Failed to process OneDrive - does not support SharePoint Online credentials

[Joffer]

So I've been doing backup tests for a few weeks just fine; well, they have been slow, 150minutes for 6,7GB of data (mostly data in one onedrive account).

As I was doing a new (full/first) backup today, I suddenly got this:

18.09.2019 11:44:55 :: Failed to process OneDrive: <username> (https://<tenant>-my.sharepoint.com/personal/<username>_<tenant>_onmicrosoft_com). Cannot contact web site 'https://<tenant>-my.sharepoint.com/' or the web site does not support SharePoint Online credentials. The response status code is 'Unauthorized'. The response headers are 'X-SharePointHealthScore=6, X-MSDAVEXT_Error=917656; Access+denied.+Before+opening+files+in+this+location%2c+you+must+first+browse+to+the+web+site+and+select+the+option+to+login+automatically., SPRequestGuid=111111-f089-1000-af41-651111111f0, request-id=f85111-f089-1000-af41-65111c7f0, MS-CV=nwVe+InwA1111118A.0, Strict-Transport-Security=max-age=31536000, SPRequestDuration=45, SPIisLatency=0, MicrosoftSharePointTeamServices=16.0.0.19304, X-Content-Type-Options=nosniff, X-MS-InvokeApp=1; RequireReadOnly, X-MSEdge-Ref=Ref A: 4196AF1E2222222222752AAC8C1 Ref B: HEL0122221 Ref C: 2019-09-18T09:44:55Z, Content-Length=0, Content-Type=text/plain; charset=utf-8, Date=Wed, 18 Sep 2019 09:44:55 GMT, P3P=CP="ALL IND XXX XXX XXX XXX XXX XXX CUSo XXXo XXXo XXXo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI", X-Powered-By=ASP.NET'.

Access+denied.+Before+opening+files+in+this+location%2c+you+must+first+browse+to+the+web+site+and+select+the+option+to+login+automatically ??

I have not changed any of the permissions (the O365 is a small 2 user livenced "lab" account I've got access to, so there aren't ppl messing around with the permissions I wouldn't know of
)
Does anyone know if some access requirements has changed? So far I've not given my app user for backup the "Sharepoint admin" role in api permissions, and it has worked fine (didn't see anything in the docs about it being needed). Could that be a new requirement?

[Joffer]

The above message is what I get when I try to browse the Sharepoint site when making a new backup job, or run an already defined sharepoint backup job.

If I run an already defined job for onedrive, I get this error in veeam:

18.09.2019 14.36.38 :: Failed to process OneDrive: <username1>. The request failed with HTTP status 401: Unauthorized.
18.09.2019 14.36.38 :: Failed to process OneDrive: <username2>. The request failed with HTTP status 401: Unauthorized.

(OT - why can't I edit my original post? The pencil icon is gone)

[Mike Resseler]

Hey Christopher,

That doesn't look good. Can you please create a support case?

[Joffer]

Got it running again. It is likely some security settings I (*cough*did'not'change'anything*couch* :p) was playing around with in azure portal. I'm trying to isolate what it was first.

[Joffer]

Ok. So somethings might have changed at O365/Azure? Yesterday I was able to exclude the SharePoint Administrator role from the Conditional Access "Baseline policy: Require MFA for admins (Preview)", and it worked again, but I didn't have to do that before. Removing the exclude, and backup failed of onedrive and sharepoint. And today, I can't exclude anyone, the feature is gone..
So today I had to disable the conditional access rule all together to make the backup run

Conditional Access - Baseline policy: Require MFA for admins (Preview):

Code: Select all

This policy requires multi-factor authentication (MFA) for the following directory roles:
- Global Administrator
- SharePoint Administrator
- Exchange Administrator
- Conditional Access Administrator
- Security Administrator
- Helpdesk Administrator/Password Administrator
- Billing Administrator
- User Administrator
This policy also blocks legacy authentication.

[Polina]

Hi Christopher,

Changes from Microsoft side keep coming regularly, as they continue working on these new policies. Before enabling the 'Require MFA for admins (preview)' policy, it's recommended to make sure that none of the administrators is using legacy authentication protocols (which is exactly the case for a VBO service account)...

Exclusions are indeed not there anymore, but if you're on Azure AD Premium P1 this can be resolved by creating additional conditional access policies (see this post ).

Thanks!