AppInsight for Exchange requirements and permissions
Exchange hybrid versions are not supported.
AppInsight for Exchange works only with the Mailbox Role, which is used for data storage. All other Exchange servers running different roles should use the Exchange application monitor templates included with SAM if you intend to monitor them. Data is collected at the same default five-minute polling interval as traditional application monitor templates.
Supported Microsoft Exchange Server versions
- Microsoft Exchange Server 2010
- Microsoft Exchange Server 2013
- Microsoft Exchange Server 2016
- Microsoft Exchange Server 2019
AppInsight for Exchange permissions
The following permissions are required to modify Exchange and WinRM settings on target servers, as well as poll performance counters:
- Local administrator permissions are needed for automatic configuration, but are not needed for monitoring after configuration is complete.
- To provide organization-wide capability, the service account (Domain User) must be a member of the View-Only Organization Management group. Membership to this group gives the User object read-only access to the entire Exchange environment, without providing any domain or local access on the Exchange server. It also prevents unauthorized access to the account.
- To gather data, the User object must be assigned the Mailbox Search management role within Exchange. The account must be a member of the Local Administrators group.
This role is only required to modify Exchange and WinRM settings on server. It's not necessary for standard polling.
- For Mailbox statistics, Hub Transport Servers need to be accessed via RPC.
- PowerShell is usually installed with Microsoft Server. Install PowerShell 5.1 or later on target servers, if it's not already installed.
- Set PowerShell permissions for Exchange.
Earlier versions of SAM used FullLanguage mode on target Exchange servers. Starting in SAM 2020.2.6, use RestrictedLanguage as the minimum PSLanguageMode setting in PowerShell on target servers. For a script to configure existing servers, see this Success Center article.
Common configuration issues
- To add local administrative privileges to an Active Directory account, see Manually configure an Exchange server for AppInsight for Exchange.
- To determine Exchange URL settings, see Find Exchange URL settings for AppInsight for Exchange in SAM.
- To install PowerShell on the Exchange server, see Manually configure an Exchange server for AppInsight for Exchange.
- If you don't want to configure WinRM to remotely monitor Exchange servers, you can use AppInsight for Exchange in conjunction with the Orion Agent for Windows.