Microsoft 365 Audit Sync Errors

Error Message: Connecting to remote server outlook.office365.com failed with the following error message : Access is denied

Possible Reasons:

1. The username or password is incorrect. If the password has been changed, update the same in the product's admin page and restart the product.
2. The account doesn't have enough permission to fetch audits. Check if the account has the required privilege (SharePoint administrator and Exchange admin, or Global admin) from Microsoft 365 admin portal.
3. It is due to deprecated basic authentication, follow the below steps to update it to Exchange V2 module.

Steps to configure Exchange V2 module:

Open PoweShell as administrator in SharePoint Manager Plus installed machine and execute Install-Module -Name ExchangeOnlineManagement to install Exchange online module.

1. If the account is non-MFA, then execute the below script one by one,
$cred=(Get-Credential);
Connect-ExchangeOnline -Credential $cred
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-2) -EndDate (Get-Date) -RecordType SharePoint -ResultSize 1
Disconnect-ExchangeOnline
• If we can get data using the above script, then execute the below DB query.
• Open connectDB.bat from <product-installation-directory>/bin and execute
  • update onlineprofiles set audit_type=1;
• Restart the SharePoint Manager Plus and wait for the next audit sync.
2. If the account is MFA enabled, then create an Azure application and execute the below script one by one,
$cred=(Get-Credential);
Connect-ExchangeOnline -CertificateFilePath "D:\Program Files\SharePoint Manager Plus\conf\SharePoint.pfx" -CertificatePassword (ConvertTo-SecureString -String "YOUR_CERTIFICATE_PASSWORD" -AsPlainText -Force) -AppID "YOUR_AZURE_APPLICATION_ID" -Organization "YOUR_DOMAIN_NAME.onmicrosoft.com"
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-2) -EndDate (Get-Date) -RecordType SharePoint -ResultSize 1
Disconnect-ExchangeOnline
• If we can get data using the above script, then execute the below DB query.
• Open connectDB.bat from <product-installation-directory>/bin and execute
  • update onlineprofiles set audit_type=2;
• Restart the SharePoint Manager Plus and wait for the next audit sync.

Error Message: Connecting to remote server outlook.office365.com failed with the following error message : The WinRM client cannot process the request. Basic authentication is currently disabled in the client configuration.

Possible reason: Basic authentication has been disabled in SharePoint Manager Plus installed machine.

Follow the steps below to enable Basic authentication:

• Open group policy settings in SharePoint Manager Plus installed machine.
• Navigate to Computer Configuration → Administrative Templates → Windows Components → Windows Remote Management (WinRM) → WinRM Client → Allow Basic authentication → Set to enabled

Error Message: Search-UnifiedAuditLog : The term ‘Search-UnifiedAuditLog’ is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

Possible reason: Check if the account has the required privilege (SharePoint administrator, Exchange admin, or Global admin) from Microsoft 365 admin portal.

Error Message: The term 'Connect-ExchangeOnline' is not recognized as a name of a cmdlet

Possible reason: Exchange online module is not installed.

Open PowerShell as administrator in SharePoint Manager Plus installed machine and execute the below script.

Error Message: Could not find or load assembly (Libraries)

(E.g) Could not load file or assembly "System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" or one of its dependencies. The system cannot find the file specified.

Possible reason: Need to install or update Microsoft .Net Framework

Download or upgrade the .Net version (Runtime) to 4.8 or above.

Restart the SharePoint Manager Plus and wait for the audit sync.

Error Message: ExchangeOnlineManagement.psm1 cannot be loaded because running scripts is disabled on this system.

Possible reason: PowerShell Execution Policy may be set to Restricted

Execute the below command as administrator in PowerShell to set the execution policy to RemoteSigned

Wait for the next audit sync to fetch the data.

If a different error message is displayed, kindly send the screenshots to support@sharepointmanagerplus.com

Previous Topic Next Topic