This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(236.8, 44%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMP%3C/text%3E%3C/svg%3E)
Hi,
I am in the process of working through a test plan after recently setting up hybrid Exchange with O365.
I have been trying to follow the steps outlined in this MS article, with a view to testing O365 user access to on premise public folders.
https://learn.microsoft.com/en-us/exchange/hybrid-deployment/set-up-modern-hybrid-public-folders
I've not managed to get very far in my lab however, as I am met with an "Access denied" error when attempting to run the following command, as part of the process:
.\Sync-ModernMailPublicFolders.ps1 -Credential (Get-Credential) -CsvSummaryFile:sync_summary.csv
The credentials I am inputting are my global admin creds for O365.
I am able to connect to ExchangeOnline via Powershell with the same creds so I cannot see that there would be a permissions issue at this point:
Error returned from attempting to run the script:
Successful connection ExchangeOnline using the same creds
I don't really know where to begin with troubleshooting this one.
Any ideas would be greatly appreciated.
Thanks
Matt
Is that account protected by MFA? If so, temporarily remove that MFA requirement or use another account that isnt using MFA and try that.
No MFA enabled on the account.
I made another O365 user a global admin to test access, but the results were the same.
Ok, but also ensure the account is enabled for Basic auth as well. Check basic auth is not blocked in Azure or ExO:
https://learn.microsoft.com/en-us/exchange/hybrid-deployment/set-up-legacy-hybrid-public-folders
In ExO:
Get-User <user> |FL AuthenticationPolicy
See what if any basic auth policy is applied to that user
Can you check the Azure Sign In logs for that user when it fails? See why its failing - password/Conditional access policy etc...
ALso: Get-User <user> |FL AuthenticationPolicy
Hi,
There is no authentication policy assigned to the user account - the result is null when the Get-User <user> | fl AuthenticationPolicy is run
Just looking at the sin in logs in Azure for the first time....
I'm assuming the sign in attempts for EO would be logged in the "User sign-in (non-interactive)" ?
There are a lot of entries - what would the application type be so that I can filter the logs?
Thanks
I would look for any Status of Failure. If you dont see any look for the Office 365 Exchange Online resource and see if those show success and match up with times you test.
I
I'm not seeing any "failure" events that correlate with the times I've been testing this afternoon.
interestingly I can see entries on our corporate firewall for successful connections to Microsoft/Azure when I connect to EO manually via the EO Powershell module.
There are no firewall log entries at all when I try to connect via the PF script however, and I've tried it from both of my Exchange testlab servers....
From the script, we can know it connect to Exchange online in the way of basic auth:
So, try to connect to Exchange online in this way first. If you cannot connect to Exchange online with basic auth, double check about the "What do you need to know before you begin" part in above article. Make sure configuration is correct.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi,
I've tried to connect to manually specifying the authentication type as Basic, the results are the same - "Access Denied"
I've also confirmed that Basic authentication is enabled in the Azure AD/O365 tenant:
Now, we can know this issue isn't related to the script. It is caused by the connect to Exchange oline.
Make sure you are using Worldwide Office 365, otherwise you will need to connect to Exchange online with other URL.
Double check the account that you used could login Exchange online admin center.
Then check the auth on the computer that you try to connect to Exchange online from:
Try to connect to Exchange online in the way:
$UserCredential = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
Import-PSSession $Session -DisableNameChecking
If you still cannot connect to Exchange online, I would suggest you try to test from another computer.
Hi,
I've expanded the testing and tried the following:
Testlab tenant global/Exchange admin creds: (testlab tenant)
Log in to EO console via browser on any pc (TESTLAB DOMAIN/PROD DOMAIN/HOME) - successful login
Log in to EO via Powershell module on any pc with module installed (TESTLAB DOMAIN/PROD DOMAIN/HOME) - successful login
Log in to EO using command below on any pc (TESTLAB DOMAIN/PROD DOMAIN/HOME) - "Access Denied"
$UserCredential = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
Import-PSSession $Session -DisableNameChecking
Production tenant global/Exchange admin creds: (production tenant)
Log in to EO console via browser on any pc (TESTLAB DOMAIN/PROD DOMAIN/HOME) - successful login
Log in to EO via Powershell module on any pc with module installed (TESTLAB DOMAIN/PROD DOMAIN/HOME) - successful login
Log in to EO using command below on any pc (TESTLAB DOMAIN/PROD DOMAIN/HOME) - "Access Denied"
$UserCredential = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
Import-PSSession $Session -DisableNameChecking
Thanks
(TESTLAB DOMAIN/PROD DOMAIN/HOME)
If you get this error on all computers, I suggest you also open a service request to Office 365, let them help us to check from the server side. Check whether there exists issue on your tenant block the basic connection.
The reason the scripts do not work is because Microsoft have disabled basic authentication in many if not all customer tenants.
The PF sync scripts rely on basic authentication to work.
This is discussed in this thread
https://github.com/MicrosoftDocs/OfficeDocs-Exchange/issues/1563
One of comments mentions a modified script - Sync-ModernMailPublicFoldersV2.txt - which can be used as a workaround to the original scripts, which Microsoft have yet to fix.
I have run the modified script and successfully synced the on prem PF's with O365.