Summary

This article provides a summary of  "Access is denied" error encountered in connecting to Exchange Online while trying to perform any exchange related operation. Below error is contained in detailed error message: Connecting to remote server outlook.office365.com failed with the following error message : Access is denied.

Applies To

This article applies to:

• MachPanel v6 and Later.
• MachPanel's Exchange Online extension for its CSP Module.
• Exchange Online

Overview

With the introduction of OAuth 2.0 in the year 2020 from Microsoft as an enhanced, more secure and modern authentication system, Microsoft had informed its users that the older Basic Authentication via PowerShell EXO V1 will be discontinued. It is confirmed that by October 2022 the Modern Authentication via OAuth v2.0 (PowerShell EXO v2) will fully replace the older mechanism.

To further speed up the process, Microsoft started identifying the tenants under its O365 cloud which were not using Basic Authentication and have stopped / blocked them from using it. If you have a new tenant for which Security Defaults are enabled, Basic Authentication will seize to work. For existing tenants as well, their Basic Authentication will stop working if detected by Microsoft and you will start facing the above highlighted error if this is done by Microsoft.

The changes affect all operations via Basic Authentication for Exchange Online whether being performed directly via PowerShell EXO v1, or via any 3rd Party App using PowerShell EXO v1.

More about this on links below:

• https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/disable-basic-authentication-in-exchange-online
• https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online#protocol-recommendation

MachPanel and Exchange Online

MachPanel currently uses PwerShell EXO v1 to communicate with Exchange Online and hence the recent changes by Microsoft as mentioned above will affect control panel's ability to perform operations on a tenant.

While we are working on making changes to our panel to upgrade to PowerShell EXO v2, the current workaround is to allow basic authentication. Please follow steps highlighted in solution section below:

Solution

In the Tenant you can run this Command  Get-OrganizationConfig | Format-List basic*

(You will see the entry/value: 255 which stand for All Basic Authentications Blocked i.e. BasicAuthBlockedApps=255)

After That you can activate the basic Authentication.

More details and pictorial illustration given on links below:

• https://techcommunity.microsoft.com/t5/exchange-team-blog/basic-authentication-and-exchange-online-june-2021-update/ba-p/2454827
• https://techcommunity.microsoft.com/t5/exchange-team-blog/basic-authentication-and-exchange-online-september-2021-update/ba-p/2772210

Some Images:

After activating the Basic Authentication for Exchange Online Remote PowerShell and running this Command  Get-OrganizationConfig | Format-List basic*

(You will see the entry/value: 239 which stand for All Basic Authentications Allowed i.e. BasicAuthBlockedApps = 239)

Finally you can now connect via Exchnge Online OAuth v1.0

If steps are completed as highlighted above, then the procedure has been completed and you are done! However, sometimes when you hit "Run Test", you will get a different message. Please review below details to cater that scenario:

After Run test:

If you see following message:

These are the current Basic authentication settings:

The organization configuration is dehydrated. In the Microsoft datacenters, an organization configuration being dehydrated means that it has certain objects consolidated to save space. In this state, configuration cannot be modified. This can be changed by running the Enable-OrganizationCustomization cmdlet.
Note that you are only required to run the Enable-OrganizationCustomization cmdlet once in your Exchange Online organization. If you attempt to run the cmdlet again, you will get an error.

To handle this you have to connect tenant using ExchangeOnlineShell module, run the command: Enable-OrganizationCustomization.

 Steps:

1. Open PowerShell
2. Install-Module -Name ExchangeOnlineManagement -RequiredVersion 2.0.5
   1. (skip if already installed)
3. Import-Module ExchangeOnlineManagement
4. Connect-ExchangeOnline
   1. Login
5. Enable-OrganizationCustomization

 After this perform the above steps again from start.

To make this change, you need to login with the Global Admin, then go to the Help section and run this command Diag: Enable Basic Auth in EXO