Office 365).
If the Hosted Exchange provider does not provide administrative credentials, or rather the admin account does not have sufficient permissions to log in to user mailboxes, click here.
Once this administrator account has been created, then you can test access to the mailboxes by following the steps in KB004616.

Exchange 2003
To create an account, perform the following from the Exchange Server 2003 machine:

Open the Active Directory Users and Computers snap-in.
Navigate to the organizational unit (OU) in which the administrative account will be created.
Right-click on the OU and select New > User.
Enter "MigrationWiz" as the first name.
Enter "MigrationWiz" as the user login name, and optionally select a user principal name (UPN) domain.
Click Next.
Enter a password and confirm the password.
Uncheck User must change password at next login.
Click Next.
Click Next to assign a mailbox.
Click Finish.
Right-click on the MigrationWiz user in the Active Directory Users and Computers snap-in, and select Properties.
Click on the Exchange Advanced tab.
Click Hide from Exchange address lists.
Click OK.
To grant the account access, perform the following from the Exchange Server 2003 machine:

Open the Exchange System Manager snap-in.
Expand the Servers node.
Note: In some Exchange System Manager consoles, the Servers node may be under Administrative Groups.
Right-click on the server that administrative access will be granted access to, and select Properties.
Click on the Security tab.
Click on Add.
Enter "MigrationWiz".
Click on OK.
Ensure Allow Send As is selected.
Ensure Allow Receive As is selected.
Click on OK.
Repeat from Step 3 until permissions have been set on each mailbox server (if there is more than one).

Exchange 2007
Note: If the Hosted Exchange provider does not provide administrative credentials, or rather the admin account does not have sufficient permissions to log in to user mailboxes, click here.

To create an account, perform the following from the Exchange Server 2007 machine:

Open the Exchange Management Console.
Expand Recipient Configuration node.
Right click on Mailbox node.
Click New Mailbox.
Click Next.
Click Next again.
Enter "MigrationWiz" as the first name.
Enter "MigrationWiz" as the user login name and optionally select a user principal name (UPN) domain.
Enter a password and confirm the password.
Click Next.
Click Browse to select a Mailbox database.
Click Next.
Click New.
Click Finish.
To grant the account access, perform the following from the Exchange Server 2007 machine:

Open the Exchange Management Shell.
Enter the following command:
Get-Mailbox -server <server> -ResultSize Unlimited | Add-MailboxPermission -AccessRights FullAccess -User MigrationWiz

Notes:

The command needs to be applied each time a new mailbox is created since permissions are set directly on each mailbox. The administrative account will not have access until the permissions are applied.
In the script above, the username "MigrationWiz" should be replaced with the name of the administrative account that was set up by following the instructions in this article.
This username is the Administrative Username that needs to be entered under the project's Source or Destination settings, within MigrationWiz, when checking the box labeled Use Administrative Login.
Any user account that is a part of the domain administrator, schema administrator, or enterprise administrator groups will not have any administrative rights to mailboxes, no matter how many permissions are granted. A security default of Exchange Server is to explicitly deny any user that is a member of these groups. This is why we recommend creating a new user account specific for migration.

Exchange 2010
Note: If your Hosted Exchange provider does not provide administrative credentials, or rather if the admin account does not have sufficient permissions to log in to user mailboxes, click here.

To create an account, perform the following from the Exchange Server 2010 machine:

Open the Exchange Management Console.
Expand Recipient Configuration node.
Right-click on the Mailbox node.
Click New Mailbox.
ClickNext.
Click Next again.
Enter "MigrationWiz" as the first name.
Enter "MigrationWiz" as the user login name and optionally select a user principal name (UPN) domain.
Enter a password and confirm the password.
Click Next.
Click Browse to select a Mailbox database.
Click Next.
Click New.
Click Finish.
To grant the account access, perform the following from the Exchange Server 2010 machine:

Open the Exchange Management Shell.
Enter the following command:
Get-Mailbox -ResultSize Unlimited | Add-MailboxPermission -AccessRights FullAccess -User MigrationWiz

Notes:

The command needs to be applied each time a new mailbox is created since permissions are set directly on each mailbox. The administrative account will not have access until the permissions are applied.
In the script above, the username "MigrationWiz" should be replaced with the name of the administrative account that was set up by following the instructions in this article.
This username is the Administrative Username that needs to be entered under the project's Source or Destination settings, within MigrationWiz, when checking the box labeled Use Administrative Login.
Any user account that is a part of the domain administrator, schema administrator, or enterprise administrator groups will not have any administrative rights to mailboxes, no matter how many permissions are granted. A security default of Exchange Server is to explicitly deny any user that is a member of these group. This is why we recommend creating a new user account specific for migration.

Exchange 2013 or 2016
Note: If the hosted Exchange provider does not provide administrative credentials, or rather the admin account does not have sufficient permissions to log in to user mailboxes, click here.

First, create an account and attach a mailbox for it in Exchange 2013 or 2016 Server.

To grant the account access, perform the following from the Exchange Server 2013 or 2016 machine:

Open the Exchange Management Shell.
Enter the following command:
Get-Mailbox -ResultSize Unlimited | Add-MailboxPermission -AccessRights FullAccess -User MigrationWiz

Notes:

The command needs to be applied each time a new mailbox is created since permissions are set directly on each mailbox. The administrative account will not have access until the permissions are applied.
In the above script, the username "MigrationWiz" should be replaced with the name of the administrative account that was set up, by following the instructions in this article.
This username is the Administrative Username that needs to be entered under the project's Source or Destination settings, within MigrationWiz, when checking the box labeled Use Administrative Login.
Any user account that is a part of the domain administrator, schema administrator, or enterprise administrator groups will not have any administrative rights to mailboxes, no matter how many permissions are granted. A security default of Exchange Server is to explicitly deny any user that is a member of these groups. This is why we recommend creating a new user account specific for migration.

Office 365
In order to have administrative permissions to migrate mailbox data, grant the account permissions on each mailbox.

Notes:

Having administrative access to the Microsoft Office 365 control panel to manage users does not mean the same account has permissions to access all mailboxes for migration.
Having delegated admin access to accounts does not provide enough access.
To manually grant administrative access for migration, execute the following remote PowerShell commands:

$cred = Get-Credential

$session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $cred -Authentication Basic -AllowRedirection

Import-PSSession $session

Get-Mailbox -ResultSize Unlimited | Add-MailboxPermission -AccessRights FullAccess -Automapping $false -User MigrationWiz

Remove-PSSession $session

Notes:

The command needs to be applied each time a new mailbox is created since permissions are set directly on each mailbox. The administrative account will not have access until the permissions are applied.
In the script above, the username "MigrationWiz" should be replaced with the name of the administrative account that was set up, by following the instructions in this Knowledge Base article.
This username is the Administrative Username that needs to be entered under the project's Source or Destination settings, within MigrationWiz, when checking the box labeled Use Administrative Login.
It is also possible to use impersonation for large-scale migrations.

Live@Edu
Having administrative access to the Live@Edu control panel to manage users does not mean the same account has permissions to access all mailboxes for migration. In order to have administrative permissions to migrate mailbox data, grant the account permissions on each mailbox.

To manually grant administrative access for migration, execute the following remote PowerShell commands:

$cred = Get-Credential

$session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $cred -Authentication Basic -AllowRedirection

Import-PSSession $session

Get-Mailbox -ResultSize Unlimited | Add-MailboxPermission -AccessRights FullAccess -User MigrationWiz

Remove-PSSession $session

Notes:

The command needs to be applied each time a new mailbox is created since permissions are set directly on each mailbox. The administrative account will not have access until the permissions are applied.
In the script above, the username "MigrationWiz" should be replaced with the name of the administrative account that was set up by following the above instructions in this article.
This username is the Administrative Username that needs to be entered under the project's Source or Destination settings, within MigrationWiz, when checking the box labeled Use Administrative Login.
Any user account that is a part of the domain administrator, schema administrator, or enterprise administrator groups will not have any administrative rights to mailboxes no matter how many permissions are granted. A security default of Exchange Server is to explicitly deny any user that is a member of these groups. This is why we recommend creating a new user account specific for migration.
Note that the command above needs to be applied each time a new mailbox is created, as permissions are set directly on the mailbox. The administrative account will not have access until the permissions are applied.

Zimbra
Zimbra installation comes with an administrator account, which is [e-mail].

To create an extra one, or to turn an existing account into an administrator, follow the instructions here:

https://wiki.zimbra.com/wiki/How_To_Create_an_Admin_Account