VBO365 Add-VBOOrg fails to change Org settings

[kevz0r]

Hi guys,

I'm having an issue with adding one particular an organization with powershell, however when I add it with the GUI it works fine. here is my powershell which works fine for other organizations:

Code: Select all

Import-Module Veeam.Archiver.PowerShell
$user = "email@address.com"
$pword = ConvertTo-SecureString -String "password" -AsPlainText -Force
$ocreds = New-Object -TypeName "System.Management.Automation.PSCredential" -ArgumentList $user, $pword
Add-VBOOrganization -Type Office365 -Office365Credential $ocreds -Office365GrantImpersonation

I've tried different options in the add-vboorg line, but always with the same results:

Code: Select all

Add-VBOOrganization : Failed to change organization settings.
At line:1 char:1
+ Add-VBOOrganization -Type Office365 -Office365Credential $ocreds -Off ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Add-VBOOrganization], Exception
+ FullyQualifiedErrorId : System.Exception,Veeam.Archiver.PowerShell.Cmdlets.Organizations.AddVBOOrganization

I'm told all permissions are set correctly (which I assume is true because adding through the GUI does work fine). Is there something else that needs to be set in O365?

Thanks

[veremin]

Just a quick question - are you trying to change settings for existing organization or just adding a completely new one (which has not been added yet)? What product version are you using? Thanks.

[kevz0r]

Adding a brand new organization, using VBO 2.0.0.567 (never had a problem with 1.5)

Thanks

[veremin]

Can you provide us with logs for both PowerShell module and VBO server? Thanks.

[veremin]

By the way, does your password contain special symbols that might unintentionally create a new line, hide a character, etc. (`r `n or similar)?

Input $pword variable into pipeline and check whether it has not been changed anyhow.

Thanks.

[kevz0r]

I have a case open with this ID which has everything in it:
03175590

There aren't any special characters that could hide or start a new line, and I can connect to O365 with these credentials using:
Connect-MsolService -Credential $ocreds

So auth seems fine...

$pword hasn't changed... I only have this issue with some Organizations so I am thinking it might be an extra permission that's required with 2.0's powershell (as I didn't have this problem with VBO 1.5) - however I'm told that all permissions have been set according to Veeam's guidelines.

Thanks

[veremin]

We've reached your support engineer to get more details regarding the issue experienced. Will update the topic, once I have more information. Thanks.

[kevz0r]

Great, thanks Vladimir!

[veremin]

So, here is what we found during our research:

1) Set-VBOOrganization cmdlet fails to change settings for "eXXXXXXX" organization.

Root cause: The specified account misses SharePoint Online Administrator or Global Administrator role.

Solution: Grant missing role. Check this document for more information.

2) Add-VBOOrganization cmdlet fails to add "sXXXXXXX" organization.

Root cause: Server fails to grant access to Azure AD application.

Solution: Grant missing privileges. Check this document for more information. Alternatively, you can set $False value to the corresponding switch: -Office365UseVeeamAADApplication:$False

3) Set-VBOOrganization cmdlet fails to change settings for "LXXXXXXX" organization.

Root cause: Authentication fails due to incorrect credentials.

Solution: Specify valid credentials.

Thanks.

[kevz0r]

But when I add through the GUI and it performs all the checks they all come back fine and lets me add the Org so it looks like all the permissions are there.

Is the GUI doing something different to Powershell?

I'll try -Office365UseVeeamAADApplication:$False when/if I next see the error.

Thanks!