Summary

During installation and initial configuration, Cayosoft Administrator performs various pre-installation checks to ensure all required components are installed and system settings are configured properly. However, there is the possibility that some settings may have been updated after the Cayosoft Administrator installation, or some settings were not properly verified during installation. This article provides an extensive set of verification procedures to ensure the system where Cayosoft Administration Service is installed and configured properly.

Published: January 14, 2014
Updated: 12/1/2015
Applies to: Cayosoft Administrator 3.x or later

---

In this article:

Typical error messages

 

Issue	Requirements
Office 365 connection account password issues
Error: Authentication Error: Password has expired. You must call the Connect-MsolService cmdlet before calling any other cmdlets. Incorrect configuration for the Office 365 connection account: account password is expired or account must change the password on first sign in. Please sign in to Office 365 with that account credentials, resolve any issues and restart the Administration Service.	Credentials provided for Office 365 connection account must be valid to log on to Microsoft Online Portal. For resolution, please see step-by-step instructions in section 1.2.
Office 365 connection account issues
Incorrect configuration for the Office 365 connection account: multi-factor authentication (MFA) is enabled. Please disable MFA for the Office 365 Service Account and restart the Administration Service.  Error: Showing a modal dialog box or form when the application is not running in UserInteractive mode is not a valid operation. Specify the ServiceNotification or DefaultDesktopOnly style to display a notification from a service application. [outlook.office365.com] Connecting to remote server outlook.office365.com failed with the following error message: Access is denied.  For more information, see the about_Remote_Troubleshooting Help topic.	Office 365 connection account should be a cloud-only account, i.e. an account that is not synchronized with Azure AD Connect. For resolution, please see step-by-step instructions in section 1.3. Office 365 connection account should be excluded from Azure AD Security Defaults. For resolution, please see step-by-step instructions in section 1.4. Multi-factor Authentication (MFA) should be disabled for the Office 365 connection account. For resolution, please see step-by-step instructions in section 1.5.
Error: AADSTS53003 Blocked by conditional access.	Office 365 connection account should be excluded from all access policies, including Baseline policies and custom policies. For resolution, please see  step-by-step instructions in section 1.4 .
AADSTS50053: You've tried to sign in too many times with an incorrect User ID or password.	The Azure AD Direct authentication should be enabled.  For resolution, please see this Microsoft article.
Exchange Online connection issues
[ps.outlook.com] Closing remote server shell instance failed with the following error message: Access is denied. For more information, see the about_Remote_Troubleshooting Help topic. Cannot validate argument on parameter 'Session'. The argument is null. Supply a non-null argument and try the command again. [outlook.office365.com] Connecting to remote server outlook.office365.com failed with the following error message: The WinRM client cannot process the request. Basic authentication is currently disabled in the client configuration. Change the client configuration and try the request again. For more information, see the about_Remote_Troubleshooting Help topic.	Connection account must be assigned a Global administrator role in Office 365 (Azure AD). Connection account must be a member of the Organization Management role in Exchange Online. Check your firewall settings. For resolution, please see  step-by-step instructions in sections 1.5 and 1.6.
The WS-Management service cannot process the request. This user has exceeded the maximum number of concurrent shells allowed for this plugin. Close at least one open shell or raise the plugin quota for this user.	A maximum of three simultaneous remote PowerShell connections to Exchange Online Organization is allowed.  For resolution, please see this Microsoft article.
Skype Online connection issues
The WS-Management service cannot process the request. This user has exceeded the maximum number of concurrent shells allowed for this plugin. Close at least one open shell or raise the plugin quota for this user.	A maximum of three simultaneous remote connections to Skype Online is allowed.  For resolution, please see this Microsoft article.

  

1. Verify Office 365 connection account

1.1 Check Office 365 settings in the Cayosoft Administrator Console

Requirements

• Office 365 extension must be enabled.
• Valid Office 365 credentials must be provided as an Office 365 connection account.
• Check Settings and the Run Components Check and resolve any reported errors.

How to check 

1. In the Cayosoft Administrator console, navigate to Microsoft Office 365 Extension.
2. Check the Office 365 credentials filed - this is the Administrator Account being used to connect to Office 365. There are several steps listed below to verify this account is configured properly.
3. Click the Check Settings command from the menu in the right pane and confirm it completes without an error.
4. Run the Run Components Check and confirm all required components are installed.
   
   

 

1.2 Set a new password for Office 365 connection account

Requirement

• Credentials provided for Office 365 connection account must be valid to log on to Microsoft Online Portal.

How to check

1. Open Office 365 Admin Panel and reset the password for Office 365 connection account. Make sure to clear the checkbox Make this user change their password when they first sign in:
   
   
2. Log on to https://portal.office.com with the new password for Office 365 connection account, to make sure these credentials would be valid.
3. Open Cayosoft Administrator Console
4. Click [...] button next to the account
5. Specify a new password for Office 365 connection account
6. Restart Administration Service to make sure all sessions are fully re-established:
   
   

Optionally set the account password to never expire

By default passwords for all accounts in Office 365 are set to expire.
You can change that and set the account password to never expire. Office 365 native Admin Center does not provide a user interface for this, so you have 2 options:

1. Do it in PowerShell, as described for example here: https://support.office.com/en-us/article/set-an-individual-user-s-password-to-never-expire-f493e3af-e1d8-4668-9211-230c245a0466
2. Do it in Cayosoft Administrator Web UI, after you reset the password and make the Cayosoft Administrator work again. So, after Cayosoft Administrator re-establishes the connection to Office 365:
   1. Open Web UI
   2. Navigate to Microsoft Office 365 -> Active Users 
   3. Search for the connection account used to connect to Office 365
   4. Click Reset Password action
   5. Check Password never expires

 

1.3 Check if Office 365 connection account is a cloud-only account

Requirement

• Office 365 connection account should be a cloud-only account, i.e. an account that is not synchronized with Azure AD Connect.

How to resolve

1. Navigate to https://login.microsoftonline.com
2. Open Office 365 Admin Center, open the list of Active users and locate the Office 365 connection account in the list. Make sure the Sync Type column states "In cloud" for the account, as shown on the screenshot below. 

 

1.4 Exclude Office 365 connection account from conditional access policies

Requirement

• Office 365 connection account should be excluded from conditional access policies, including Baseline policies and custom policies.

How to resolve

For step-by-step instructions please see Configuring Azure AD Conditional Access Policies for Office 365 connection account KB.

 

1.5 Exclude Office 365 connection account from Azure AD Security Defaults

Requirement

• Office 365 connection account should be excluded from Azure AD Security Defaults.

How to resolve

Сheck if Azure AD Security Defaults is enabled:

For step-by-step instructions please see Azure AD Security Defaults impact on Cayosoft Administrator KB.

 

1.6 Disable Multi-Factor Authentication (MFA) for Office 365 Connection account 

Requirement

• Multi-factor Authentication (MFA) should be disabled for the Office 365 connection account.

How to resolve

1. Navigate to https://login.microsoftonline.com
2. Open Office 365 Admin Center, open the list of Active users and locate the Office 365 connection account in the list. 
3. Open the account properties, and click the Manage multi-factor authentication link.
4. In the list of accounts, locate the connection account and make sure the Multi-factor Auth Status column states "Disabled", as shown on the screenshot below.
5. Save changes. 
6. If you are not able to log on with the Office 365 Administrator Account credentials, obtain credentials with the appropriate settings that allow you to log on to the Microsoft portal.

 

1.7 Verify Office 365 role for the Office 365 connection account

Requirement

• Office 365 connection account must be assigned a Global administrator role in Office 365 (Azure AD). For more details, please see Permissions required for AD and Office 365 accounts used by Cayosoft Administrator article.

How to check

1. In the Office 365 Admin Portal, select the account you intend to use as the connection account for Cayosoft Administrator.
2. Open Roles dialog for the selected account
3. Make sure the Global administrator role is assigned, as shown on the screenshot below.
   1. See Microsoft KB http://support.microsoft.com/kb/2905767 for details on ensuring the administrative account has Office 365 Administrative Credentials.

 

1.8 Verify Exchange Online roles for the Office 365 connection account

Requirement

• Office 365 connection account must be a member of the Organization Management role in Exchange Online.

How to check

1. In the Office 365 Admin Portal, expand Admin centers navigation group and select Exchange to go to Exchange Admin Center
2. Select Permissions section in the Exchange Admin Center
3. On the Admin Roles tab, select "Organization Management" role and click Edit
4. Make sure the Office 365 connection account is listed in the Members list for the "Organization Management" role, as shown on the screenshot below.

Note: In some tenants, the Organization Management role is configured to have a TenantAdmins_<Number> ("Company Administrator") admin role as a member. In that case, select the TenantAdmins_<Number> role in the list and make sure the Office 365 connection account is listed as its member in the right pane.

 

  

2. Verify Required Software Components and System Settings

2.1 Verify required Software components

Requirement

• The MSOnline PowerShell for Azure AD and Azure AD PowerShell for Graph components are required for Cayosoft Administrator to connect to and manage Microsoft Azure Active Directory and Microsoft Office 365.

How to check

1. On the system where Administration Service is deployed, run the Cayosoft Requirements Check from the Start menu
2. Make sure both components are marked as <Installed>: MSOnline PowerShell for Azure Active Directory and Azure Active Directory PowerShell for Graph. See the screenshot below.
   
   

2.2 Verify PowerShell remoting is enabled

Requirement

• PowerShell Remoting must be enabled.

How to check

1. Click Start (or press the Windows flag key). The windows start menu or start screen should appear.

2. Type PowerShell ISE then press ENTER. The PowerShell ISE editor will appear on the screen.

3. In the PowerShell ISE Window do the following:
   1. Type Enter-PSSession –computername localhost then press ENTER
4. No warnings or messages should appear, only the command prompt should be visible, as shown on the screenshot below.

How to resolve

1. If a warning message appears you will need to enable PowerShell Remoting by running the Enable-psremoting command.
   
   

 

2.3 Verify PowerShell Execution Policy is Unrestricted or RemoteSigned

Requirement

• PowerShell Execution Policy must be set to Unrestricted or RemoteSigned.

How to check

1. In the PowerShell ISE Window do the following
2. Type get-ExecutionPolicy then press ENTER
3. A value of Unrestricted or RemoteSigned should be returned, as shown on the screenshot below

How to resolve

1. If the system does not return Unrestricted or RemoteSigned then use the command set-executionpolicy remotesigned to set the policy
   
   

 

2.4 Verify Windows Remoting (WINRM) is Enabled

Requirement

• Windows Remoting service must be started.

How to check

1. In the PowerShell ISE Window do the following
2. Type Get-service winrm then press ENTER
3. You should see the message displayed below

How to resolve

1. If the system indicates WINRM is not running then use the command net start winrm to start the service.
   
   

 

2.5 Verify Basic Authentication is Enabled for Windows Remoting (WINRM)

Requirement

• Basic Authentication must be enabled for Windows Remoting on the machine running the Cayosoft Administrator.

How to check

1. In the PowerShell ISE Window do the following
2. Type winrm get winrm/config/client/auth then press ENTER. You should see the message as on the screenshot below. Notice that Basic must be set to "true".
   
   

How to resolve

1. If Basic = false is displayed, then use the command winrm set winrm/config/service/auth '@{Basic="true"}' to enable Basic Authentication

 

3. Test Connection

3.1 Test Office 365 Connection Outside of Cayosoft Administrator

To eliminate the possibility that Firewall, Proxy, PowerShell or other Environmental Problems are preventing the Cayosoft Administrator to connect to Office 365, perform the following tasks:

1. Click Start (or press the Windows flag key). The windows start menu or start screen should appear.
2. Type PowerShell ISE then press ENTER. The PowerShell ISE editor will appear on the screen.
3. Type $Office365_Credentials = Get-Credential then press ENTER
   
   1. You will be prompted for a username and password. Enter the account and password of the Global Admin account you will use as the connection account for Cayosoft Administrator then click OK.
      
4. Type connect-msolservice -credential $Office365 Credentials then press ENTER.
   
   1. If you see a warning appear that your Microsoft Online Service Module is out of date, you should update it after you have completed this test.
5. Type $Session_Exch = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $Office365_Credentials -Authentication Basic -AllowRedirection then press ENTER
   1. You should see a prompt with text similar to:
      WARNING: Your connection has been redirected to the following URI: "https://pod51044psh.outlook.com/powershell-liveid?PSVersion=3.0 "
      
      
6. Type Import-PSSession $Session_Exch then press ENTER
   1. You may see text similar to indicating a successful connection has been established:
      WARNING: The names of some imported commands from the module 'tmp_aa015xtf.uot' include unapproved verbs that might make them less discoverable. To find the commands with unapproved verbs, run the Import-Module command again with the Verbose parameter. For a list of approved verbs, type Get-Verb.
      
      ModuleType Name ExportedCommands
      ---------- ---- ----------------
      Script tmp_aa015xtf.uot {Add-AvailabilityAddressSpace, Add-DistributionGroupMember, Add-MailboxFolderPermission, Add-MailboxPermission...}

 

3.2 Next Steps

If the connect was successful, but you still experience problems, please contact Cayosoft Support for additional assistance.

If the connection failed please verify that Antivirus, Firewall or Proxy Settings are not preventing this computer from connecting to Office 365.

  

4. Maximum number of Exchange Online connections exceeded

You may get the error due to the limitation of a number of sessions to Exchange Online. A maximum of three simultaneous remote PowerShell connections to Exchange Online Organization is allowed. You should wait for 30 minutes, after that the sessions that are not used would be closed and the error won't be displayed. For more details, please see this Microsoft article. 

 

5. Maximum number of Skype Online connections exceeded

How to resolve

You may get the error due to the limitation of a number of sessions to Skype Online. A maximum of three simultaneous remote connections to Skype Online is allowed. You should wait for 30 minutes, after that the sessions that are not used would be closed and the error won't be displayed. For more details, please see this Microsoft article.