Providing Service Accounts Access to Online Mailboxes for Office 365 with Exchange in a Hybrid Environment

Applies to: Office 365 with Exchange, User Mailbox

In an Office 365 with Exchange environment, you must configure the Exchange Online service account to discover, archive, clean up, and restore data for user mailboxes, group mailboxes, and all public folders.

Before You Begin

The Office 365 with Exchange (Exchange Online) Administrator Account must have the following service accounts configured:

Exchange Online Service Account, which must meet the following requirements:
- Must be an online mailbox.
For the Exchange Online Service Account, a license is not required. Convert the user mailbox to a shared mailbox and remove the Office 365 license for the Exchange Online Service Account.
For backup and restore of public folders, service account should have owner permissions at the sub-folder level and at the root level. You must convert the shared mailbox to a user mailbox, assign the owner permissions and then convert it back to a shared mailbox.
You must assign the Exchange administrator role to the Exchange Online Service Account. This is required to discover and protect Office365 Group mailboxes. For more information see, Assign admin roles in Office 365.

Procedure

Open Windows PowerShell and create a remote PowerShell session to Office 365 with Exchange.
To assign view-only recipient permissions, type the following command:
```
 
New-RoleGroup -Name "ExchangeOnlineBackupRoleGroup" -Roles "View-Only Recipients" -Members serviceaccount1,serviceaccount2
```
where:
- ExchangeOnlineBackupRoleGroup is a unique name for the new role group.
- serviceaccount1 and serviceaccount2 are Exchange Online service accounts.

Note

In Modern authentication, service account is required only for mailbox discovery and license computation and not for backup and restore operations.

What To Do Next

Run Application Check Readiness for the Exchange Mailbox Client.