403 Forbidden since Mai 28th

[dasfliege]

We're serving O365 backup as a service for a few customers and since Mai the 28th, we can't login to all organizations that use modern legacy auth (App password). While clicking through the add organization dialog, i receive and Error "403 Forbidden" when trying to connect to Microsoft Graph.
Anyone else having the same issue?

[Polina]

Hi dasfliege,

Can you check if tenants' apps are assigned with the full_access_as_app permission?

[dasfliege]

Yes they are. We had to add that when we updated to v5. Everthing was working fine then until 3 days ago. Nothing has changed on our site.

[nielsengelen]

Which VBO version are you running at the moment?

[dasfliege]

We're running 5.0.1.179

[Mildur]

Could you update to 5.0.1.252 and try it again?
https://www.veeam.com/kb4158

It should be resolved with this version:
https://www.veeam.com/kb4156

Challenge
Backup and restore operations in Veeam Backup for Microsoft Office 365 fail with the error:

"The remote server returned an error: (403) Forbidden. Access denied"

Cause
Recent changes made by Microsoft to their APIs have impacted certain authentication queries that are used in versions of Veeam Backup for Microsoft Office 365 prior to build 5.0.1.225.

Solution
Users must upgrade to latest version with Veeam Backup for Microsoft Office 365 5b cumulative patch KB4135.

The newest product build leverages different API queries which help to avoid the permission issue which takes place in older builds.

[dasfliege]

Thank you very much for your answer. That seemed to fix the issue. For whatever reason, i wasn't able to find that KB...

[Mildur]

Glad it helped you

You can find the newest versions of VBO365 here:
https://www.veeam.com/kb4106

The page in the forum is not current at the moment. I have asked Mike in a PN if he could update the page with the most current version:
veeam-backup-for-office-365-f47/current ... 39185.html

[Mike Resseler]

@Mildur @dasfliege
We do adapt the mentioned forum post, but only when there are major changes. For some incremental upgrades, we don't change it (we have a few reasons for it). However, please bookmark the KB article (which is also mentioned above and in the post itself). That will always show the latest version

Thanks
Mike

[nicotomio]

Hello,
I have applied the patch, check that the version is well 5.0.1.252 but I have already 403 error.
I use the basic authentification.
Do you have any idea ?
Thanks.

[Mildur]

Most likely someone has activated Azure Security Defaults. Can you check that?

[Polina]

Nicolas,

Please open a support call and let our engineers troubleshoot it. Take a moment to post your case ID here.

Thanks!

[vladimir_g]

We are also seeing this error impacting all organizations that use Modern Authentication with legacy protocols without security defaults enabled. We confirmed it happens with 5.0.1.252

[Polina]

Vladimir,

Please provide me your support case ID for the followup.

[vladimir_g]

After spending some time researching this issue, I had a chance to confirm that Veeam REST API responds with "{\r\n "message": "Connecting to remote server outlook.office365.com failed with the following error message : Access is denied. For more information, see the about_Remote_Troubleshooting Help topic."\r\n}" for multiple operations when an account is pruned from O365. In case anybody else runs into this, make sure organization still exists in O365.