Articles in this section

See more
Print

KB20180503-1 Troubleshooting connection to Office 365

Avatar
Cayosoft
  • Updated
Follow

Summary

During installation and initial configuration, Cayosoft Administrator performs various pre-installation checks to ensure all required components are installed and system settings are configured properly. However, there is the possibility that some settings may have been updated after the Cayosoft Administrator installation, or some settings were not properly verified during installation. This article provides an extensive set of verification procedures to ensure the system where Cayosoft Administration Service is installed is configured properly.

Published: January 14, 2014
Updated: 12/1/2015
Applies to: Cayosoft Administrator 3.x or later

In this article:

Typical error messages

  • [ps.outlook.com] Closing remote server shell instance failed with the following error message: Access is denied. For more information, see the about_Remote_Troubleshooting Help topic. Cannot validate argument on parameter 'Session'. The argument is null. Supply a non-null argument and try the command again.

  • [outlook.office365.com] Connecting to remote server outlook.office365.com failed with the following error message: The WinRM client cannot process the request. Basic authentication is currently disabled in the client configuration. Change the client configuration and try the request again. For more information, see the about_Remote_Troubleshooting Help topic.

  • Error: Authentication Error: Password has expired. You must call the Connect-MsolService cmdlet before calling any other cmdlets.

  • Error: Showing a modal dialog box or form when the application is not running in UserInteractive mode is not a valid operation. Specify the ServiceNotification or DefaultDesktopOnly style to display a notification from a service application.

  • Incorrect configuration for the Office 365 connection account: multi-factor authentication (MFA) is enabled. Please disable MFA for the Office 365 Service Account and restart the Administration Service.

  • Incorrect configuration for the Office 365 connection account: account password is expired or account must change the password on first sign in. Please sign in to Office 365 with that account credentials, resolve any issues and restart the Administration Service.

  • Error: AADSTS53003 Blocked by conditional access.

  • AADSTS50053: You've tried to sign in too many times with an incorrect User ID or password.

  • The WS-Management service cannot process the request. This user has exceeded the maximum number of concurrent shells allowed for this plugin. Close at least one open shell or raise the plugin quota for this user.

 

Office 365 connection account

  • Credentials provided for Office 365 connection account must be valid to log on to Microsoft Online Portal.
  • Should be a cloud-only account, i.e. an account that is not synchronized with Azure AD Connect
  • Multi-factor Authentication (MFA) should be disabled for the account
  • Should be excluded from all access policies, including Baseline policies and custom policies
  • In case of AADSTS50053 error, the Azure AD Direct authentication should be enabled. For more details, please see this Microsoft article. 

Step-by-step instructions.

 

Role membership

 

Required Components

  • The MSOnline PowerShell for Azure AD and Azure AD PowerShell for Graph components are required for Cayosoft Administrator to connect to and manage Microsoft Azure Active Directory and Microsoft Office 365. Step-by-step instructions.

 

System Settings

 

Office 365 connection account expired

  • Open Office 365 Admin Panel and reset the password for Office 365 connection account.
  • Log on to https://portal.office.com with connection account credentials, to make sure these credentials would be valid.
  • In Cayosoft Administrator Console specify a new password for Office 365 connection account.

Step-by-step instructions

 

Maximum number of Skype Online connections exceeded

The error "The WS-Management service cannot process the request. This user has exceeded the maximum number of concurrent shells allowed for this plugin. Close at least one open shell or raise the plugin quota for this user." occurs due to the limitation for a number of sessions to Skype Online. The maximum number of sessions is five. You should wait for 30 minutes, after that the sessions that are not used would be closed and the error won't be displayed. 

 

1. Verify Office 365 connection account

1.1 Check Office 365 settings in the Cayosoft Administrator Console

Requirements

  • Office 365 extension must be enabled
  • Valid Office 365 credentials must be provided as an Office 365 connection account
  • Check Settings and the Run Components Check and resolve any reported errors

How to check requirements

  1. In the Cayosoft Administrator console, navigate to Configuration > Microsoft Office 365.
  2. Check the Office 365 credentials filed - this is the Administrator Account being used to connect to Office 365. There are several steps listed below to verify this account is configured properly.
  3. Click the Check Settings command from the menu in the right pane and confirm it completes without an error.
  4. Run the Run Components Check and confirm all required components are installed.

1.2 Verify Office 365 Connection account directly on the Microsoft Online Portal site

Requirements

  • Credentials provided for Office 365 connection account must be valid to log on to Microsoft Online Portal.
  • Should be a cloud-only account, i.e. an account that is not synchronized with Azure AD Connect
  • Multi-factor Authentication (MFA) should be disabled for the account
  • Office 365 connection account should be excluded from all access policies, including Baseline policies and custom policies
Note: You can use Trusted IPs feature that bypasses two-step verification for users who sign in from the company intranet. For more information, please see this article https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings#trusted-ips.

 

How to check requirements

  1. Navigate to https://login.microsoftonline.com
  2. Attempt to log on with the same Office 365 Administrator Account credentials, used to configure Office 365 Extension above.
    1. Successful login using this account would validate the password expiration status, sing-in status and whether the account is set to change the password on next logon.
  3. Open Office 365 Admin Center, open the list of Active users and locate the Office 365 connection account in the list. Make sure the Sync Type column states "In cloud" for the account, as shown on the screenshot below.
  4. Check that password is set to never expire following the steps described in this Microsoft article: Set an individual user's password to never expire
  5. Open the account properties, and click the Manage multi-factor authentication link.
  6. In the list of accounts, locate the connection account and make sure the Multi-factor Auth Status column states "Disabled", as shown on the screenshot below.
  7. Navigate to Admin centers > Azure Active Directories 
  8. In the Azure portal, on the left navbar, click Azure Active Directory
  9. On the Azure Active Directory page, in the Security section, click Conditional access
  10. Exclude Office 365 connection account from all access policies, including Baseline and custom policies.
  11. Save changes.

 

How to resolve

  1. If you are not able to log on with the Office 365 Administrator Account credentials, obtain credentials do with the appropriate settings that allow you to log on to the Microsoft portal.

 

 

1.3 Verify Office 365 role for the Office 365 connection account

Requirements

  • Office 365 connection account must be assigned a Global administrator role in Office 365 (Azure AD)

How to check

  1. In the Office 365 Admin Portal, select the account you intend to use as the connection account for Cayosoft Administrator.
  2. Open Roles dialog for the selected account
  3. Make sure the Global administrator role is assigned, as shown on the screenshot below.
    1. See Microsoft KB http://support.microsoft.com/kb/2905767 for details on ensuring the administrative account has Office 365 Administrative Credentials.

 

1.4 Verify Exchange Online roles for the Office 365 connection account

Requirements

  • Office 365 connection account must be a member of Organization Management role in Exchange Online

How to check

  1. In the Office 365 Admin Portal, expand Admin centers navigation group and select Exchange to go to Exchange Admin Center
  2. Select Permissions section in the Exchange Admin Center
  3. On the Admin Roles tab, select "Organization Management" role and click Edit
  4. Make sure the Office 365 connection account is listed in the Members list for the "Organization Management" role, as shown on the screenshot below.

Note: In some tenants, Organization Management role is configured to have a TenantAdmins_<Number> ("Company Administrator") admin role as a member. In that case, select the TenantAdmins_<Number> role in the list and make sure the Office 365 connection account is listed as its member in the right pane.

 

 

2. Verify Required Software Components

Requirements

  • The MSOnline PowerShell for Azure AD and Azure AD PowerShell for Graph components are required for Cayosoft Administrator to connect to and manage Microsoft Azure Active Directory and Microsoft Office 365.

How to check requirements

  1. On the system where Administration Service is deployed, run the Cayosoft Requirements Check from the Start menu
  2. Make sure both components are marked as <Installed>: MSOnline PowerShell for Azure Active Directory and Azure Active Directory PowerShell for Graph. See screenshot below.

 

3. Verify System Settings

3.1 Open the PowerShell prompt before proceeding

  1. Click Start (or press the Windows flag key). The windows start menu or start screen should appear.
  2. Type PowerShell ISE then press ENTER. The PowerShell ISE editor will appear on the screen.

3.2 Verify PowerShell Remoting is Enabled

Requirements

  • PowerShell Remoting must be enabled

How to check

  1. In the PowerShell ISE Window do the following
  2. Type Enter-PSSession –computername localhost then press ENTER
  3. No warnings or messages should appear, only the command prompt should be visible, as shown on the screenshot below.

How to resolve

  1. If a warning message appears you will need to enable PowerShell Remoting by running the Enable-psremoting command.

 

3.3 Verify PowerShell Execution Policy is Unrestricted or RemoteSigned

Requirements

  • PowerShell Execution Policy must be set to Unrestricted or RemoteSigned

How to check

  1. In the PowerShell ISE Window do the following
  2. Type get-ExecutionPolicy then press ENTER
  3. A value of Unrestricted or RemoteSigned should be returned, as shown on the screenshot below

How to resolve

  1. If the system does not return Unrestricted or RemoteSigned then use the command set-executionpolicy remotesigned to set the policy

 

3.4 Verify Windows Remoting (WINRM) is Enabled

Requirements

  • Windows Remoting service must be started

How to check

  1. In the PowerShell ISE Window do the following
  2. Type Get-service winrm then press ENTER
  3. You should see the message displayed below

How to resolve

  1. If the system indicates WINRM is not running then use the command net start winrm to start the service.

 

3.5 Verify Basic Authentication is Enabled for Windows Remoting (WINRM)

Requirements

  • Basic Authentication must be enabled for Windows Remoting on the machine running the Cayosoft Administrator

How to check

  1. In the PowerShell ISE Window do the following
  2. Type winrm get winrm/config/client/auth then press ENTER. You should see the message as on the screenshot below. Notice that Basic must be set to "true".

How to resolve

  1. If Basic = false is displayed, then use the command winrm set winrm/config/service/auth '@{Basic="true"}' to enable Basic Authentication

 

4. Test Connection

4.1 Test Office 365 Connection Outside of Cayosoft Administrator

To eliminate the possibility that Firewall, Proxy, PowerShell or other Environmental Problems are preventing the Cayosoft Administrator to connect to Office 365, perform the following tasks:

  1. Click Start (or press the Windows flag key). The windows start menu or start screen should appear.
  2. Type PowerShell ISE then press ENTER. The PowerShell ISE editor will appear on the screen.
  3. Type $Office365_Credentials = Get-Credential then press ENTER
    1. You will be prompted for a username and password. Enter the account and password of the Global Admin account you will use as the connection account for Cayosoft Administrator then click OK.
      Get-Credential_2.png
  4. Type connect-msolservice -credential $Office365 Credentials then press ENTER.
    1. If you see a warning appear that your Microsoft Online Service Module is out of date, you should update it after you have completed this test.
  5. Type $Session_Exch = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $Office365_Credentials -Authentication Basic -AllowRedirection then press ENTER
    1. You should see a prompt with text similar to:
      WARNING: Your connection has been redirected to the following URI: "https://pod51044psh.outlook.com/powershell-liveid?PSVersion=3.0 "

  6. Type Import-PSSession $Session_Exch then press ENTER
    1. You may see text similar to indicating a successful connection has been established:
      WARNING: The names of some imported commands from the module 'tmp_aa015xtf.uot' include unapproved verbs that might make them less discoverable. To find the commands with unapproved verbs, run the Import-Module command again with the Verbose parameter. For a list of approved verbs, type Get-Verb.

      ModuleType Name ExportedCommands
      ---------- ---- ----------------
      Script tmp_aa015xtf.uot {Add-AvailabilityAddressSpace, Add-DistributionGroupMember, Add-MailboxFolderPermission, Add-MailboxPermission...}

 

4.2 Next Steps

If the connect was successful, but you still experience problems, please contact Cayosoft Support for additional assistance.

If the connection failed please verify that Antivirus, Firewall or Proxy Settings are not preventing this computer from connecting to Office 365.

 

5. Set a new password for Office 365 connection account

5.1 Reset the password in Office 365 Admin Panel

Open Office 365 Admin Panel and reset the password for this account. Make sure to clear the checkbox "Make this user change their password":

O365pwd.png

5.2 Check new credentials in Office.com

Log on to https://portal.office.com with the new password for Office 365 connection account, to make sure these credentials would be valid.

5.3 Set new password in Cayosoft Administrator Console

  1. Open Cayosoft Administrator Console
  2. Click [...] button next to the account
  3. Specify a new password for Office 365 connection account
  4. Restart Administration Service to make sure all sessions are fully re-established

    O365pwd2.png

5.4 Optionally set the account password to never expire

By default passwords for all accounts in Office 365 are set to expire.
You can change that and set the account password to never expire. Office 365 native Admin Center does not provide a user interface for this, so you have 2 options:

  1. Do it in PowerShell, as described for example here: https://support.office.com/en-us/article/set-an-individual-user-s-password-to-never-expire-f493e3af-e1d8-4668-9211-230c245a0466
  2. Do it in Cayosoft Administrator Web UI, after you reset the password and make Cayosoft Administrator work again. So, after Cayosoft Administrator re-establishes connection to Office 365:

    1. Open Web UI

    2. Navigate to Microsoft Office 365 -> Active Users

    3. Search for the connection account used to connect to Office 365

    4. Select it and run Reset Password action:

      O365pwd3.png

    5. There you would have a UI option to set the password to never expire. 

 

Related articles

Comments

0 comments

Please sign in to leave a comment.