When you or your Exchanger server administrator assigns the ApplicationImpersonation role, use the following parameters of the New-ManagementRoleAssignment cmdlet:
- Name – The friendly name of the role assignment. Each time that you assign a role, an entry is made in the RBAC roles list. You can verify role assignments by using the Get-ManagementRoleAssignment cmdlet.
- Role – The RBAC role to assign. When you set up impersonation, you assign the ApplicationImpersonation role.
- User – The service account.
- CustomRecipientScope – The scope of users that the service account can impersonate. The service account will only be allowed to impersonate other users within the specified scope. If no scope is specified, the service account is granted the ApplicationImpersonation role over all users in an organization. You can create custom management scopes by using the New-ManagementScope cmdlet.
Before you can configure impersonation, you need:
- Administrative credentials for the Exchange server.
- Domain Administrator credentials, or other credentials with the permission to create and assign roles and scopes.
- Exchange management tools. These are installed on the computer from which you will run the commands.
To configure impersonation for all users in an organization
-
Open the Exchange Management Shell. From the Start menu, choose All Programs > Microsoft Exchange Server 2013.
-
Run the New-ManagementRoleAssignment cmdlet to add the impersonation permission to the specified user. The following example shows how to configure impersonation to enable a service account to impersonate all other users in an organization.