Mailbox Migration Fails with Error: "The remote server returned an error: (403) Forbidden" (4378683)

The following errors were encountered during migration:

• "Error creating source session. The request failed."

• "Could not locate mailbox using Autodiscover."

• "Autodiscover failed to find the EWS URL for mailbox."

The root cause was determined to be related to access policies and authentication mechanisms in Exchange Online.

The error "403 Forbidden" typically indicates permission or authentication issues with the migration tool's ability to access mailboxes in Exchange Online. This can result from outdated permissions, incorrect policy configurations, or issues with the service principal.

To resolve this issue, follow these steps:

1. Verify Access Policies

   • Run the following command in PowerShell to ensure the application has been granted the necessary permissions:

     Test-ApplicationAccessPolicy -Identity "UserMailbox@domain.com" -AppId "YourAppIDGuid"

   • If AccessCheckResult returns "Granted," the application has the required access.

2. Grant Exchange Online PowerShell Core Consent

   • Add the Exchange Online PowerShell core consent to ensure proper authentication for mailbox migration.

   • Verify the correct service principal is assigned to the Entra Exchange Administrator role.

3. Check for Conflicting Application Access Policies

   • Run the following command to list any restrictive access policies:

     Get-ApplicationAccessPolicy

   • Ensure no policies are limiting access to the affected mailboxes.

4. Reattempt Migration

   • After making the necessary adjustments, restart the migration process and monitor for any remaining issues.