I'm using TFS 2017 update 1 on premises + TFS Aggregator 2.2.1. In order to properly use autoImpersonate set to true in TFSAggregator2.ServerPlugin.Policies, i.e.:
<!--
autoImpersonate false (default) use the TFS Service account, true the user requesting. (Optional)
-->
<authentication autoImpersonate="true" />
is it necessary to set the following permission to true for "Project Collection Valid Users" group? https://www.visualstudio.com/en-us/docs/setup-admin/permissions#make-requests-on-behalf-of-others-permission