Exchange Support and Permissions Explained
This topic outlines support for each Exchange version type.
Sensitive Data Discovery is available with the EWSMailbox, EWSPublicFolder, and ExchangeMailbox data collectors.
Support by Data Collector
The following tables show support by data collector:
| Data Collector | Exchange Online | Exchange 2019 | Exchange 2016 | Exchange 2013 | Exchange 2010 | MAPI-Based |
|---|---|---|---|---|---|---|
| EWSMailbox | Yes | Yes | Yes | Yes | Limited* | No |
| EWSPublicFolder | Yes | Yes | Yes | Yes | Limited* | No |
| Exchange2k | No | No | No | Yes | Yes | Yes |
| ExchangeMailbox | No | No | No | Yes | Yes | Yes |
| ExchangeMetrics | No | Yes | Yes | Yes | Yes | No |
| ExchangePS | Yes | Yes | Yes | Yes | Yes | No |
| ExchangePublicFolder | No | No | No | Yes | Yes | Yes |
| SMARTLog | No | Yes | Yes | Yes | Yes | No |
* The data collector can target Exchange 2010 Service Pack 1 and later.
Support by Job Group
The following tables show support by job group:
| Job Group | Exchange Online | Exchange 2019 | Exchange 2016 | Exchange 2013 | Exchange 2010 | MAPI-Based |
|---|---|---|---|---|---|---|
| 1. HUB Metrics | No | Yes | Yes | Yes | Yes | No |
| 2. CAS Metrics | No | Yes | Yes | Yes | Yes | No |
| 3. Database | No | Limited* | Limited* | Yes | Yes | Yes |
| 4. Mailboxes | Yes*** | Yes | Yes | Yes | Yes | No |
| 5. Public Folders | No | No | No | Yes | Yes | Yes |
| 6. Distribution Lists | Yes | Yes | Yes | Yes | Yes | No |
| 7. Sensitive Data | Yes | Yes | Yes | Yes | Limited* | Mix** |
| 8. Exchange Online | Yes | No | No | No | No | No |
* Limited indicates that some of the data collectors can target the environment, but not all.
** Mix indicates some data collectors are MAPI-based, but not all.
*** The Logons sub-group (part of job group 4. Mailboxes) isn't compatible with Exchange Online targets. For the Exchange Online version of this group, use 8. Exchange Online > Mailboxes.
Exchange Solution to Permissions Alignment
See the following sections for permission requirements by job group, data collector, or action module:
-
Exchange Mail-Flow Permissions
- ExchangeMetrics Data Collector
-
- HUB Metrics Job Group
-
Exchange Remote Connections Permissions
- SMARTLog Data Collector
-
- CAS Metrics Job Group
-
Exchange PowerShell Permissions
- ExchangePS Data Collector
- PublicFolder Action Module
- Mailbox Action Module
-
- CAS Metrics Job Group
-
- Databases Job Group
-
- Mailboxes Job Group
-
- Public Folders Job Group
-
- Exchange Online Job Group
-
Exchange Web Services API Permissions
- EWSMailbox Data Collector
- EWSPublicFolder Data Collector
-
- Sensitive Data Job Group
-
MAPI-Based Data Collector Permissions
- Exchange2K Data Collector
- ExchangeMailbox Data Collector
- ExchangePublicFolder Data Collector
-
- Databases Job Group
-
- Public Folders Job Group
-
- Sensitive Data Job Group
All MAPI-based data collectors require the Settings > Exchange node configured in the Enterprise Auditor Console.