Sync Public Folders to Exchange online fails Unable to create a remote shell session to Exchange Online. The error is as follows: "Connecting to remote server outlook.office365.com failed with the following error message : Access is denied.

Question

I am performing an Exchange 2013 to Office365 Migration. I am at the point where I need to make on-prem public folders visible to Office365 mailboxes. I am attempting to run the script sync-modernmailpublicfolders.ps1 per guidance provided here: https://learn.microsoft.com/en-us/exchange/hybrid-deployment/set-up-modern-hybrid-public-folders. Running the script returns:
InitializeExchangeOnlineRemoteSession : Unable to create a remote shell session to Exchange Online. The error is as
follows: "Connecting to remote server outlook.office365.com failed with the following error message : Access is
denied. For more information, see the about_Remote_Troubleshooting Help topic.".
At C:\script\Sync-ModernMailPublicFolders.ps1:506 char:5

• InitializeExchangeOnlineRemoteSession;
• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
• CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
• FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,InitializeExchangeOnlineRemoteSession

The account being used is has the Office 365 Global Administrator and Exchange Online Organization Management roles assigned. The account does not require MFA. In the same powershell session I can "connect-ExchangeOnline" without issue, so I'm thinking the error message may be misleading or bogus. I've run this script many times in the past in other organizations and never had a problem. On-Prem Exchange 2013 CU23 is patched to within thirty days. I have run the script on different Exchange servers, always with the same result. I have tried running the script in the EMS and in Windows Powershell. All powershell on Exchange servers reports same powershell version:
PS C:\script> $psversiontable

Name Value

---

PSVersion 5.1.14409.1018
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.14409.1018
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

I have opened a support call with Microsoft, but am not getting anywhere. I'm hoping someone out there has run into this one.

TIA
Tom

Answer 1

I'm thinking it has to do with not supporting Modern Authentication and "I THINK" that Microsoft is starting to phase out basic authentication. I need to test this myself but here's a discussion on github that talks about it and a potential workaround.

https://github.com/MicrosoftDocs/OfficeDocs-Exchange/issues/1563

Answer 2

I just noticed I pasted the wrong URL for the Microsoft documentation I am following. The correct URL is: https://learn.microsoft.com/en-us/exchange/hybrid-deployment/set-up-modern-hybrid-public-folders.
It's been a long week!

Answer 3

@Thomas Walters

Here are some information about the access is denied error:

I would suggest you use the Exchange online admin account that used to configure AAD Connect. Then, have a check about the security defaults setting on your AAD Connect.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

Hi Kyle,
Thank you for your reply. I am sure I am typing in the correct username and password. The account is a Global Administrator and has Organization Management assigned. I have checked security defaults. The account being used is also the account used to configure AAD Connect. Do you have any other suggestions?

Thanks,
Tom

Answer 5

Again, I have to wonder about the error message. I have an established powershell session both before and after I enter the command that says I cannot connect:

PS C:\script> get-pssession

Id Name ComputerName ComputerType State ConfigurationName Availability -- ---- ------------ ------------ ----- ----------------- ------------ 12 ExchangeOnli... outlook.offi... RemoteMachine Opened Microsoft.Exchange Available

PS C:\script> .\sync-modernmailpublicfolders.ps1 -credential(Get-Credential) -CSVSummaryfile:c:\script\20211001-PFSync.c sv

cmdlet Get-Credential at command pipeline position 1 Supply values for the following parameters: Credential

Confirm Are you sure you want to perform this action? Performing the operation "Remove File" on target "C:\script\20211001-PFSync.csv". [Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): a [10/1/2021 11:24:00 AM] Creating an Exchange Online remote session... InitializeExchangeOnlineRemoteSession : Unable to create a remote shell session to Exchange Online. The error is as follows: "Connecting to remote server outlook.office365.com failed with the following error message : Access is denied. For more information, see the about_Remote_Troubleshooting Help topic.". At C:\script\Sync-ModernMailPublicFolders.ps1:506 char:5 + InitializeExchangeOnlineRemoteSession; + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,InitializeExchangeOnlineRemoteSession

PS C:\script> get-pssession

Id Name ComputerName ComputerType State ConfigurationName Availability -- ---- ------------ ------------ ----- ----------------- ------------ 12 ExchangeOnli... outlook.offi... RemoteMachine Opened Microsoft.Exchange Available

PS C:\script>