If you need to link your LibraCyber Archiver or Email Security to Microsoft Exchange for operations such as LibraCyber Archiver synchronization/import or LibraCyber Email Security Gateway Threat Remediation feature, you require full read access to all mailboxes residing in Microsoft Exchange. To accomplish this, it is necessary to create an account in Microsoft Exchange with read rights across all mailboxes (impersonation role).
Prerequisites: You must be a member of the Organization Management role group and ensure that the Exchange server is assigned Client Access Role.
Impersonation account creation
There are two methods to configure the service account, the first one from the Exchange Admin Center and the second one from Exchange Management Shell:
Method 1: From Exchange Admin Center
- Create an unprivileged domain user (e.g. LibraCyber Archiver).
- Exchange admin center -> recipients -> create a new dedicated mailbox.
- Log on to the Exchange admin center of your Microsoft Exchange environment.
- Navigate to permissions.
- Under admin roles select + (New).
- Enter a meaningful name (e.g. LibraCyber Impersonation) and description for the new role group.
- Under Roles add the role ApplicationImpersonation.
- Under Members add the user you've created above.
- Click on Save to create the new role group.
Method 2: From the Exchange Management Shell
- Create an unprivileged domain user (e.g. libraesva@yourdomain.com).
- Open a Microsoft Exchange Management Shell session on the Microsoft Exchange 2016 Server.
- Enter the following command:
New-ManagementRoleAssignment -Name:"Libraesva Impersonation" -Role:ApplicationImpersonation -User:libraesva@yourdomain.com
- Optional: Enter the following command to check the role assignment:
Get-ManagementRoleAssignment -Role:ApplicationImpersonation -RoleAssigneeType:User | Format-List * Get-ManagementRoleAssignment -Identity:"Libraesva Impersonation" | Format-List *- Optional: Enter the following command to remove the role assignment:
Remove-ManagementRoleAssignment "Libraesva Impersonation"Remove EWS throttling limits
By default Exchange has specific limits on the amount of requests a user can make. To prevent Exchange from throttling LibraCyber Appliances you can safely remove this limits with this command:Exchange 2010
New-ThrottlingPolicy -Name libraesva -EWSFindCountLimit $null -EWSFastSearchTimeoutInSeconds $null -EWSMaxConcurrency $null -EWSMaxSubscriptions $null -EWSPercentTimeInAD $null -EWSPercentTimeInCAS $null -EWSPercentTimeInMailboxRPC $null; $b = Get-ThrottlingPolicy libraesva; Set-ThrottlingPolicyAssociation -Identity <name of the user with the impersonation role> -ThrottlingPolicy $b;Exchange 2013
New-ThrottlingPolicy -Name libraesva -RCAMaxConcurrency $null -EWSMaxConcurrency $null -EWSMaxSubscriptions $null -EwsCutoffBalance $null -EwsMaxBurst $null -EwsRechargeRate $null -CPAMaxConcurrency $null; $b = Get-ThrottlingPolicy libraesva; Set-Mailbox -Identity <name of the user with the impersonation role> -ThrottlingPolicy $b;
Exchange 2016+
New-ThrottlingPolicy -Name libraesva -RCAMaxConcurrency unlimited -EWSMaxConcurrency unlimited -EWSMaxSubscriptions unlimited -EwsCutoffBalance unlimited -EwsMaxBurst unlimited -EwsRechargeRate unlimited -CPAMaxConcurrency unlimited; $b = Get-ThrottlingPolicy libraesva; Set-Mailbox -Identity <name of the user with the impersonation role> -ThrottlingPolicy $b;