Migrating Group Mailbox Fails with Error: “The remote server returned an error: (403) Forbidden” (4374198)

The error is typically caused by one of the following:

• Application Access Policy restrictions.
• Conditional Access Policy blocking the migration account.

Option 1: Update Access Policies

• Add the temporary migration account (or the account that granted consent) to the Application Access Policy or Conditional Access Policy.
• This ensures the account has permission to access the mailbox during migration.

Option 2: Review Consents

• Go to the Consents page in your Microsoft 365 tenant.
• If RBAC consent is enabled for mail migrations, remove it and leave only the basic Mail option enabled.

For other types of mailboxes, please see another knowledge base.