Exchange Migration Knowledge BaseCategory: Mailbox Migration QuestionsAre delegate permissions migrated during a dry-run?
Anonymous asked 10 years ago

We are using the dry-run feature of the Priasoft migration tools to test various aspects of the migration effort, however it seems that none of the delegate permissions are actually being migrated.  Is this to be expected?

1 Answers
Eriq VanBibber Staff answered 10 years ago

The simple answer to this question is NO. For clarity however, the migrator does not migrate delegate information due to the fact that there is likely no matching objects in the target with which to match up with source permissions.  The delegate migration tasks for folder and send-on-behalf-of delegates rely on the ability to discover delegates in the target mail system.  When performing a dry-run, the mailboxes that are migrated are processed such that the target mailboxes are isolated from the environment.  This isolation is created by doing several actions on the target mailbox: Hide mailbox from address list Adjust all email addresses so that they are not usable Set a block for MAPI and OWA access to the mailbox The delegate resolver tool (which handles folder and send-on-behalf-of delegates) has to do a search for each cached delegate in the target system to see if it can restore it.  Since a dry-run pass is modifying values that for which the delegate resolver would normally search, the permission restore is ignored. Furthermore, since a dry-run migration, by design, is supposed to NOT cause any interference with an existing environment (source or target), we felt that applying permissions of any kind should be dropped in the dry run process.  It could frustrate users if, due to group membership or by direct access, they were able to open folder from a dry-run account, especially since the folder names are preserved in the dry-run mailbox; a user would not know that it was a dry-run account. Priasoft recommends that permission testing be done with a contrived “pilot” group (not real users) so that the full end-to-end migration pattern can be validated.