Federation related error when adding new organisation

[renedubs]

HI @all

I'm trying to add a new organization. Connect ot Graph / EWS is OK, but powershell doesn't work. I get the error: "Connect to PowerShell: The partner returned a bad sign-in name or password error. - For more information, see Federation Error-handling Scenarios."

I'm working with a user including 2-factor authentication. Using the app-password.

What I have to-do?

Best Regards
René

Case #03573652

[nielsengelen]

As you made a support case, I would wait for support for assistance.

[Mike Resseler]

Hi Rene,

First: Welcome to the forums!
Second: Are you using a federated account? And in what format are you using it?

[Padre880]

Hello,
I am having the exact same issue.
Application created and permissions assigned.
service account is exchange and sharepoint admin.
App password created... Grpah and EWS are ok, PowerShell is not.
It is an onprem account, synced with AD connect.

Using Basic authentication works fine with the AD password.
I am getting this error when using Modern Auth

Any help?
Thank you

[Polina]

Hi Padre880,

Please use an account with MFA enabled on the O365 side. VBO doesn't support federated accounts with MFA configured via ADFS or any 3rd party tools.

Thanks!

[marcin baran]

Hello,

Even with account with MFA enable on the office365 error still occurs.
Did someone figured out what caused this issue by itself or with support?

Regards,
Marcin

[Mike Resseler]

Hi Marcin,

First: Welcome to the forums.
Second: The previous case was closed with no response so we are not sure how it ended. If you have a O365 account and have this issue (and it is not a federated account), please create a support call also. Without diving in the logs it is rather impossible to figure out where the error is coming from

As per forum rules, please post your case ID here, and the outcome after investigation of our engineers.

Thanks
Mike

[marcin baran]

Hello,

I didn't inquire what type of account was it - it might be federated account.
So veeam needs account created directly in Azure AD?
On-premise AD account that log in to office365 using Federation Services or synchronized with Directory Connect are unable to add organization in VBO365 console?

Regards,
Marcin

[Mike Resseler]

Hi Marcin,

Correct. The reason is rather simple. We connect to Azure AD, and if we would be able to talk to a federated account, it means that we need credentials / access to your on-premises environment also. It is rather a security risk. Plus, it remains smarter to use a AAD account specifically for this service, because no matter what happens, at least it can not be used to do something to your on-prem environment. I hope it makes sense

[marcin baran]

OK, I understand.
Thank you for your help.

Regards,
Marcin

[marcin baran]

Hello,

I found that if you have hybrid organization with on-premise AD account that log in to office365 using Federation Services you can also install Exchange Online Remote PowerShell Module on proxy (according to microsoft kb Connect to Exchange Online PowerShell using multi-factor authentication, https://docs.microsoft.com/en-us/powers ... xchange-ps).
This module resolved issue with "Connect to PowerShell: The partner returned a bad sign-in name or password error. - For more information, see Federation Error-handling Scenarios."

Regards,
Marcin

[BTobbe]

Hi,

I'm just installing the Veeam Backup for office365 on community edition to trial this for our company.

When adding the organization it connects to Microsoft Graph, EWS and "connect to powershell".
The connect to powershell fails with this error: Connect to powershell: The partner returned a bad sign-in name or password error. For more information, see Federation error-handling scenarios.

I have gone through the permission KBs and have added everything. Not really sure where to troubleshoot as the error message is very generic and googling it doesn't show up much.

Anyone know where to look for this?

[Polina]

Hi BTobbe,

Are you using a federated account enabled for MFA?

[rpearson]

We have recently started using Azure sync to have our Windows and our O365 passwords synced together. But now I get an error that states "Federated service at https://autologon.microsoftazuread-sso. ... b7d2a2a4a2 returned error: Authentication Failure" How do I get this back up and going?

[Polina]

Hi Robert,

Please check out the above discussion.
I assume you might be using an MFA-enabled federated account to add your organization, which is not supported.

[marcin baran]

Hi,

I think that BTobbe needs to install Exchange Online Remote PowerShell Module on VBO365 proxy.

Rpearson, please check if you are using MFA or non-MFA account for VBO365 and use resepective credentials.