Maintain control of your Microsoft Office 365 email data
Post Reply
mlange
Enthusiast
Posts: 30
Liked: 1 time
Joined: Sep 02, 2014 3:06 pm
Contact:

Issues authenticating

Post by mlange » Feb 18, 2019 9:17 pm

We initially set up VBO with a global admin account, but now we want to use an account of least privilege. I've created the account and set it up with the Sharepoint and Exchange permissions as outlined here, https://helpcenter.veeam.com/docs/vbo36 ... tml?ver=20. When trying to use this account to connect VBO to our tenant I cannot get past the Connect to EWS and Microsoft Graph actions. EWS fails with HTTP status 401: Unauthorized and Microsoft Graph with Failed to get Microsoft Graph resource ID. As far as I can tell this new account is not set up to use MFA. We do have MFA turned on for the accounts we use to administer O365 but that's only about 4 accounts, everyone else isn't set up to use it. Am I missing an additional privilege or roll somewhere?

Mike Resseler
Product Manager
Posts: 5695
Liked: 599 times
Joined: Feb 08, 2013 3:08 pm
Full Name: Mike Resseler
Location: Belgium
Contact:

Re: Issues authenticating

Post by Mike Resseler » Feb 19, 2019 5:59 am

Hey Matt,
Are you doing this with version 2? Or trying this with the beta of version 3?

Polina
Veeam Software
Posts: 787
Liked: 108 times
Joined: Oct 21, 2011 11:22 am
Full Name: Polina Vasileva
Contact:

Re: Issues authenticating

Post by Polina » Feb 19, 2019 8:08 am

Matt,

If you're running v2 with a non-MFA enabled account, it only requires username and password to authenticate to EWS and Graph, so it might be worth to ensure that you provide the correct credentials. Also, for the newly configured accounts, it takes some time to sync the changes in O365; if you use it immediately with VBO the authentication may fail.

mlange
Enthusiast
Posts: 30
Liked: 1 time
Joined: Sep 02, 2014 3:06 pm
Contact:

Re: Issues authenticating

Post by mlange » Feb 19, 2019 1:16 pm

Mike - Sorry, using version 2. You just dropped the beta and I didn't think to include the version.

Polina - I've verified the credentials. The account was made on Friday so I would hope that would be enough time. I was unsure what all was needed for EWS and Graph, but if it's just username and password I'll go back and dig deeper into the account to see what it's doing.

Polina
Veeam Software
Posts: 787
Liked: 108 times
Joined: Oct 21, 2011 11:22 am
Full Name: Polina Vasileva
Contact:

Re: Issues authenticating

Post by Polina » Feb 19, 2019 1:30 pm

Matt,

If the credentials are correct and you can successfully login with this account to portal.office.com, then it might be something with your LAN proxy settings. In this case, it'd be best to open a support case and let our engineers verify the configuration.

mlange
Enthusiast
Posts: 30
Liked: 1 time
Joined: Sep 02, 2014 3:06 pm
Contact:

Re: Issues authenticating

Post by mlange » Feb 19, 2019 1:53 pm

I can log into portal.office.com. Would the proxy settings affect two accounts differently because if I use the global admin account everything works as expected.

nielsengelen
Veeam Software
Posts: 2613
Liked: 538 times
Joined: Jul 15, 2013 11:09 am
Full Name: Niels Engelen
Contact:

Re: Issues authenticating

Post by nielsengelen » Feb 19, 2019 2:02 pm

As you are getting a 401 Unauthorized result within Graph, it should/could mean 2 things:
- Wrong credentials
- Wrong permissions for the ApplicationImpersonation

I would suggest opening a support case as the logs will most likely tell more and they can assist you.
VCP-DCV
Veeam Certified Architect (VMCA)
http://foonet.be

Mike Resseler
Product Manager
Posts: 5695
Liked: 599 times
Joined: Feb 08, 2013 3:08 pm
Full Name: Mike Resseler
Location: Belgium
Contact:

Re: Issues authenticating

Post by Mike Resseler » Feb 20, 2019 6:29 am

Matt,

I agree. One thing you should know is that when you can open the portal, it doesn't mean you have all the rights to the grap API. For example, see what you can do in the Azure AD admin portal. It might be that you are not allowed to do things over there.

mlange
Enthusiast
Posts: 30
Liked: 1 time
Joined: Sep 02, 2014 3:06 pm
Contact:

Re: Issues authenticating

Post by mlange » Feb 26, 2019 1:44 pm

Ack, I forgot to post that I opened, and have since closed, a case; 03423925. It turned out it was the Conditional Access Policy. Apparently Office 365 and Azure AD don't quite work the way I thought they did, and when I was initially looking into the MFA status for the account it was saying it wasn't enabled. Turns out that particular page really only applies to tenants that don't have Azure AD licensing, and if you do have AAD licensing that page is ignored. I just wasn't familiar enough with some of the idiosyncrasies of O365/AAD to find exactly what I was looking for.

Mike Resseler
Product Manager
Posts: 5695
Liked: 599 times
Joined: Feb 08, 2013 3:08 pm
Full Name: Mike Resseler
Location: Belgium
Contact:

Re: Issues authenticating

Post by Mike Resseler » Feb 27, 2019 6:36 am

Matt,

Good to hear. Thanks for letting us know. I am sure some others will have the same issues at some point. I am not going to comment too much on AAD/ O365 but sometimes it is indeed rather difficult to figure out what portal to use, and depending on the portal, the procedures seem to be quite different also :-(

Post Reply

Who is online

Users browsing this forum: No registered users and 3 guests