When trying to run a Teams and/or M365 Groups discovery task the mentioned error is generated in the discovery logs, but the objects are discovered in On Demand Migraiton.
This is caused by a Conditional Access Policy in the source or target tenants. During the discovery we query both source and target.
Error is generated when the below API call is sent to the source or target during discovery:
https://graph.microsoft.com/v1.0/groups/<ObjectID>/drive
This can be reproduced in Graph Explorer.
There is a Conditional Access policy or other restrictions blocking this API call. This is an environmental issue and need to be investigated locally.
It is very likely, that there are IP restrictions in place, in such case, the Azure IP range need to be whitelisted. You can filter by your specific region or by particular service. Please see the below Knowledge Base article for more details:
https://support.quest.com/on-demand-migration/kb/4241629/on-demand-migration-ip-s-used
