I’m just putting a quick snippet here so I can find it later on.

When you create a brand-new Microsoft 365 tenancy, it often takes a while before you can assign the ApplicationImpersonation role via the Exchange admin centre. Why would you need to do this? If you’re then migrating a heap of email into Microsoft 365 using something like MigrationWiz.

A quick fix is to instead drop into PowerShell and type the following:

Connect-ExchangeOnline
Enable-OrganizationCustomization
New-RoleGroup -Name "Application Impersonation" -Roles ApplicationImpersonation -Members "[email protected]"

This will get it sorted out much quicker than waiting for things to happen in the web interface.