AAD Discovery Workflow Error: “CDS.Library.AbandonedException: Could not find any available CDS PowerShell users” (4331969)

When running the Active Directory Environment Discovery task, the following error occurs:

CDS.Library.AbandonedException: Could not find any available CDS PowerShell users in elapsed:00:10:03.9507505
   at CDS.AzureLibrary.CDSPowerShellPool.GetPowerShell(Boolean useTeams, Boolean useAzureAd, Boolean importExchange)
   at CDS.AzureLibrary.AzureAD.<GetChangedIds>d__36.MoveNext()
   at CDS.Model.Office365.<GetDeltaObjectsByType>d__72.MoveNext()
   at CDS.Model.Office365.<GetDeltaObjects>d__68.MoveNext()
   at CDS.Model.PushJob.Run(IWebServiceFactory webServiceFactory, CancellationToken cancellationToken)
   at CDS.Model.Job.Execute(IWebServiceFactory webServiceFactory, CancellationToken cancellationToken)
   at CDS.Model.Agent.ExecuteJobs(CancellationToken cancellationToken)

The error indicates that the environment is blocking access for the service account used by ODM. Common reasons include:

• Multi-Factor Authentication (MFA) is enabled on service accounts.
• Conditional Access Policies are preventing login.
• Password changes not updated in ODM.
• Disabled service account.
• PowerShell Remoting is not enabled for CDS PowerShell accounts.

To resolve this issue:

1. Check MFA Settings

   • Ensure MFA is disabled for both source and target service accounts used during setup.

2. Review Conditional Access Policies

   • Remove or adjust any policies that block the service account.

3. Verify Service Account Credentials

   • If the password has changed, reinstall the ODM agent as per the documentation.

4. Enable PowerShell Remoting

   • Confirm that PowerShell Remoting is enabled for CDS PowerShell accounts.

5. Exclude ODM Accounts from MFA

   • When connecting the tenant, ODM creates two accounts starting with:

     BinaryTreeCDSPowerShell
     

   • Ensure these accounts are excluded from MFA and conditional access policies.

Note: If your tenant enforces Security Defaults, MFA may still apply even if exclusions are set. Adjust Security Defaults as needed.