Unable to Auto Discover O365 Exchange Mailboxes

Hi Simon,

This error might mean that you haven't setup access node in your configuration.

Can you confirm if you have added access node(s) to the configuration? Each access nodes needs Exchange package be installed. Please refer to this documents

https://documentation.commvault.com/commvault/v11_sp16/article?p=28823.htm

https://documentation.commvault.com/commvault/v11_sp16/article?p=92971.htm

@Simon Delicata 

The properties of the Mailbox agent will have a section for mailbox access nodes. These clients should have Exchange package installed on them. Make sure one or more are selected.

HI @Scott Reynolds & @Leila Mehrabi 

Thanks both for your feedback. I reread the instructions, stopped on step 1, and installed the Exchange Agent on the commcell  .

Having done that, the error has now gone. I’ve now got a powershell problem, from the CvRTTagCreator.log (I’ve removed the service user USN):

0000 0001 02/02 09:42:23 ### BEGIN CvRTagCreator
0000 0001 02/02 09:42:23 ### Executing CvRTagCreatorDotNet40.exe
0000 0001 02/02 09:42:23 ### Starting process C:\Program Files\CommVault\Simpana\Base\\CvRTagCreatorDotNet40.exe...
0000 0001 02/02 09:42:23 ### BEGIN CvRTagCreatorDotNet
0000 0001 02/02 09:42:24 ### SetExecutionPolicyForPS - START
0000 0001 02/02 09:42:24 ### Running script for updating Execution policy ..
0000 0001 02/02 09:42:25 ### Current effective execution policy[RemoteSigned]
0000 0001 02/02 09:42:25 ### SetExecutionPolicyForPS - END
0000 0001 02/02 09:42:25 ### Executing Remote Exchange PowerShell script: 'Get-Mailbox -ResultSize unlimited -Filter {CustomAttribute15 -ne 'IsACommvaultServiceAccount'} | Where-Object {($_.IsMailboxEnabled -eq 1) -and ($_.IsValid -eq 1) -and  ($_.OriginatingServer -like "*.outlook.*") -and (-not ($_.Alias -like "DiscoverySearchMailbox*")) } | fl DisplayName, UserPrincipalName, PrimarySmtpAddress, Name, Alias, OriginatingServer, ExchangeGuid, ExternalDirectoryObjectId, ServerLegacyDN, LegacyExchangeDN, OriginatingServer, ArchiveGuid, ArchiveName, ArchiveDatabase, IssueWarningQuota, ProhibitSendQuota, ProhibitSendReceiveQuota, ArchiveQuota, ArchiveWarningQuota, RecipientTypeDetails | Out-File "C:\Program Files\CommVault\Simpana\Base\Temp\psexport1643794943.txt" -width 1023' as servicegroupuser@ourtenent
0000 0001 02/02 09:42:25 ### Connect Uri Set To = https://outlook.office365.com/powershell-liveid/
0000 0001 02/02 09:42:25 ### $Session = New-PSSession -ConfigurationName "Microsoft.Exchange" -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $Cred -Authentication Basic -AllowRedirection
0000 0001 02/02 09:42:25 ### Import-PSSession $Session
0000 0001 02/02 09:42:25 ### if (Get-Command 'Enable-OrganizationCustomization' -errorAction SilentlyContinue) { $currentErrorAction = $ErrorActionPreference; $ErrorActionPreference = 'silentlyContinue'; Enable-OrganizationCustomization; $ErrorActionPreference = $currentErrorAction }
0000 0001 02/02 09:42:26 ### Exception in PowerShell script: 'System.Management.Automation.ParameterBindingValidationException: Cannot validate argument on parameter 'Session'. The argument is null. Provide a valid value for the argument, and then try running the command again. ---> System.Management.Automation.ValidationMetadataException: The argument is null. Provide a valid value for the argument, and then try running the command again.
   at System.Management.Automation.ValidateNotNullAttribute.Validate(Object arguments, EngineIntrinsics engineIntrinsics)
   at System.Management.Automation.ParameterBinderBase.BindParameter(CommandParameterInternal parameter, CompiledCommandParameter parameterMetadata, ParameterBindingFlags flags)
   --- End of inner exception stack trace ---
   at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input)
   at CvRTagCreator.PSCaller.RunRemoteExchangeScript(String script, ICollection`1& results, String& errMsg, String user, String pswd, MSCloudRegion cloudRegion)'
0000 0001 02/02 09:42:26 ### END CvRTagCreatorDotNet
0000 0001 02/02 09:42:26 ### END CvRTagCreator

If I use the following two commands on a powershell command-line, the if( Get-Command… and Get-Mailbox -ResultS commands that are trying to be run execute correctly :

import-module ExchangeOnlineManagement

Connect-Exchangeonline

Also, FWIW, the following two commands have been successfully executed :

New-AuthenticationPolicy BasicAllowedOnlyForServiceAccountEWSandPS -AllowBasicAuthPowershell -AllowBasicAuthWebServices

Set-user -Identity CVServiceAccount -AuthenticationPolicy "BasicAllowedOnlyForServiceAccountEWSandPS”

If it matters, this is running on a Windows 2012 non R2 server. Shall I go and raise a ticket ?

Thanks again

Simon

Hi @Scott Reynolds , 

I ran this on our commcell which is also the access node, and supplied the service credentials to the first line, and on running the second got :

PS C:\temp> $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powersh
ell -Credential $UserCredential -Authentication Basic -AllowRedirection
WARNING: Your connection has been redirected to the following URI:
"https://ps.outlook.com/PowerShell-LiveID?PSVersion=5.1.14409.1018 "
New-PSSession : [ps.outlook.com] Connecting to remote server ps.outlook.com failed with the following error message :
Access is denied. For more information, see the about_Remote_Troubleshooting Help topic.
At line:1 char:12
+ $Session = New-PSSession -ConfigurationName Microsoft.Exchange -Conne ...
+            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotin
   gTransportException
    + FullyQualifiedErrorId : AccessDenied,PSSessionOpenFailed
PS C:\temp>

many thanks

Simon

@Simon Delicata Appears there is an issue with the service account being used to connect to Exchange online. 

“Access is denied. For more information, see the about_Remote_Troubleshooting Help topic.”

Are you sure the account meets the requirements? Is MFA enabled on the account?
 

An Exchange Online service account, which must meet the following requirements:

• Must be an online mailbox or a shared mailbox.

• Must be created in Microsoft Azure AD only.

• Must have either the Exchange administrator role or the global administrator role assigned so that the administrator can discover and back up Office 365 group mailboxes. For more information, see Assign admin roles in Office 365 on the Microsoft website.