✖
 
 

Troubleshooting Tips

  • Azure AD module is incompatible with 32-bit version of the product.

    • You must be using 32 bit version of M365 Manager Plus. Windows Azure Active Directory Module v2 (AzureAD) must be installed to manage and generate reports on Azure Active Directory, which is not available in 32 bit version.

    Hence follow the below mentioned steps,

    1. Download and install M365 Manager Plus (64-bit)

    2. To install Azure Active Directory Module v2 (Azure AD):

      • Install PowerShellGet using this link
      • Install nuget package provide in PowerShell with the following command Install-PackageProvider -Name Nuget -MinimumVersion 2.8.5.201 -Force;
      • Now, use the below command to install Azure AD v2 (AzureAD) module Install-Module -Name AzureAD -Force
      • If the problem still persists, your firewall might be blocking it. Please contact m365managerplus-support@manageengine.com.

  • MicrosoftTeams module must be installed.

    • If MicrosoftTeams module is not installed, you will not be able to view any general reports on Skype for Business.

    Note: PowerShell version 5.1 or higher is required to install MicrosoftTeams PowerShell module.

    Steps to download and install MicrosoftTeams Module.

    1. To check if the module is installed, open PowerShell and enter Get-module -ListAvailable -Name MicrosoftTeams. If MicrosoftTeams module is already installed, it will be listed in the result. If not, run the below PowerShell command in as an administrator,

      • Install-Module -Name MicrosoftTeams -Force;

    2. After installing the module, please restart the application.

  • MicrosoftTeams module is incompatible with 32-bit version of the product.

    • You must be using 32 bit version of M365 Manager Plus. MicrosoftTeams, which is required to generate reports on Skype for Business is not available for 32-bit version.

    To resolve this issue,

    1. Download and install M365 Manager Plus (64-bit)

    2. Follow these steps to install MicrosoftTeams module.

    3. After installing the module, please restart the application.

  • Updating the Microsoft Teams PowerShell module

    • Microsoft retired all the earlier versions of the Microsoft Teams PowerShell module from June 15, 2022. Only the module versions present in the 4.x.x series or later are supported now. Therefore, it is recommended to update the Microsoft Teams PowerShell module to the latest version available for smooth functioning of the product.

    Follow the steps below to update the Microsoft Teams PowerShell module:

    1. Run the PowerShell command below as an administrator on the machine where the product is installed:

      • Update-Module -Name MicrosoftTeams -Force;

    2. Once the module has been updated, please restart the product.

    3. If the problem persists please contact m365managerplus-support@manageengine.com.

  • .NET version need to be upgraded to generate this report.

    • For General Skype reports, Microsoft .NET framework version 4.8 or higher is required.

    1. To check if Microsoft .NET Framework is installed, open the Command Prompt from Run. Enter the following command:

      reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\full" /v version

    2. Check the displayed version. If the version is below 4.8, install Microsoft .NET Framework version 4.8 from here.

  • Internet Connection! Please check your internet connection.

    1. The product requires an active internet connection to interact and function as desired. Please make sure that your internet connection is active and stable.

    2. To allow the product to interact with Microsoft 365, add these ports and url’s to your firewall’s allowed to connect to the internet list. Failure to do so will result in certain features not working as intended.

  • Database backup failed.

    • PostgreSQL

    The backup fails due to one of the following reasons.

    1. The backup file size exceeds the available free space.
      • Free up some space in the product installation directory and try again.
    2. User Logon Account does not have Write permission for the backup folder
      • Provide the User Logon Account Write permission for <product_installation_directory>/Patch/backupDB folder.
    3. The database is down.
      • Bundled PostgreSQL users,
        • Navigate to <product _installation_directory>\bin folder
        • Start Command Prompt as an administrator
        • Execute the command startDB.bat to start the database.
      • External PostgreSQL users,
        • Open Run window using Winkey + R
        • Type services.msc
        • Locate PostgreSQL service based on version installed.
        • Right click and choose Start.
        • If the External PostgreSQL is not listed
          • Open Command Prompt
          • Navigate to <postgres_installation_directory>\bin
          • Execute pg_ctl -D "<postgres_installation_directory>\data" start
    4. Missing pg_dump.exe file in the <product _installation_directory>\pgsql\bin folder.
      • Download the file from this page based on the PostgreSQL version you are on. To find the PostgreSQL version. Run the below command in <product _installation_directory>\pgsql folder.
        • postgres -V

    If the problem still persists please contact m365managerplus-support@manageengine.com.

    MSSQL

    The backup fails due to one of the following reasons.

    1. The backup file size exceeds the available free space.
      • Free up some space in the product installation directory and MSSQL Installation directory and try again.
    2. User Logon Account does not have Write permission for the backup folder
      • Provide the User Logon Account Write permission for
        - <product_installation_directory>/Patch/backupDB folder.
        - <MSSQL_SERVER_installation_directory>/MSSQL/Backup folder.
    3. Database Version incompatibility.
      • M365 Manager Plus supports MSSQL 2008 and above. Please migrate to a compatible database version.
    4. The database is down.
      • To start your database,
        • Ensure that the TCP/IP port is set to static in the SQL Server Configuration Manager.
        • Ensure that the SQL Server Browser is Enabled and Running.
        • Restart the MSSQL Server.

    If the problem still persists please contact m365managerplus-support@manageengine.com.

  • Elasticsearch has been switched to read-only mode due to low disk space (<1 GB). Please free up some space.

    • Elasticsearch is a distributed search engine which helps to analyze huge volumes of data in near real-time. Unlike conventional techniques, Elasticsearch fetches data real quick which results in reduced report generation time, quicker threat detection, and a lot more. In M365 Manager Plus we use Elasticsearch in the following modules,

    Recommended:

    It is advised to have at least 1 GB free hard disk space for Elasticsearch to function effectively. If the disk space runs low, Elasticsearch will be switched to read-only mode, during which the data collected from native will not be stored in the engine. To enable Write for Elasticsearch,

    1. Free up space in hard disk to maintain the recommended threshold.
    2. Restart the product.

  • .NET version needs to be upgraded to generate this report.

    • For General Skype reports, Microsoft .NET framework version 4.8 or higher is required.

      1. To check if Microsoft .NET Framework is installed, open the Command Prompt from Run. Enter the following command:

        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\full" /v version

      2. Check the displayed version. If the version is below 4.8, install Microsoft .NET Framework version 4.8 from here.

  • MicrosoftTeams module is incompatible with 32-bit version of the product.

    • You must be using 32 bit version of M365 Manager Plus. MicrosoftTeams, which is required to generate reports on Skype for Business is not available for 32-bit version.

    To resolve this issue,

    1. Download and install M365 Manager Plus (64-bit)
    2. Follow these steps to install MicrosoftTeams module.
    3. After installing the module, please restart the application.

  • Tenant configuration errors

    • You will see one of the following conditions if tenant configuration is incomplete.

  • REST API Access column in Tenant Settings shows Update Permission / Grant Admin Consent / Enable Now.

    • If the REST API Access column shows Enable Now:

    Cause

    • The above prompt is shown if you have not granted all the permissions required by M365 Manager Plus while configuring the tenant.

    If the REST API Access column shows Update Permissions:

    Cause

    • The above prompt is shown if M365 Manager Plus needs a few additional permissions for the newly added features to work.

    If the REST API Access column shows Grant Admin Consent:

    Cause

    • The above prompt is shown if admin has not provided consent for the permissions that were provided for the applications.

    Solutions

    • Click Tenant Settings button on the right-side corner of the product.
    • Click on the action required under the REST API Access column. You will be navigated to the Microsoft 365 login page.
    • Login as Global Admin and proceed to provide consent.

    Note: Follow the steps in this document to grant the required permissions for REST API access.

  • REST API Access column in Tenant Settings shows 'Update Permissions'

    • Cause

    • The above error will be shown if M365 Manager Plus needs a few additional permissions for the newly added features to work.

    Solution

    • Follow the steps in this document to grant the required permissions for REST API access.
  • 1. Service Account column in Tenant Settings shows 'Configure'.
    2. Status column in Tenant Settings shows 'Failed to create a service account' or 'Service account is not configured'.

    • Cause

    • One of the above errors will be shown if the service account creation could not be completed.

    Solution

    • Follow the steps below to resolve this issue.
      • Create an Microsoft 365 service account with following roles: Exchange Admin, Global Reader, Privileged Authentication Admin, Privileged Role Admin, Teams Service Admin, and User Admin.
      • In M365 Manager Plus, click on the Configure option under the Service Account column.
      • Provide the credentials of the service account you had created.
      • Click on Update.
  • Status column in Tenant Settings shows 'Service Account password has expired'.

    • Cause

    • The above error will be shown if the service account password has expired.

    Solution

    • Reset the service account password from its user profile in the Microsoft 365 admin center, and update the new password for the service account in the configured tenant.
  • Status column in Tenant Settings shows 'Azure AD Secret Key is invalid'.

    • Cause

    • The above error will be shown if the Application Secret Key is invalid or has expired.

    Solution

    • Update the Secret Key in the product's Tenant Settings.
    • Check this document to know how to get your Azure AD Application Secret Key.
  • To test the connectivity of your Microsoft 365

    1. To test the connectivity of your Microsoft 365 environment using PowerShell, follow the steps listed here.

  • Dashboard graph empty

    1. Make sure that the report corresponding to the graph can be generated without any issue for the specified number of days.

    2. If the report cannot be generated, follow the troubeshooting tips listed based on the cause of error.

    3. If the report can be generated but the graph in the dashboard does not mirror the values, contact m365managerplus-support@manageengine.com .

  • Access Denied

    1. Make sure that you have entered the correct user name and password.

    2. Check if the user account is blocked. To check if an account is blocked, follow the steps listed here.

    3. Check if the required roles are assigned to the service account. Click here to view the list of required roles.

    4. Run the Office365Troubleshoot.ps1 script file

      • Open PowerShell as the administrator.
      • Run the command Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force -Scope process.
      • Run the below script:
        <install-dir>/bin/Office365Troubleshoot.ps1

        • Note: <install-dir> here refers to the directory in which you have installed the M365 Manager Plus application.

      • Enter the username and password of the configured Microsoft 365 account.
      • If Exchange session returns a value Error Occurred, the problem is with the configured account.
        • If the problem occurs when you try to configure an Microsoft 365 tenant, try using a dedicated service account to configure M365 Manager Plus by following the steps listed here.
        • If the problem occurs at any other stage, please contact m365managerplus-support@manageengine.com with a screenshot of the error.
  • Invalid account

    1. Make sure that you have entered the correct user name and password.

    2. Run the Office365Troubleshoot.ps1 script file

      • Open PowerShell as the administrator.
      • Run the command Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force -Scope process.
      • Run the below script:
        <install-dir>/bin/Office365Troubleshoot.ps1

        • Note: <install-dir> here refers to the directory in which you have installed the M365 Manager Plus application.

      • Enter the username and password of the configured Microsoft 365 account.
  • Password Expired

    1. Please check if you can log in to the Microsoft 365 portal with the user account.

    2. Reset the account password and try again.

  • Logon failure

    1. Please check if you can log in to the Microsoft 365 portal with the user tenant.

    2. Check if the user account is blocked. To check if an tenant is blocked, follow the steps listed here.

  • Open Session failure/ Connection Error

    1. The error occurs when a PSSession can not be opened successfully.

    2. Run the Office365Troubleshoot.ps1 script file

      • Open PowerShell as the administrator.
      • Run the command Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force -Scope process.
      • Run the below script:
        <install-dir>/bin/Office365Troubleshoot.ps1

        • Note: <install-dir> here refers to the directory in which you have installed the M365 Manager Plus application.

      • Enter the username and password of the configured Microsoft 365 account.
      • If Exchange session returns a value Error Occurred, the problem is with the configured account.
        • If the problem occurs when you try to configure an Microsoft 365 tenant, try using a dedicated service account to configure M365 Manager Plus by following the steps listed here.
        • If the problem occurs at any other stage, the error may be temporary and try again after some time. If the issue persists, please contact m365managerplus-support@manageengine.com .
  • Permission denied

    1. Run the Office365Troubleshoot.ps1 script file

      • Open PowerShell as the administrator.
      • Run the command Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force -Scope process.
      • Run the below script:
        <install-dir>/bin/Office365Troubleshoot.ps1

        • Note: <install-dir> here refers to the directory in which you have installed the M365 Manager Plus application.

      • Enter the username and password of the configured Microsoft 365 account.
      • If Exchange session returns a value Error Occurred, the problem is with the configured account.
        • If the problem occurs when you try to configure an Microsoft 365 tenant, try using a dedicated service account to configure M365 Manager Plus by following the steps listed here.
        • If the problem occurs at any other stage, please contact m365managerplus-support@manageengine.com with a screenshot of the error.
  • Authentication Error

    1. Make sure that you have entered the correct user name and password.

    2. MicrosoftTeams module does not support App Password. If the Service Account is MFA-enabled, please provide the account password.

    3. The Microsoft 365 authentication system may be not functioning properly. Please try again after some time.

  • Operation Stopped
    1. Microsoft Online Services Sign-in Assistant may not be ready yet. To restart the service:
      • Type services.msc in Run and hit enter.
      • Find Microsoft Online Services Sign-in Assistant, right click and select restart.
    2. This error may arise due to credentials without proper permission when the product is installed as a service. To resolve this, try using Domain User account as a Service Logon account. To do this:
      • Type services.msc in Run and hit enter.
      • Right click ManageEngine M365 Manager Plus and select Properties.
      • Select Log On tab.
      • Select This Account and type the valid credentials.
      • Click OK.
    3. Your tenant might not be available in default Azure environment :

      • Click Tenant Settings option found at the top right corner.

      • Choose the correct Azure cloud environment from Azure Environment drop-down.

    4. If the problem still persists, run the Office365Troubleshoot.ps1 script file a
      • Open PowerShell as the administrator
      • Run the command Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force -Scope process.
      5. Run the below script: <installdir>/bin/Office365Troubleshoot.ps1

      Note: <install-dir> here refers to the directory in which you have installed the M365 Manager Plus application.

  • Unified Audit Log must be enabled to fetch data

    • The following reports require Unified Audit Log to be enabled:

    • Azure Admin Activity
    • SharePoint Admin Activity
    • All OneDrive activity reports

    To enable the collection of Unified Audit Log data, follow the steps mentioned below.

    Enable collection of unified audit log data through Microsoft Purview.

    1. Sign in to the Microsoft Purview portal.
    2. Select Audit from the sidebar.
    3. Click the Start recording user and admin activity banner to turn on auditing for your tenant.
  • Incomplete Audit Reports

    • To generate audit reports for all operations, follow the steps listed below.

    • Open PowerShell as the administrator.
    • Run the command Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force -Scope process.
    • Run the below script:
      <install-dir>/bin/Office365Troubleshoot.ps1

      • Note: <install-dir> here refers to the directory in which you have installed the M365 Manager Plus application.

    • Enter the username and password of the configured Microsoft 365 account.
    • If Exchange session returns a value Error Occurred, please contact m365managerplus-support@manageengine.com to resolve this issue.
    • If the Exchange session returns a success value, follow the steps listed below:
      • Run the script provided below to enable auditing for the connected Microsoft 365 tenant.
        Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
      • Proceed with enabling auditing for the individual mailboxes.

        • To enable complete auditing for all mailboxes

        Get-Mailbox -ResultSize unlimited |Set-Mailbox -AuditEnabled $true -AuditOwner Create,HardDelete,MailboxLogin,Move,MoveToDeletedItems,SoftDelete,Update -AuditAdmin Copy,Create,FolderBind,HardDelete,MessageBind,Move,MoveToDeletedItems, SendAs,SendOnBehalf,SoftDelete,Update -AuditDelegate Create, FolderBind, SendAs, SendOnBehalf, SoftDelete, HardDelete, Update, Move, MoveToDeletedItems

        To enable complete auditing for particular mailboxes

        Set-Mailbox -Identity abc@microsoft.com -AuditEnabled $true -AuditOwner Create,HardDelete,MailboxLogin,Move,MoveToDeletedItems,SoftDelete,Update -AuditAdmin Copy,Create,FolderBind,HardDelete,MessageBind,Move,MoveToDeletedItems, SendAs,SendOnBehalf,SoftDelete,Update -AuditDelegate Create, FolderBind, SendAs, SendOnBehalf, SoftDelete, HardDelete, Update, Move, MoveToDeletedItems

        To enable auditing for select operations for all mailboxes

        Get-Mailbox -ResultSize unlimited |Set-Mailbox -AuditEnabled $true -AuditOwner Create,HardDelete,MailboxLogin,Move,MoveToDeletedItems,SoftDelete,Update -AuditAdmin Copy,Create,FolderBind,HardDelete,MessageBind,Move,MoveToDeletedItems,SendAs, SendOnBehalf,SoftDelete,Update -AuditDelegate Create, FolderBind, SendAs, SendOnBehalf, SoftDelete, HardDelete, Update, Move, MoveToDeletedItems


        Identify the operations that you want to be audited from the underlined section and exclude the rest from the script.
  • Incomplete User Reports or Mailbox Reports

    • If any of the generated reports under users or mailboxes section do not contain information for certain individuals, then follow the steps listed below.

    • Check if the user’s information is displayed in the All Users report or Mailbox Users report.
    • If the user’s information is displayed there, the reason for the partial data in the report is that the specific user is not managed by M365 Manager Plus.

    To rectify this, purchase more licenses or reassign licenses to accommodate the user by following the steps listed below:

    • In M365 Manager Plus, select the Tenant Settings option found at the top right corner.
    • Click Manage Licenses link at the right-corner of the window.
    • Click the Total Number of Users in the Managed Users column. This will open a pop-up.
    • Click Search icon to search for the specified user
    • Select the check box against the particular user
    • Click OK to save the selection.
  • Data generation failed. Update REST API permissions in Tenant Settings.

    • Cause

    This error occurs when:

    • The product fails to fetch data from Azure AD due to insufficient REST API permissions.
    • There are any internal issues in Azure AD. If the required permissions are provided, Please try again.

    Solution: Update REST API permissions with the following steps.

    • Go to Tenant Settings at the top-right corner of the product's home page.
    • Click on Update Permissions in the Rest API Access column for the required tenant.
    • You will now be redirected to Microsoft 365 login. Enter the credentials of a Global Administrator account.
    • Click on Accept to grant Read Service Health permissions and to update the REST API permissions successfully.
  • This Microsoft 365 account has been blocked

    1. This account has been blocked by the administrator.

    2. Contact your administrator to login to M365 Manager Plus.

  • The data for this report is currently being generated in the background.

    • This message indicates that,

    1. The data for this report is currently being generated in the background for some other report opted by you.

    2. Or the data is already being generated in the background by some other user.

    Note: If the data generation was successful in either of the above mentioned cases, it will be updated automatically. Hence try switching to any other report and check the required report at a later time.

  • Please choose the correct Azure environment.

    • Click Tenant Settings option found at the top right corner.

    • Choose the correct Azure cloud environment from Azure Environment drop-down.

  • Invalid service account password.

    • Cause

    • This error will be shown if the service account password entered is incorrect or has expired.
    • Also, if the service account was configured earlier, using the application password.

    Solution

    • Create a new password in the Microsoft 365 portal and update it in the product.
    • If MFA has not been enabled, reset the service account password in the Microsoft 365 portal and update the password in the product.
    • If MFA has been enabled, bypass MFA for the service account. Follow the steps listed here to bypass MFA.
  • Invalid Application Secret Value.

    • Cause

    • This error message is shown if the application secret value entered has been deleted or expired.

    Solution

    • Create a new application secret value and update the same in the product's tenant settings.

    Steps :

    • Sign in to Azure AD portal using the credentials of a Global Administrator account.
    • Select Azure Active Directory from the left pane.
    • Select App registrations.
    • Select All applications.
    • Search for the application name which is configured in the product.
    • Select Certificates & secrets.
    • Select Client secrets and click New client secret.

    • Enter the appropriate values and Add.

    • Now, follow the Steps to modify a Microsoft 365 tenant to update the secret in product.`
  • Missing Azure AD application.

    • Cause

    • This error message is shown if the Azure AD application is deleted.

    Solution

    • Configure a new application in the Azure portal. Follow the steps listed here to configure your application, manually.
  • Missing Azure AD application scope or permission.
    • Update the necessary permissions in the application.
    • You can check and update the permissions by navigating to Tenant Settings > Rest API Access > Update Permissions.
    • If Rest API Access is Enabled, Please follow the steps mentioned here to verify and update the recommended permissions.

    Note: A newly configured application might take some time to reflect the change in permissions. Please wait for some time or refresh the tenant by clicking on Tenant Settings and click on Refresh icon under the Actions column of the tenant to be refreshed

    If the issue still persists, please contact m365managerplus-support@manageengine.com.

  • Data collection API is not available in this environment.
    • Unable to generate reports that use the /identity/conditionalAccess/ endpoint of data collection API as it is not supported for national clouds like Azure AD for US Government and Azure AD China.
  • Tenant does not have a SharePoint Online license.
    • Unable to generate SharePoint Online reports in M365 Manager Plus as your tenant does not have a SharePoint Online license. Kindly purchase a Microsoft SharePoint Online license and try again.
  • The Microsoft Graph API required to generate this report is not supported for your tenant.
    • This error occurs when the /reports endpoint of Microsoft Graph API is not supported for national clouds like Azure AD for US Government. M365 Manager Plus is unable to generate certain reports that use the /reports endpoint to retrieve information from Azure AD.
  • User information hashed in reports.

    • Error: Identifiable user information hashed in M365 Manager Plus reports.

    Solution: Due to Microsoft's privacy settings, identifiable user information may appear hashed in M365 Manager Plus reports. Follow the steps below to show identifiable user information in reports.

    • Login to the Microsoft 365 admin center as a Global Administrator.
    • Go to Settings > Org Settings > Services.
    • Select Reports from the given list.
    • Uncheck Display concealed user, group, and site names in all reports.
    • Click Save.

    Note: Please note that the changes will automatically reflect in the product only after the next report sync.

    To perform manual sync, go to Product scheduler > DefaultRestAPISync > Run now.

  • The cache being updated for report generation.

    • Error: The cache is being updated. Please try generating the report again after a few minutes.

    Cause: Frequently accessed data is updated in the cache for faster report generation. This message appears due to one of the following reasons:

    • You are generating a report for the first time. In this case, the cache will be updated before report generation.
    • We refresh the cache regularly to keep data updated. Your report generation interfered with the cache update.

    Resolution: Wait a few minutes and try again to generate the report.

  • Cache initialization failed.

    • The speed of report generation is increased by using the cache memory. While generating reports, cache initialization might fail if the cache folder does not have the required permissions. Follow these steps to grant required permissions to the cache folder.

    • Shutdown M365 Manager Plus.
      • If the product runs as an application: Start → All Programs → M365 Manager Plus → Stop M365 Manager Plus.
      • If the product runs as a Windows service: Start → Run →Type "services.msc" → Stop ManageEngine M365 Manager Plus.
    • Go to <product_installation_directory>/bin folder.
    • Open Command Prompt as an administrator.
    • Run setPermissions.bat.

    These steps will grant the required permissions to the cache folder in <product_installation_directory>/mmp/cache. If the issue persists, please contact m365managerplus-support@manageengine.com.

  • Enable access to Azure AD applications configured for M365 Manager Plus

    • ManageEngine M365 Manager Plus uses these applications in Azure AD to fetch data for report generation and other tasks:

    • Office 365 SharePoint Online
    • Office 365 Management APIs
    • Microsoft Graph

    Apart from the above mentioned applications, users would have to create an application that needs to be configured to M365 Manager Plus.

    When the administrator disables access to these applications, report generation will fail and users will face this error.

    To resolve this error, Azure AD application access must be enabled for all users.

    Note: Only an administrator or a user with appropriate permissions can enable access.

    To enable Azure AD application access:

    1. Login to Azure
    2. From the left pane, choose Enterprise Applications.
    3. From the Application type drop-down, choose All Applications.
    4. Find and select the application required for M365 Manager Plus.
    5. Select Properties from the left pane.
    6. Toggle to Yes next to Enable users to sign-in?
  • Install the latest MSOnline module

    • To install the latest MSOnline module:

    1. Uninstall the old MSOnline module v1.0.
      • Go to Control Panel > Uninstall a program.
      • Search for Windows Azure Active Directory Module for Windows PowerShell and uninstall it.
    2. Now, run the following command in the Command Prompt as an administrator to install latest MSOnline module in the machine where M365 Manager Plus is installed:
      • Install-Module -Name MSOnline -RequiredVersion 1.1.183.81 -Force
  • Steps to assign roles to users
    1. Login to the Azure AD admin center with a Global Admin account.
    2. Choose Active Directory > Roles and administrators from the left pane.

    3. Search for the required role using the field provided.
    4. Click on the role to be assigned.
    5. Choose Add assignment.

    6. Select Directory from the Scope type drop-down.
    7. Under the Select members* section click on the hyperlink provided and select the users to whom the role must be assigned. Use the search box, if required.

    8. Click on Next, select Active and Permanently assigned.
    9. Enter a justification for this setting in the provided text box.

    10. Click on Assign.
  • Steps to assign roles to applications
    1. Login to the Azure AD admin center with a Global Admin account.
    2. Choose Active Directory > Roles and administrators from the left pane.

    3. Search for the required role using the field provided.
    4. Click on the role to be assigned.
    5. Choose Add assignment.

    6. Select Directory from the Scope type drop-down.
    7. Under the Select members* section click on the hyperlink provided and select the applications to whom the role must be assigned. Use the search box, if required.

    8. Click on Next, select Active and Permanently assigned.
    9. Enter a justification for this setting in the provided text box.

    10. Click on Assign.
  • Basic authentication is disabled.

    • If basic authentication is disabled, the user will not be able to run Exchange-related activities through PowerShell scripting. In such cases, reports or management tasks will fail to execute. To turn on basic authentication in WinRM, open an elevated Command Prompt and run:

    winrm get winrm/config/client/auth

    If Basic = true is not found, run the below command:

    winrm set winrm/config/client/auth @{Basic="true"}

    Or,in elevated PowerShell, run the below command to modify the Windows registry:

    Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client' -Name 'AllowBasic' -Type DWord -Value '1'

    For more details, please refer to this document.

  • Unable to connect Microsoft 365. The Possible causes are.

    • Please check your internet connection.

    1. The product requires an active internet connection to interact and function as desired. Please make sure that your internet connection is active and stable.
    2. To allow the product to interact with Microsoft 365, add these ports and url’s to your firewall’s allowed to connect to the internet list. Failure to do so will result in certain features not working as intended.

    Enable TLS 1.2

    M365 Manager Plus uses .NET framework to connect to Microsoft 365 and collect the required data. Since TLS 1.0 and TLS 1.1 have been deprecated for security reasons, Microsoft 365 fails to connect with clients that use these two versions. Deprecated TLS versions will be used only if an older .NET version is used or if the older TLS versions are manually enabled. As older .NET framework won't use the latest protocol (TLS 1.2); a manual update of the registry is required.

    Execute the following PowerShell script in Run as Administrator mode in the machine in which M365 Manager Plus is installed to enforce TLS 1.2:

    If (-Not (Test-Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319')) { New-Item 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Force | Out-Null } New-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -Value '1' -PropertyType 'DWord' -Force | Out-Null New-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUsebCrypto' -Value '1' -PropertyType 'DWord' -Force | Out-Null If (-Not (Test-Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319')) { New-Item 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Force | Out-Null } New-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -Value '1' -PropertyType 'DWord' -Force | Out-Null New-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUsebCrypto' -Value '1' -PropertyType 'DWord' -Force | Out-Null If (-Not (Test-Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server')) { New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Force | Out-Null } New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Name 'Enabled' -Value '1' -PropertyType 'DWord' -Force | Out-Null New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Name 'DisabledByDefault' -Value '0' -PropertyType 'DWord' -Force | Out-Null If (-Not (Test-Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client')) { New-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Force | Out-Null } New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Name 'Enabled' -Value '1' -PropertyType 'DWord' -Force | Out-Null New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Name 'DisabledByDefault' -Value '0' -PropertyType 'DWord' -Force | Out-Null Write-Host 'TLS 1.2 has been enabled. You must restart the Windows Server for the changes to take affect.' -ForegroundColor Green
  • Other Errors

    1. Run the Office365Troubleshoot.ps1 script file

      • Open PowerShell as the administrator.
      • Run the command Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force -Scope process.
      • Run the below script:
        <install-dir>/bin/Office365Troubleshoot.ps1

        • Note: <install-dir> here refers to the directory in which you have installed the M365 Manager Plus application.

      • Enter the username and password of the configured Microsoft 365 account.
      • If Exchange session returns a value Error Occurred, the problem is with the configured account.
        • If the problem occurs when you try to configure an Microsoft 365 tenant, try using a dedicated service account to configure M365 Manager Plus by following the steps listed here.
        • If the problem occurs at any other stage, please contact m365managerplus-support@manageengine.com with a screenshot of the error.
  • Certificate used in REST API Application has been expired or not registered or removed from portal
    • Case 1: If the certificate's validity period does not match with live (your local time zone), you might receive this error from Microsoft and you won't be able to use the certificate.
    • Case 2: If the certificate has been recently uploaded in the Azure portal, you might receive this error while trying to update the same in the product. In this case, try again after a few minutes to check if the issue has been resolved.

    If your certificate has expired or not registered or removed from portal, add a new one using the following steps.

    1. Log in to Azure portal using the Global Administrator account credentials.
    2. Select Azure Active Directory from the left pane.
    3. Select App registrations.
    4. Search for the application using the Client ID.
    5. Click Certificates & secrets from the left pane.
    6. Go to Certificates and click Upload certificate. Upload your application certificate that is a .cer file.
    7. Now click Tenant Settings in M365 Manager Plus and click the Edit icon for your respective tenant.
    8. In the Modify Microsoft 365 Tenant popup, click the Edit icon for Application Details.
    9. Under Application Secret and Certificate, add the Application Security ID and upload the Application Certificate that is a .pfx file.
    10. If the user has an SSL certificate, the same can be used here. Otherwise, click here for the steps to create a self-signed certificate
    11. Click Update.
    12. Now, follow the Steps to modify a Microsoft 365 tenant to update the certificate

    Note:If the issue still persists, please contact m365managerplus-support@manageengine.com.

  • Frequent Microsoft credential pop-up
    • This can happen if the configured service account password is invalid or the account is blocked.
    • Check if MFA is enabled for the account. To bypass MFA for the account, kindly read this.
    • Once the above changes are made, close the pop-ups and wait for a few minutes. If the pop-up reappears, restart the product.
  • This report requires an Entra ID Premium license to collect the required data

    • Cause

    This message is shown when you try to generate any of the following reports in a tenant without a Microsoft Entra ID P1 or P2 license:

    • Inactive Users
    • Users Last Logon
    • MFA Registration Details
    • Reports under the Azure AD Logon Reports category

    Solution

    To resolve this, make sure your tenant has a Microsoft Entra ID P1 or P2 license.

  • Exchange Online service principle is disabled.

    • This indicates that a subscription within the tenant has lapsed or that the administrator for this tenant has disabled the application, preventing tokens from being issued for it.

    Note: Only an administrator or a user with appropriate permissions can enable access.

    To enable Exchange Online:

    1. Log in to Azure AD.
    2. From the left pane, choose Enterprise Applications.
    3. From the Application type drop-down, choose All Applications.
    4. Search for "Office 365 Exchange Online."
    5. Select Properties from the left pane.
    6. Toggle to Yes next to the Enable users to sign-in? toggle button.
    7. Click Save.
  • The service account used to run this operation is no longer available in the given tenant

    • Cause:

    This error occurs when the service account used to configure a tenant in M365 Manager Plus is disabled or deleted from the tenant.

    Solution:

    • If the service account is disabled, please enable the service account to continue using M365 Manager Plus.
    • If the service account is deleted, Follow the steps below to resolve this issue.
      1. Create an Microsoft 365 service account with the following roles: Exchange Admin, Global Reader, Privileged Authentication Admin, Privileged Role Admin, Teams Service Admin, and User Admin.
      2. In M365 Manager Plus, click on the Configure option under the Service Account column.
      3. Provide the credentials of the service account you had created.
      4. Click Update.
  • Unable to update the Entra application due to an invalid private key

    • This error can occur when you upload a new application certificate.

    Possible causes

    • The certificate was signed with an encryption algorithm other than SHA-256 with RSA.
    • A corrupted private key file was uploaded.

    Solutions

    • M365 Manager Plus only supports application certificates signed using SHA-256 with RSA. Please use a certificate that matches this requirement. You can also create a new self-signed certificate by following the steps mentioned here.
    • If the private key is corrupted, please use a valid version of the certificate and try again.
  • This service account cannot be used to fetch data due to a restriction by a Conditional Access policy

    • If the service account configured for M365 Manager Plus does not meet the requirements of a Conditional Access policy, M365 Manager Plus is unable to fetch data using the service account as the login attempt is being interrupted.

    Causes

    The following restrictions in your Conditional Access policies might prevent your service account from signing in to Microsoft Entra ID:

    • Requirement for an MFA factor
    • Login from a trusted or compliant device
    • Login from a Microsoft Entra hybrid joined device

    Solution

    To find out which Conditional Access policy is blocking the service account sign-ins, you can check the account's sign-in logs in Microsoft Entra ID by following these steps:

    1. Navigate to Identity > Monitoring & health > Sign-in logs.
    2. Search for the service account’s sign-in attempts.
    3. Apply the Status: Failure filter on the User sign-ins (non-interactive) tab.
    4. Click the failed attempts to open their details.
    5. Select the Conditional Access tab to see which policies were applied.

    This service account cannot be used to fetch data due to a restriction by a Conditional Access policy

    Once you've identified the Conditional Access policy, you can make the appropriate changes to ensure your service account logs in to Microsoft Entra ID.

  • Unable to establish Exchange Online Connection due to blocked product files.

    • M365 Manager Plus requires specific DLL files located in the <Installation_dir>\lib\native\ExchangeOnlineManagement directory to connect with Exchange Online and collect data. If these files are blocked from execution, M365 Manager Plus will be unable to establish a connection to Exchange Online, preventing all Exchange Online operations.

    Cause

    The DLL files might have been blocked from being executed by your computer since they were created in an external system.

    Solution

    You will have to unblock the DLL files so they can be executed in your server. You can do this by running the following script in Windows PowerShell as an administrator: dir "<Installation_dir>\lib\native\ExchangeOnlineManagement" | Unblock-File

    You can verify if the files have been unblocked by following the steps given below:

    1. Right-click on any of the DLL files in the <Installation_dir>\lib\ directory\native\ExchangeOnlineManagement directory.
    2. Click Properties
    3. Verify if the Unblock option is checked.

    The Properties window of a DLL file indicating the file has been blocked.

  • Creation of client secrets is blocked by a tenant-wide policy. Please contact your tenant administrator for more information.

    • M365 Manager Plus uses an Entra application to obtain permissions and tokens for admin tasks via GraphAPI. Registering the Entra app grants the tool access to read or manage tenant resources. You must create a client secret to authenticate securely during the OAuth 2.0 flow. Without this secret, Microsoft 365 cannot confirm the app’s identity or authorize its actions.

    However, in some cases, you cannot create a client secret in your tenant due to a restriction in your tenant-wide policy.

    Cause

    Your tenantAppManagementPolicy might be configured to restrict creating new client secrets for Entra applications in your tenant. Refer to this Microsoft document for more details on this policy,

    Solution

    You will have to edit the passwordAddition attribute in your tenantAppManagementPolicy using Microsoft GraphAPI to allow creation of client secrets in your tenant.

  • The role required to collect data for the MFA status report is not assigned.

    • Cause: The MFA Status report could not be generated because the Entra application registered in M365 Manager Plus does not have either the Privileged Authentication Administrator or Global Reader role.

    Solution: Assign either of these roles to the Entra application registered in M365 Manager Plus by following the steps listed here and try again.

  • Insufficient privilege to perform the operation

    1. Appropriate scopes must be assigned to perform this task. Click here to know the required scopes.

    2. When REST API is enabled appropriate roles are required for the Azure application to perform privileged operations like Reset password, Block/Unblock users, Change authentication information, Delete user, Restore user and Hard delete user.

      • Helpdesk Administrator role should be assigned to allow technicians to update details of non-administrators and other help desk administrators.

      • Privileged Authentication Administrator or Global Administrator role should be assigned to allow technicians to update details of all users (administrators and non-administrators).

      • Appropriate role must be assigned to perform this task. Click here to know the steps to assign the same.

    3. Contact your administrator.

  • Invalid argument error

      • Kindly refer the below table and take necessary actions while invalid argument error is thrown when a management task is performed.

      Operation Title Roles required Action to be done
      Microsoft 365 Group Modification Security Group Creation and Membership role In Exchange Admin Center, please make sure that the service account is part of Organization Management role group which has Security Group Creation and Membership role.
  • Added to delayed task

      • When a new object is created, it will take some time for it to sync to Azure AD. Any management task that is to be performed on the newly created object will fail as the object will not be found. In this case, M365 Manager Plus will schedule those tasks to be executed after one minute. If that fails, it will be scheduled to be executed five minutes later. A list of these tasks can be found by clicking the Delayed Tasks button on the top-right corner of the Management tab.

  • This invitation is blocked by the cross-tenant access settings of either your tenant or the external user's

    • Cause:

    This error occurs in the Create Bulk Guest Users task, when:

    • Admins in either your organization or the invited user's organization have not configured cross-tenant access settings to allow the invitation.
    • Your external user is not from the same national cloud as your tenant, you will not be able to invite them to your organization. National clouds are isolated instances of Azure with their own environment and endpoints. The national clouds include Azure Global, Azure Government, and Azure China. For example, if your Entra ID tenant is in Azure Global, you cannot invite a user whose account is in Azure China or Azure Government.

    Solution:

    • Refer to this link to know more on how to configure cross-tenant access settings for your tenant.
    • Ensure that your external user's email address is associated with a tenant in the same national cloud as your tenant. If it's not, you can create an user account for them in your tenant.
  • Reached the end of the CSV file while processing only the newly appended objects

      • Cause

      This error occurs in automation tasks that use the entries in a CSV file to import the objects for the required task and have the Select only the appended objects option checked. This occurs when the automation task could not find any new entries in the CSV file that were not processed earlier. This could be because no new entries were added, or there might be a problem reading them from the file.

      Solution

      • Create a new file with the new entries that complies with the instructions for CSV files and update the Location of CSV in the automation.
      • To process all objects in the CSV file, uncheck the Select only the appended objects from the file option in the automation configuration.
  • Some objects used in this task could not be found

    • This error occurs when selecting multiple objects in any of the following management tasks:

    • Modify Microsoft 365 Group Members
    • Add / Remove Group Members using CSV
    • Add/Remove Team Owners
    • Add / Remove Microsoft 365 Group Owners

    Causes

    • The objects listed in the CSV file may have been deleted.
    • The users listed in the CSV may not be members of the group or team they are assigned to be as owners.
    • The objects selected manually in M365 Manager Plus may have been deleted in Microsoft 365 and have yet to sync.

    Solutions

    • Please ensure the objects in the CSV file exist before you use them in the mentioned tasks.
    • Please ensure that the object to be removed or assigned as an owner is already a member of the group or team.
    • If you have selected the objects manually using M365 Manager Plus, it will take some time for M365 Manager Plus to sync with Microsoft 365 and update the deleted objects. You can try again later.
  • A service account with the required permissions needs to be configured for the tenant to modify MFA settings.

    • Cause:

    This error message appears if you attempt to run the MFA Settings management task without configuring a service account that has the Privileged Authentication Administrator and Global Reader roles assigned to it.

    Solution:

    You will have to create a service account in Microsoft 365 with the required roles and configure it in M365 Manager Plus.

  • You must change your Microsoft 365 account password before you can login

    1. An Administrator has changed the password to your Microsoft 365 account.

    2. Login to Microsoft 365 Portal and reset your password to login to ManageEngine M365 Manager Plus

  • Rest API authentication required

    1. Rest API based authentication must be enabled for MFA-enabled / Federated Help Desk Technician accounts.

    2. Once enabled, users with MFA-enabled / Federated Accounts will be redirected to Microsoft 365 portal for authentication to access M365 Manager Plus.

    3. Click here to enable Rest API based authentication

  • An unexpected error occurred

    1. The error occurs when a PSSession can not be opened successfully.

    2. Make sure that you have entered the correct user name and password.

    3. If the problem still persists, contact your administrator.

  • Access Denied

    1. Make sure that you have entered the correct user name and password.

    2. If the problem still persists, contact your administrator.

  • The Redirect URI is not found in the application.
    • In the Redirect URI of the application configured for M365 Manager Plus in Azure AD, add your machine name or IP address, port number followed by the paths mentioned below. (Eg: https://testmachine:8365/webclient/GrantAccess, http://localhost:8365/AADAuthCode.do) Know more
      • /webclient/VerifyUser
      • /webclient/GrantAccess
      • /AADAuthCode.do
      • /AADAppGrantSuccess.do
    • Click Add URI to add the below Redirect URIs in the subsequent rows. Please note that for users with M365 Manger Plus build 4409 or higher, Redirect URIs (b) and (c) are optional.
      1. https://identitymanager.manageengine.com/api/public/v1/oauth/redirect
      2. https://demo.o365managerplus.com/oauth/redirect
      3. https://manageengine.com/microsoft-365-management-reporting/redirect.html
    • If product is accessed from AD360 or Log360 products with reverse proxy enabled update the endpoints by providing the above mentioned paths in the Redirect URI fields. The user should include the accessing URI with the above mentioned paths, like:
      • For context based reverse proxy: https://<AD360/Log360 hostname>:<reverse proxy port>/<reverse proxy context>/webclient/VerifyUser
      • For port based reverse proxy : https://<AD360/Log360 hostname>:<reverse proxy port>/webclient/VerifyUser.
  • Unable to save the changes. Please try again later.

    1. Make sure that the product is running in the standby server.

    2. Ensure that firewall is disabled for the port in which the product is installed.

  • Data engine update failed due to insufficient storage.

    1. The storage space of the drive in which the product is installed is insufficient to complete the migration. When you increase the storage space and restart the product, the migration will restart automatically.

  • Product successfully updated. Data engine update failed due to insufficient storage.

    1. The storage space of the drive in which the product is installed is insufficient to complete the migration. When you increase the storage space and restart the product, the migration will restart automatically.

  • Elasticsearch switched to read-only mode.

    1. If disk space is low(<1 GB), please free up some space and restart the product

    2. If disk space is high(>1 GB), please contact m365securityplus-support@manageengine.com .

  • Steps to check whether a user account is blocked from logging in:
    • Log in to Microsoft 365 portal .
    • Navigate to Users --> Active Users.
    • In the filters drop-down box, select Sign-in Blocked.
    • Check if the user account is blocked from logging in.
  • Steps to create a dedicated service account:
    • Log in to the Microsoft 365 portal .
    • Navigate to Users --> Active Users --> Add a User.
    • Create a new user by filling the mandatory fields display name and user name.
    • In the password section, select Let me create the password and enter a password for the user account.
    • Uncheck the Make this user change their password when they first sign in.
    • In the product licenses section, select Create user without product license
    • Click Next.
    • Under the Roles option, select the Admin center access and choose the required roles. (Exchange Admin is mandatory). Click here to view the list of required roles. Click Next
    • Click Save.
    • Use this account to configure your Microsoft 365 tenant in M365 Manager Plus.

    If the problem persists, contact m365managerplus-support@manageengine.com .

  • When I add my domains manually, the domain controllers (DCs) are not resolved. Why?

    1. This problem occurs when the DNS associated with the machine running M365 Manager Plus does not contain the necessary information. You need to add the DCs manually.

  • When I add a DC, I get an error that says "The Servers are not operational/Cannot connect to the domain controller?

    • This error could be due to any of the following reasons:

    • The DC is down.
    • The product server is not available.
    • A firewall has been enabled, and port 389 is closed.
    • The network is busy.
  • When I add a DC, I get an error that says "Unable to get domain DNS / FLAT name." What does that mean?

    • This error could be due to any of the following reasons:

    • The specified username or password is invalid.
    • An anonymous login (where no username and password are provided) was performed.
    • The IP address of the DC is specified instead of its name.
  • Elasticsearch has stopped

    • This error message will be displayed when Elasticsearch bundled with the product has stopped unexpectedly.

    This may be due to any of the following reasons:

    Cause 1: Insufficient disk space

    It is advised to have at least 1GB of free disk space for Elasticsearch to function effectively. When the size of data stored in Elasticsearch increases, it is recommended to free up storage accordingly to ensure Elasticsearch functions as expected.

    Solution:

    1. Log in to M365 Manager Plus and navigate to Settings > Admin > Disk Space Alerts and click the Usage Reports tab. You can see the amount of storage consumed by Elasticsearch data in the Elasticsearch field.

      2. Backup Errors

    2. Free up more disk space for Elasticsearch to function properly.

    Cause 2: Insufficient heap memory

    Elasticsearch uses a file-system cache to provide faster searches. It is recommended to have at least 30% of the server's RAM free for Elasticsearch to use. This free RAM will be used to cache Elasticsearch's indices to provide better performance.

    For proper functionality, 2GB of heap memory is initially assigned to Elasticsearch. When the size of data stored in Elasticsearch increases, it is recommended to assign more heap memory accordingly. At least 1GB of heap memory for every 60GB of data stored in Elasticsearch is required.

    Solution:

    You can assign more heap memory to Elasticsearch (1GB for every 30GB of Elasticsearch data is recommended for better performance) if it is feasible to do so.

    To configure the heap memory assigned to Elasticsearch, follow the steps below.

    1. Log in to M365 Manager Plus and navigate to Settings > Admin > Disk Space Alerts and click the Usage Reports tab.
    2. You can see the amount of storage consumed by Elasticsearch data in the Elasticsearch field. Use the storage size to decide how much heap memory has to be allocated to Elasticsearch.

      3. Backup Errors

    3. Shut down M365 Manager Plus.
      • If the product runs as an application, navigate to Start > All Programs > M365 Manager Plus and click Stop M365 Manager Plus.
      • If the product runs as a Windows service, navigate to Start > Run, type services.msc, right-click M365 Manager Plus from the list of services, and click Stop.
    4. Navigate to <Installation_directory>\elasticsearch\config and open the es-additional-wrapper.conf file using a text editor of your choice. The default installation directory is C:\Program Files\ManageEngine\M365 Manager Plus.

      5. Backup Errors

      Note: Make sure you back up a copy of the es-additional-wrapper.conf file before making any changes so that you can restore it if you encounter any issues while configuring the heap memory assigned to Elasticsearch.

    5. The variables wrapper.java.initmemory and wrapper.java.maxmemory need to be set to the same value. In this example, the values are set to 3072, i.e., Elasticsearch's memory is set to (3072MB/1024) = 3GB.

      6. Backup Errors

    6. Save the changes made before closing the file.
    7. Restart M365 Manager Plus for the new heap memory configuration to take effect.

      8. Note:

      • Heap memory allocated to Elasticsearch shouldn't exceed 32GB, as larger heaps can cause longer garbage collection pauses, thereby slowing down the functioning of the product.
      • Make sure both the values of wrapper.java.initmemory and wrapper.java.maxmemory are the same. Otherwise, the product will not start up properly.
      • In the event of OutOfMemory and LowMemory errors, the Elasticsearch heap is automatically increased by 1GB.
      • Increasing the heap size is not always the solution to improve performance. Apart from heap memory, other factors like storage devices and CPU used may also cause Elasticsearch to slow down. Ensure that the system requirements are met. Also note that increasing the Elasticsearch heap size should be done with careful consideration of the available resources on your machine.

    Cause 3: Firewall ports 9300 to 9400 have been blocked

    To allow Elasticsearch to interact with Microsoft 365 and collect data, firewall ports 9300 to 9400 are used.

    Solution:

    • Allow M365 Manager Plus to use firewall ports 9300 to 9400.

    If these steps did not resolve your issue, please contact the support team at m365managerplus-support@manageengine.com to get it resolved.

  • Microsoft SQL transaction log is full

    • Cause:

    This error occurs in instances where Microsoft SQL Server is configured as the product database. A transaction log that records all transactions and modifications made by each operation is maintained in the database. When the log size reaches the allotted size limit, all transactions in the database will be stopped.

    Solution:

    To resolve this issue, enlarge the transaction log size or optimize the log file growth by following the steps mentioned in this article.

  • Insufficient disk space to update to build 4800.

    • Cause:

    M365 Manager Plus users updating to build 4800 will have the product's built-in PostgreSQL database updated to version 15.7. In this case, you will be required to free up more disk space (1.3 times occupied by your product database) to proceed with the update. This space is only required for migrating the database from the old version to the new version. It will be freed up once the update is complete. Follow the steps mentioned below to find the size of your product database.

    1. Right-click on the pgsql folder in your M365 Manager Plus installation directory [By default, the default path to the installation directory is C:\Program Files\ManageEngine\M365 Manager Plus].
    2. Click Properties.
    3. View the disk space occupied by your product database in the Size on disk field.

      4. The pgsql Properties window with the Size on disk field highlighted to indicate the space occupied by M365 Manager Plus' built-in PostgreSQL database.

    Solution:

    1. Free up the required disk space in the machine where M365 Manager Plus is installed.
    2. Once done, you can now update the product by following the steps mentioned here.
  • Untrusted certificate provider.

    • This error occurs when the certificate used for authentication firewall or proxy is not trusted by the product's Java Runtime Environment (JRE). To rectify this condition, the certificates must be added to the JRE's trusted certificate store. To locate and import the certificate, follow these steps. To add the certificate to the trust store:

    • Navigate to <product_installation_directory>/jre/bin.
    • Open command prompt as an administrator.
    • Run the following command:
    • keytool.exe -import -trustcacerts -alias "certAlias" -file "certPath" -keystore ..\lib\security\cacerts
      • certAlias - A name of your choice.
      • certPath - Path of the certificate.
    • You will be prompted for a password. The default password is changeit. Provide the password and hit Enter.
    • Restart the Product.

    Follow the steps below to identify the certificate to import in the keystore:

    1. Note down the value of CN displayed in the error message.

      2. Backup Errors

    2. Open Manage User Certificates tool in the screen that opens.
    3. Open Run → certmgr.msc. The certificate management tool will open as shown here:

      4. Backup Errors

    4. Navigate to Trusted Root Certification Authorities in the left-pane, and click Certificates. A list of trusted certificates will display.

      5. Backup Errors

    5. In the list of certificates, identify the CN noted down in step 1, in the Issued By column.

      6. Backup Errors

    6. Once identified, click on the certificate to export.
      • A pop-up will open as shown here:

        • Backup Errors

      • Navigate to the Details tab.
      • Click Copy to File. A Certificate Export Wizard will open.

        • Backup Errors

      • Click Next.
      • Select the certificate format DER encoded binary X.509 (.CER), and click Next.
      • Specify the file name and path to export (for example: D:\Trusted Root.cer), and click Next.
      • Click Finish. The certificate will be exported to the specified path.
  • The service account is disabled for remote PowerShell.

    • If your service account is disabled for remote PowerShell execution, enable it by running the following command in PowerShell as an administrator:

    Set-User -Identity <service account> -RemotePowerShellEnabled $true
  • The remote server returned an error- (401) Unauthorized.

    • Cause

    • Invalid credentials.
    • Expired client secret.
    • App registration was deleted.

    Fix

    • Check the credentials of the service account that has been configured.
    • Ensure that your client secret has not expired or been deleted.
    • Make sure that your app registration exists.
  • The request failed with HTTP status 403.

    • Cause This issue occurs when necessary API permissions were not provided for the application.

    Fix

    • Log in to the Azure AD portal.
    • Click Azure Active Directory from the left pane.
    • Choose App registrations from under the Manage section.
    • Select the All applications tab.
    • Click on the Azure AD application of M365 Manager Plus.
    • In the API permissions page, check if admin consent has been granted for the full_access_as_app permission shown in the image below.

      • Backup Errors

    • If the permission doesn't exist, follow the steps below:
      • In the API permissions page, click on Add a permission and select the APIs my organization uses tab.
      • Search for Office 365 Exchange Online and select the same.

        • Backup Errors

      • Choose Application permissions and select the full_access_as_app checkbox.

        Note: The API permission full_access_as_app uses Exchange Web Services to backup and restore mailboxes.

      • Click on the Add Permissions button.

        • Backup Errors

      • In the Configured permissions section, click on Grant admin consent for <your_tenant_name>.
      • Click Yes in the pop-up that appears.
  • Backup is not supported for 32-bit installation of the product.

    • Solution:

    If you are using a 32-bit version of M365 Manager Plus, you won't be able to back up data using the add-on. Install the 64-bit version of the product to enable backup.

    Steps to install the 64-bit version of M365 Manager Plus

    Note: Take a backup of the M365 Manager Plus database before installing the 64-bit version to avoid loss of data.

    1. Uninstall the 32-bit version of M365 Manager Plus.
    2. Download and install M365 Manager Plus using this link.
    3. Start the application.
  • When the Microsoft 365 technician does not have permission to provide consent for applications:
    • Login to Microsoft 365 Azure AD portal.
    • Click on Enterprise Applications -> Admin consent requests.
    • Select the corresponding user consent and grant approval.

      • Access Denied Error

    • For a permanent solution, if the consent is not necessary for the application, add the following delegated permission to the application:
      • offline_access
      • User.Read

        • Access Denied Error

    • Once the permissions are added to the application, click Grant admin consent to allow Microsoft 365 technicians to provide consent.
  • Multiple technicians with the same UPN cannot be used in the product. Please contact the product administrator to resolve the issue.

    • Active Directory users can be added as technicians in M365 Manager Plus and can be assigned any combination of reporting, management, and auditing tasks. When two Active Directory users with the same UPN are registered in M365 Manager Plus as technicians, this can cause an ambiguity in the login process as to which user account should be logged in to.

    Cause

    When two different users are assigned technician roles in M365 Manager Plus, they will need to have unique UPNs to be configured. Once they are added, if their UPNs are edited to be the same, this can cause the error to surface.

    Solution

    1. Update the UPN for one of the conflicting AD user accounts so it becomes unique.
    2. Remove that user from the technicians list in M365 Manager Plus.
    3. Add the user again as a technician with the new UPN.
    Navigate to next Previous Topic Next Topic Navigate to next

    Copyright © 2023, ZOHO Corp. All Rights Reserved.