O365 collection fails autodiscovery with "error: (401) Unauthorized"

Article: 100039735
Last Published: 2022-05-11
Ratings: 0 0
Product(s): eDiscovery Platform

Problem

When performing a collection from eDP v8.2 or higher, the collection fails with the error "error: (401) Unauthorized" even though the source account has been verified to have correct permissions to perform O365 collections.

Error Message

Error found in "ExchangeAutoDiscovery_output.log":

2017-08-22 15:46:59,159 [2868] INFO  ngeAutoDiscovery - Found 1 Exchange Server(s) in input config xml
2017-08-22 15:46:59,159 [2868] INFO  ngeAutoDiscovery - Profile computed for Exchange server BPOS: is eDP-O365-TemplateProfile-Do not Delete
2017-08-22 15:46:59,191 [2868] INFO  ngeAutoDiscovery - Profile already exists for exchange server: BPOS:
2017-08-22 15:46:59,191 [2868] INFO  ngeAutoDiscovery - Exchange server is cloud based. Will use O365Autodiscover to get server name
2017-08-22 15:46:59,304 [2868] INFO  O365AutoDiscover - getExchangeProfileDetails : NTML Auth is enabled in Exchange Profile 
2017-08-22 15:46:59,311 [2868] INFO  O365AutoDiscover - Credentials for AutoDiscoveryService: Domain: [DOMAIN_NAME], UserID: [SOURCE_ACCOUNT]
2017-08-22 15:46:59,311 [2868] DEBUG O365AutoDiscover - Default credentials are used for creating webrequest with requestUrl : https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml   request : <Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/requestschema/2006"><Request><EMailAddress>SOURCE_ACCOUNT@EMAIL.COM</EMailAddress><AcceptableResponseSchema>http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a</AcceptableResponseSchema></Request></Autodiscover> 
2017-08-22 15:46:59,311 [2868] INFO  O365AutoDiscover -  credentials passed explicitly used for creating webrequest 
2017-08-22 15:46:59,477 [2868] INFO  O365AutoDiscover - WebException in getExchangeProfileDetails(): Attempt: 1 Exception Type: System.Net.WebException, Exception Message: The remote server returned an error: (401) Unauthorized., Status: ProtocolError
2017-08-22 15:46:59,478 [2868] ERROR ngeAutoDiscovery - Unexpected Error occured while performing Exchange AutoDiscovery
2017-08-22 15:46:59,485 [2868] ERROR ngeAutoDiscovery -    at System.Net.HttpWebRequest.GetResponse()
   at ExchangeAutoDiscovery.O365AutoDiscover.getExchangeProfileDetails(O365InputDetails inputDetails) in D:\builds\checkout_ESA-V82_CHF5\src\C#\ExchangeAutoDiscovery\ExchangeAutoDiscovery\O365AutoDiscover.cs:line 149
   at ExchangeAutoDiscovery.Program.getExchangeProfiles(AutoDiscoveryParams autoDiscoveryParams) in D:\builds\checkout_ESA-V82_CHF5\src\C#\ExchangeAutoDiscovery\ExchangeAutoDiscovery\Program.cs:line 95

Cause

The ESA property "esa.icp.exchange.online.isntlmauthreq" is set to true forcing NTLM authentication.

Solution

Verify that the following line exists in the "ExchangeAutoDiscovery_output.log":

2017-08-22 15:46:59,304 [2868] INFO  O365AutoDiscover - getExchangeProfileDetails : NTML Auth is enabled in Exchange Profile 

Use the following steps to remove the ESA property "esa.icp.exchange.online.isntlmauthreq":
  1. Login to the eDP user interface
  2. Go to "System > Support Features"
  3. From the drop-down menu select "Property Browser"
  4. In the field "Name of property to change" type in "esa.icp.exchange.online.isntlmauthreq"
  5. Check the box "Confirm change. Are you sure?*"
  6. Click "Submit"
  7. A prompt will be displayed advising that the property has been removed.
  8. Verify O365 collections are successful

Was this content helpful?