AAD Discovery workflow error: "CDS.Library.AbandonedException: Could not find any available CDS PowerShell users" (4331969)

We setup and ran the Active Directory Environment Discovery task twice with the same results. What is causing this error?

"CDS.Library.AbandonedException: Could not find any available CDS PowerShell users in elapsed:00:10:03.9507505
   at CDS.AzureLibrary.CDSPowerShellPool.GetPowerShell(Boolean useTeams, Boolean useAzureAd, Boolean importExchange)
   at CDS.AzureLibrary.AzureAD.<GetChangedIds>d__36.MoveNext()
   at CDS.Model.Office365.<GetDeltaObjectsByType>d__72.MoveNext()
   at CDS.Model.Office365.<GetDeltaObjects>d__68.MoveNext()
   at CDS.Model.PushJob.Run(IWebServiceFactory webServiceFactory, CancellationToken cancellationToken)
   at CDS.Model.Job.Execute(IWebServiceFactory webServiceFactory, CancellationToken cancellationToken)
   at CDS.Model.Agent.ExecuteJobs(CancellationToken cancellationToken)
   at System.Threading.Tasks.Task`1.InnerInvoke()
   at System.Threading.Tasks.Task.Execute()"

This error indicate that the environment is preventing access using the service account. This can be caused by several factors, including Multi-Factor Authentication (MFA) being enabled, conditional access policies, a password change, a disabled account, or PowerShell Remoting not being enabled for the CDS PowerShell accounts.

To resolve this issue, you should:
 
1. Check if MFA is enabled for the source and target service accounts used to establish the connection during the setup and disable it if necessary.
2. Remove any conditional access policies that may be blocking the service account.
3. If the password for the service account has changed, you may need to reinstall the agent as per the documentation.
4. Ensure that PowerShell Remoting is enabled for the CDS PowerShell accounts.
 
Additionally, when the tenant is being connected, On Demand Migration for Active Directory (ODMAD) creates two accounts that start with BinaryTreeCDSPowershell. Make sure that these accounts are also excluded from MFA and conditional access policies.

Note: It may be necessary to modify tenant's Security Defaults that will enforce MFA despite BinaryTreeCDSPowerShell accounts being excluded.