> For the complete documentation index, see [llms.txt](https://docs.migration-center.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.migration-center.com/scanners/exchange-scanner.md). # Exchange Scanner ## Introduction The Microsoft Exchange Scanner is a new connector available since migration-center 3.2.6. The Exchange scanner can extract messages (emails) from Exchange mailboxes and use it as input into migration-center, from where it can be processed and migrated to other systems supported by the various mc importers. The Microsoft Exchange Scanner currently supports Microsoft Exchange on-premises and the Exchange 365. It uses **Exchange Web Services (EWS)** through the Independentsoft JWebServices for Exchange Java API for on-premises Exchange, and **Microsoft Graph** for Exchange Online. ## Limitations Exchange Online **in-place archive mailboxes** cannot be scanned through Microsoft Graph. Keep `scanInPlaceArchive` set to `false` for Exchange Online. The existing on-premises archive functionality remains available through EWS. An in-place archive mailbox is separate from an ordinary Archive folder inside the primary mailbox. **Delta migration** for objects scanned with migration-center v26.2 and older is **not supported**.\ This only applies when scanning from Exchange Online, due to switching the Exchange scanner from the deprecated EWS API to Microsoft Graph, the unique identifiers for each email have a slightly different format. As a result, previously scanned emails can no longer be recognized and will be treated as new objects. {% hint style="danger" %} Running delta scan with the new version over scans from the previous version **can result in duplicate objects scanned**. {% endhint %} Our recommendation is to finish migrations for any mailboxes that are in progress and for which no delta scans will be needed in the future, and only then upgrade migration-center and start scans of new mailboxes, to avoid duplication. ## Prerequisites ### Credentials for Exchange Online Exchange Online scanning uses Microsoft Graph with application authentication. Register an application in the Microsoft Entra tenant containing the mailboxes to be scanned, then configure its application client ID and client secret in migration-center. 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/) and select the tenant containing the Exchange Online mailboxes. 2. Open **Entra ID > App registrations > New registration**. 3. Enter an application name. Under **Supported account types**, select **Single tenant only**. Click **Register**. 4. On the application's **Overview** page, copy the **Application (client) ID**. This value is used for the scanner's `clientId` parameter. 5. Open **Certificates & secrets > Client secrets > New client secret**. 6. Enter a description, select an expiration period, and click **Add**. 7. Copy the secret's **Value** immediately. Use this value for `clientSecret` parameter in the scanner; the **Secret ID** is not the credential. The value cannot be displayed again after leaving this page. 8. Open **API permissions > Add a permission** and select **Microsoft Graph**. 9. Select **Application permissions**, search for **Mail.Read**, select it, and click **Add permissions**. 10. Have an authorized administrator select **Grant admin consent for \[organization]** and confirm that consent has been granted for the Microsoft Graph **Mail.Read** application permission. With administrator consent, the **Mail.Read** application permission allows the application to read all mailboxes in the organization by default, including shared mailboxes. No additional mailbox permission setup is required unless your organization has restricted this application's access to selected mailboxes. If such a restriction exists, ask your Exchange administrator to confirm that it permits the mailbox in `username` and every additional mailbox selected in `scanFolders`. ## Scanning Online vs On-Premises For **Exchange Online**, the scanner authenticates as an application through Microsoft Graph using `clientId` and `clientSecret`. Access to the selected mailboxes is determined by the application's permissions and any tenant restrictions. For **on-premises Exchange**, the scanner authenticates with the configured username and password through EWS. The account must have delegate access to any other mailboxes selected for scanning. The scanner selects the connection method from the configured credentials: * **Exchange Online:** configure `username`, `clientId`, and `clientSecret`. Leave `password` empty. `exchangeServer` and `domain` are not used for this connection. * **On-premises Exchange:** configure `username`, `password`, and `exchangeServer`. Leave `clientId` and `clientSecret` empty. {% hint style="warning" %} Configure only one authentication method. Providing a password together with a client ID or client secret is invalid. {% endhint %} Selected folders are scanned recursively. Use `excludeFolders` to omit folders and their subfolders. The scanner treats scan and exclusion paths as case insensitive. The scanner saves email content and attachments to disk as `.eml` files, or as Outlook-readable `.msg` files when `exportMailAsMsg` is enabled. In addition to the emails themselves, attachments and properties of the respective messages are also extracted. The messages and included attachments are stored as on disk, while the properties are written to the mc database, as is the standard with all migration-center scanners. ## Scanner Configuration To create a new Exchange Scanner job, specify the respective adapter type in the Scanner Properties window – from the list of available connectors, “Exchange” must be selected. Once the adapter type has been selected, the Parameters list will be populated with the parameters specific to the selected adapter type, in this case the Exchange connector's parameters. The Properties window of a scanner can be accessed by double-clicking a scanner in the list, or selecting the Properties button or entry from the toolbar or context menu. ### Scanner parameters The common adaptor parameters are described in [Common Parameters](/common-parameters.md#common-adaptor-details). The configuration parameters available for the Exchange Scanner are described below: * **username\***\ For on-premises Exchange, the account used to authenticate. It must have delegate access to any other mailboxes selected for scanning. \ For Exchange Online, the full UPN of the default mailbox, for example `user@contoso.com`. The domain part identifies the tenant used for application authentication. \ The application must have access to this mailbox, even when `scanFolders` selects another mailbox. * **password**\ The password that will be used to connect to the exchange server.\ **Do not** **set** if you're connecting to Exchange Online**.** * **clientId**\ Client ID used to connect to the Exchange Online. * **clientSecret**\ Client Secret used to connect to the Exchange Online. * **exchangeServer**\ The **host name or IP address** of the exchange server. Use *outlook.office365.com* for online version. * **domain**\ The domain against which the user will be authenticated. \ Leave empty for authentication against exchange server domain. * **useHttps**\ Specify if the connection between Job Server and Exchange server will be established over a secure SSL channel. * **scanInPlaceArchive**\ Specify if the folder(s) to be scanned are located in an In-Place Archive.\ This feature no longer works with Exchange Online throuhg Graph API. * **scanFolders\***\ Exchange **folder paths** to scan. (**Case insesitive**) The syntax is \\\\\\[\folder path] or \folderPath. If only the account is given (ex: \\\\) then the scan location will be considered to be the "Top of Information Store" folder of the user. If no account is specified, the path is considered to be in the account specified in the “username” property. Multiple paths can be entered by separating them with the “|” character. Example: * \\\user\Inbox would scan the Inbox of user (including subfolders) * \Inbox\sales is equivalent to \\\“username”\Inbox\sales * **excludeFolders**\ Exchange **folder paths** to **exclude** from scanning. (**Case insesitive**)\ Follows the same syntax as scanFolderPaths above. Example: * *\\\user\Inbox\Personal* would exclude user’s personal mails stored in the *Personal* subfolder of the *Inbox* if used in conjunction with the above example for scanFolderPaths. * **ignoredAttributes**\ A **comma separated list** of Exchange **properties** to be **ignored by the scanne**r. At least ***Body, HTMLBody, RTFBody, PermissionTemplateGuid*** should be always excluded as these significantly increase the size of the information retrieved from Exchange but don’t provide any information useful for migration purposes in return. * **exportLocation\***\ **Folder path.** The location where the exported object content should be temporary saved. It can be a local folder on the same machine with the Job Server or a shared folder on the network. \ This folder **must exist** prior to launching the scanner. \ The **Jobserver** must have **write permissions** for the folder**.**\ This path must be accessible by both scanner and importer so if they are running on different machines, it should be a [shared folder](/installation-guide.md#accessing-network-shares). * **exportMailAsMsg**\ Boolean. If true, the emails will be exported as .msg files, otherwise they will be exported as .eml files. * **numberOfThreads\***\ Number. The number of concurrent threads that will be used for scanning the emails from the configured locations. * **loggingLevel\***\ See: [Common Parameters](/common-parameters.md#logging-level). {% hint style="warning" %} Parameters marked with an asterisk **(\*)** are **mandatory**. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.migration-center.com/scanners/exchange-scanner.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.