When trying to migrate a mailbox, it is failing with error: "Error creating source session. The request failed. The remote server returned an error: (403) Forbidden". Source account is GA, and MFA is not enabled for it. However access is given by the Service Principal. Service Account is PIM-enabled. Source is hybrid and accounts are synced from the onprem AD.
Note: the issue can also happen with the cloud-only tenant, where service account was created through Microsoft PIM.
Cause 1: Application Access Policy Limiting application permissions to specific Exchange Online mailboxes - Microsoft Graph | Microsoft Docs
Cause 2: Minimal and Full consents both granted
| Scenario | Consent granted | Outcome |
| Scenario 1 |
Source Tenant
Target Tenant
| Error will occur |
| Scenario 2 |
Source Tenant
Target Tenant
| Error will occur |
| Scenario 3 |
Source Tenant
Target Tenant
| Error may occur |
| Scenario 4 |
Source Tenant
Target Tenant
| Error may occur |
** there are more scenario that cant be covered but multiple consent will be causing the error to occurs
Cause 3: RBAC consent granted and not configured for use
Cause 4: Conditional Policy or Application Policy (Group Mailbox for Teams or M365 Group)
Since source EXO mailboxes are controlled by the Application Access policy, verify what group this policy is applied to, then add affected users as members of the said group onprem. After ADconnect syncs user's membership to the cloud, mailbox migration should work for them.
It may be required to remove Application Access Policy using PowerShell as there's no convenient way to see them using Microsoft Azure GUI
To retrieve a list of Application Access Policies and test ability to access a specific mailbox, please do the following command in bold:
Connect-ExchangeOnline -UserPrincipalName <admin_account using onmicrosoft UPN> -ShowProgress $true
Get-ApplicationAccessPolicy | Select-Object Identity, AppId, AccessRight, ScopeIdentity, PolicyScopeGroupId
Note: <AppId> is the id that come from output of 2nd cmdlet.
Test-ApplicationAccessPolicy -Identity "<email of user's account>" -AppId <AppId>
Result of Test-ApplicationAccessPolicy will indicate whether AppID has access to the mailbox. Quest ODM AppId are listed in Microsoft AzureAD -> Enterprise Application, search for "quest" in the search bar on the right pane.
Note: The error could also be "error creating target session". This should pinpoint what tenant exactly is experiencing an issue.
** Please find the below Microsoft document reference of how to delete enterprise applications.
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/delete-application-portal?pivots=portal
If it is not intended to use RBAC, follow the steps below to revoke RBAC consent. Otherwise if RBAC is intended, review this article to ensure it is configured correctly.
Add the temporary migration account (or account which granted consent) to the application/conditional access policy to avoid the error.
