Office 365 MP Config Issue - Account doesn't have administrator permissions

SCOM 2012 R2 RU3 | Windows Server 2012 R2
I just configured this MP in the environment using the following references:
Office 365 MP Operations Guide
Reference 1
Reference 2
In addition I've configured the Office 365 Subscription Proxy secure reference.
When looking in the SCOM console I only see one error:
Source: Office 365 Monitoring
Full Path Name: Office 365 Monitoring
Alert Monitor: Office 365 Connection State monitor
Created: 1/14/2015 4:42:56 PM
Account doesn't have administrator permissions
Knowledge: View additional knowledge...
Summary
The monitor oversees the availability connection to Office 365 API EndPoint.
Causes
An error state is caused by having issues with connecting to Office 365 API EndPoint. It can be caused by:
• Issues with global connection to Office 365 API EndPoint
• Credentials for Office 365 Subscription's account are not correct
• Office 365 Subscription's account is not allowed to getting data from Office 365 EndPoint API
I've verified that the account is able to log into the server, has the _identifier, and global admin permissions in the Office 365 admin console.
Wondering if there's anything I may have missed.
Any responses appreciated.

Verify that a proxy account is domain account.
Also check below office 365 MP Guide
http://www.microsoft.com/en-us/download/details.aspx?id=43708
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"Mai Ali | My blog:
Technical | Twitter:
Mai Ali

Similar Messages

I've purchased the Creative Cloud and the payment was pending. I log out and log in with a diferent PC, but now my account doesn't have any payment pending and it's all trial. What happend? Thks

I've purchased the Creative Cloud and the payment was pending. I log out and log in with a diferent PC, but now my account doesn't have any payment pending and it's all trial. What happend? Thks

I am not doing it in ITunes, but i did down load the song from ITunes. I loaded the song on to my Nano, but in my menu selections it doesn't show the song or the artist in any search format. However, when i plug in my nano to my PC I see the Nano library on my PC drive listings and that song and artist are there. I can click on the song and it will play in Windows media on my work PC. I did notice that the format for most all the songs in my library on my Nano are MPEG - 4 audio Files.
Thanks for your help, Mel

HT1911 I had to change my Apple ID password because I forgot what it was. Now, my account doesn't have the itunes money in it that was there on my last visit. How do I find my funds?

I had to change my Apple ID password because I forgot what it was. Now, my account doesn't have the itunes money in it that was there on my last visit. How do I find my funds?

ChrisJ4203,
Thank you for the help. Every app on my phone was downloaded using my old I-tunes ID. I just hope that they will re-download under my new ID because I still can't change it on my phone. In order to change to the new ID it says I have to sign out from the old ID and change to the new one. My problem is that I don't remember my password to be able to sign out from my old ID. Then the phone says it can change my password through e-mail and I agree but I never get an e-mail at my old address or the new one.
BHuyett

Event 1053 ActiveSync doesn't have sufficient permissions to create

Hello all and thanks in advance.
Exchange 2007 to 2013 co-existence. All email now routed (proxies) through 2013 server. For everyone, Outlook functional, OWA functional and for everyone else on the old server, EAS is functional. I only have three clients on the new server.
Outlook and OWA are functional, EAS is not. Two of those accounts get the following message on the 2013 server:
Exchange ActiveSync doesn't have sufficient permissions to create the "CN=Name\, User,OU=Users-IT,DC=HALFF,DC=AD" container under Active Directory user "Active Directory operation failed on SRV05.HALFF.AD. This error is not retriable.
Additional information: Access is denied.
Active directory response: 00000005: SecErr: DSID-031521D0, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0".
Make sure the user has inherited permission granted to domain\Exchange Servers to allow List, Create child, Delete child of object type "msExchangeActiveSyncDevices" and doesn't have any deny permissions that block such operations.
These two accounts are also part of several 'protected' security groups such as domain admins and or enterprise admins. I've seen this KB: http://support.microsoft.com/en-us/kb/2579075
One of these accounts is mine. Security for my user object is NOT inherited. I went to make the change in the article and it said 77 items were going to be changed. "Warning. The change you are about to make will result in 77 permissions
being added to the access control list"
Is this normal for AD objects that are part of protected groups? What is the best way to get through this?
Thanks,
Willis

Hello
after enable inherited not add "extra" permission for user like domain admin, but exchange trusted subsystem have got enugh permission on user and user can access to email from phone.
after user registering mobile in exch server you can disable inherited but remember when user have got problem. :)
sorry my english

Exchange ActiveSync doesn't have sufficient permissions

In one of our cas servers getting the following error.
Anybody have any idea why this error kindly share.
Exchange ActiveSync doesn't have sufficient permissions to create the "CN=a,OU=b-Administrators,DC=comany,DC=domain,DC=domain " container under Active Directory user "Active Directory operation failed on SRVINFDCDR01.kfupm.edu.sa. This error is not retriable.
Additional information: Access is denied.
Active directory response: 00000005: SecErr: DSID-031521D0, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
Make sure the user has inherited permission granted to domain\Exchange Servers to allow List, Create child, Delete child of object type "msExchangeActiveSyncDevices" and doesn't have any deny permissions that block such operations.
Details:%3
Ashraf

Some times you have to do this.
Start Active Directory Users and Computers.
Click View, and then click to enable Advanced Features.
Right-click the object where you want to change the Exchange Server permissions, and then click
Properties.
Note You can change permissions against a user, an organizational unit, or a domain.
On the Security tab, click Advanced.
Click Add, type Exchange Servers, and then click
OK.
In the Apply to box, click Descendant msExchActiveSyncDevices objects.
Under Permissions, click to enable Modify Permissions.
Click OK three times.

Powerpivot 2013 doesn't work on Excel 2013 / Office 365: data model issue

Hi guys
I recently upgraded my Office 2010 to Office 365, with Excel 2013. Before installing Office 365 I uninstalled Office 2010. I'm running Windows 8 64 bits.
I have the Powerpivot 2013 add-in, I can activate it without any issue. However when I click on "manage" on any spreadsheet (including new empty ones) I have an error "We
couldn't load the Data Model. This may be because the Data Model in this workbook is damaged.", followed by "PowerPivot is unable to load the Data Model".
I tried to repair the installation to no avail. I tried to launch excel in admin mode, nothing better.
This issue seems to be shared by some other people on this forum but
with no satisfactory answer so far.
I had a SQL server 2012 plugin installed previously which I uninstalled as well, but no change.
Would you think of something else?
Thanks

Hi lourson,
Someone work out this issue to stop the Tabular Model instance. Please take a look at the following blog:
PowerPivot 2013 Error: Data Model Damaged:
http://www.mssqlgirl.com/powerpivot-2013-error-data-model-damaged.html
For more information, please see the same issue at Connect site:
https://connect.microsoft.com/SQLServer/feedback/details/780949/powerpivot-couldnt-load-data-model-when-ssas-tabular-instance-is-running#details
Hope you can solve this issue on your new work environment.
Regards,
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Sharepoint Login Popup (Office 365 vs. Microsoft Account)

Hello Everyone,
We are using Sharepoint Online and I am designing the site for office use. Let me pre-face this with the fact that we do NOT use Office 365. I have been registering email accounts with Microsoft so other users can login externally. I have run into a barrier
to adoption for my users: When they attempt to access the sharepoint site (randomdomainhere.sharepoint.com), they are met with an Office 365 login popup. There is an option at the bottom of that popup to login with a Microsoft account. Now, even though
I have explained in great detail that this link needs to be clicked and the user login from that page, I still receive multiple users asking me to make this process easier as it often leads to mistakes or frustration on their end. What I have done to this
point is clicked on the link, used that URL as a Trusted site, and remained logged in. In theory, as long as I click the link I get right in, but the preference would be to display the microsoft account page popup in place of the office 365 popup. This would
potentially do one, if not both of the following:
1. Allow my users to login using their credentials without seeing two popup pages
2. If site was trusted and auto login was allowed, it would let users directly into the Sharepoint site
which is the intended goal.
I have searched for an answer to this repeatedly with no viable solution. I should also mention that I am not a developer or web designer. I am just a guy who wants to make things run smoother in my office. Please help.
Thanks,
Christian

There really isn't a good solution to this issue at the moment. MS applied this change to the Login page a few months ago and it is very confusing for external users. MS is aware of the frustration, but the SharePoint Online group doesn't control
that login page. What I have done for my external users is put together an email message, with a screen shot, showing how to get to the Microsoft Account login page from the default login page.
#1 is the only way that works.
#2 usually won't work since the trust sites autologin passes their workstation login. In my experience that usually will be an internal corporate account that won't match their Microsoft account.
The only way to really handle it at this point is through education and wait for the login page to be changed to a better external user experience.
Paul Stork SharePoint Server MVP
Principal Architect: Blue Chip Consulting Group
Blog: http://dontpapanic.com/blog
Twitter: Follow @pstork
Please remember to mark your question as "answered" if this solves your problem.

Office 365 ProPlus Activation Issues

Issue Resolved:
After adding all of the Office 365 URL's and Address Ranges to our internet filters exception list activation worked.
Hi Everyone
I'm preparing for a deployment of Office 365 ProPlus using the Office Deployment Tool (ODT) and having trouble getting Office to activate after installation. Using my custom .xml file, I'm able to install only Office products that are needed without
issue using a Group Policy start-up script. It is necessary for me to do this because none of the users in my environment have local administrator rights and cannot install Office on their own using Click-to-Run. Installing with a start-up script
uses the System account to circumvent that issue. Upon first launch of Office 365 ProPlus I'm prompted to enter my email address and password for activation and promptly receive the error "There is a problem with your account. Please try again
later."
I've verified that an Office 365 ProPlus license has been provisioned for my account through our portal and have ADFS running without issue. Here's where things start to get strange... In testing, I added myself as a local administrator to my desktop
and downloading/installed the Click-to-Run from our Office portal. Upon launching Office for the first time it was activated automatically and the portal showed that a license was used.
As of right now I'm at a bit of a loss as to why I can't activate Office using valid credentials with proper licenses provisioned when installing with the ODT but it auto activated when using Click-to-Run. Any help or suggestions would be much appreciated.
See below for a copy of my configuration.xml
<Configuration>
<Add SourcePath="PATH TO OFFICE INSTALL FILES" OfficeClientEdition="32">
<Product ID="O365ProPlusRetail">
<Language ID="en-us" />
<ExcludeApp ID="Access" />
<ExcludeApp ID="Groove" />
<ExcludeApp ID="InfoPath" />
<ExcludeApp ID="Lync" />
<ExcludeApp ID="Project" />
<ExcludeApp ID="SharePointDesigner" />
<ExcludeApp ID="Visio" />
</Product>
</Add>
<Display Level="None" AcceptEULA="TRUE" />
<Logging Level="Standard" Path="%temp%" />
<Property Name="FORCEAPPSHUTDOWN" Value="TRUE" />
</Configuration>
**note: Add SourcePath="PATH TO OFFICE INSTALL FILES" points to the Office\Data folders which were created when using the ODT in /download mode.
Edit:
After troubleshooting the issue more yesterday I found that whenever I try to activate Office 365 ProPlus an error is generated in the application log.
The description for Event ID 0 from source MSOIDSVC.EXE cannot be found. Either the component that raises
this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
InitializeSvcAPI failed with hr = 0x8004825b
I've thus far been unsuccessful in figuring out what MSOIDSVC.EXE is or what it does.
Edit:
http://community.office365.com/en-us/w/sso/534.aspx
MSOIDSVC.EXE is part of the Microsoft Services Sign-In Assistant (MSO SIA). After installing MSO SIA and verifying that the services were running activation still failed.

hi,
Thank you for sharing your solutions and experience here. It will be very beneficial for other community members
who have similar questions.

Calendar bug with Office 365 for Education (exchange accounts)

I have an Office 365 Exchange account provided by my University. When I add the account to my Mac, Mail.app and Contacts.app work perfectly. However I receive an error message in Calendar which states that “Calendar needs a valid email address to connect” to my account. The address is clearly valid since it is working in Mail and Contacts. Furthermore, this account works perfectly in iOS Mail, Contacts, and Calendar. The issue is only with Calendar in OS X. Upon researching online, it appears that this issue will occur on Macs if the account is hidden on the Exchange Global Address List (which is true for my account). Below are a few additional points that are related to this bug:
1. iOS connects to Exchange through ActiveSync which is why I don't see the issue on iOS devices.
2. OS X connects to Exchange through Exchange Web Services (EWS). OS X supports EWS for Calendar syncing only when a users name is listed on the Global Address List. If the account is hidden (and they usually are for Office 365 educational accounts at Universities complying with FERPA laws) then Calendar.app cannot connect and sync the users calendar. I am not sure if this is by-design or a bug.
3. The third-party Mac app 'BusyCal 2' also uses EWS to connect to Exchange and it will work regardless of the visibility of the user's account on the GAL.
This has led me to two conclusions: Either (1) Apple has a bug in Calendar.app, or (2) the bug is in EWS and Busycal 2 is forcing some sort of work-around. It's likely that Apple and Microsoft will need to work together to fix the issue. I've attempted submitting a bug report to Apple but I have no way to contact Microsoft since I am not an admin for the Office 365 plan that my school uses. I would need to go through my admins but they don't seem to care much about this issue. So pretty much I'm left helpless at this point :/
Does my analysis seem valid or does anyone else have any points to contribute? I would appreciate the assistance

Hi,
There are two ways to share read access to your calendar on premise to Office 365. The method you choose depends on your requirements and the level of access that you want to give to the calendars. But providing write access to the calendar is not possible
in a Cross-Premise scenario.
For more information, here is a blog for your reference.
Cross Premise Calendar Sharing with Office 365
http://blogs.technet.com/b/matabra/archive/2013/05/07/cross-premise-calendar-sharing-with-office-365.aspx
Hope this can be helpful to you.
Best regards,
Amy Wang
TechNet Community Support

Cannot open document because Office keeps trying to sign in to Office 365 with the wrong account

Problem: I cannot open Office documents from SharePoint on Office 365 because Office tries to sign in with my Microsoft account instead of my Office 365-account.
History
When we started the project, I did not have an Office 365-account yet for the organization I was working for. To get temporary access to SharePoint a colleague invited me on my Microsoft Account to gain access to SharePoint. This worked fine and I
was able to access SharePoint. A few days later I received my official Office 365 account, so I also got e-mail etc. Because I now have an official Office 365 account, we removed my Microsoft Account from SharePoint. So now I only have access to SharePoint
with my Office 365 account.
The problem is that I can no longer open documents in Office. In the web version everything works fine, but if I want to open a document in for example Word, it says the document cannot be opened. Sometimes it shows a screen which says "Something
went wrong". If I click through to go back to the website, it show me that it tried to login with my Microsoft Account and that this account does not have access to the site. It suggests to sign out and login with a different account, but this leads to
a page that does not exist. I cannot figure out how to make Word use my Office 365 account.
What I have already tried
-Remove all my browser history and temporary files
-Add Office 365 as a connected service in Office. I can sign-in with my Office 365 account and the location is added, but I still cannot open documents.
-Tried a different pc. But because Office syncs al my settings, I got the same problem on all my pc’s.
-Removed all my Windows credentials via the credential manager in the control panel. If I also remove the credentials for my Microsoft Account, Office cannot sign in anymore. At this point, if I try to access SharePoint, it asks me for my credentials
and I have access to the documents. However, if I restore my Microsoft Account in Office again by entering my password, the problem is back.
-As a work around I can add my Office 365 account as a separate Office account. I have access then, but it is really annoying because every time I want to open a document, I have to open Word, switch accounts, close Word and open the document. It is
not capable of automatically selecting the account to use.
Conclusion and question
I have also worked with other Office 365 organizations which I can easily add to the connected services in Office and they work fine. So somehow Office has linked my Microsoft Account to this organization of Office 365 and it refuses to use the correct
account. Does anybody know how to unlink my Microsoft Account from this Office 365 organization so that I can use the correct account?

Try these steps from the source linked below:
Stop connecting to a connected account
You can stop connecting to a connected email account in Outlook Web App by removing the connection.
In Outlook Web App, click Settings >
Options > Account > Connected accounts.
Under Account Name, select the account you want to stop connecting to.
Click Delete to remove the connection.
Click Yes in the dialog box to confirm that you want to stop connecting to the account.
http://office.microsoft.com/en-us/support/connected-accounts-HA102836325.aspx

Having trouble removing a student email account from the Windows Mail App because the school has started using office 365 for thier email which i dont have access to

I was wondering if anybody has any ideas on how to remove a gmail account that was set up by a community college for use on their mail servers and then find out that after awhile they have locked you out because they have started using office 365 for their
emails and you are left with a student email account that you have no idea how to delete because you have missied out on deleting it before they changed to a different email provider?
Anybody with ideas please help because I don't know what to do

Hi,
Regarding to Windows Mail App, do you mean the Modern UI App in Windows 8.1? Do you mean that you want to remove the email account from Mial App? Generally, we can simply remove the account by the "Account" option in Mail App (Open Mail App, move
the mouse the right chram bar, click Account, then click the mail account\Remove account), but if the email acocunt is tied with the Microsoft Account which is used on the pc, in that case, it is unavailable to remove the email account, you need to contact
your college to disconnect the Microsoft Account.
If I'm misunderstanding something, please free correct me.
Regards
Yolanda Zhu
TechNet Community Support

Office 365 Internal DNS issues

I have recently started doing some migrations from a hosted exchange 2007 server onto office 365 and have ran into some issues.
Since we have alot of users still using the hosted exchange (slowly moving users over 1 by 1 to 365) I have not fully turned off the local server and therefore had some issues with the autodiscover when setting up my email in outlook 2013.
I instead used the domain and email given to me by microsoft (the <user>@<name>.onmicrosoft.com) This at the least allowed me to be able to add my user and sync my email, but it presented me with another issue. Outlook and now lync ask
me for credentials every few mins. I can cancel the password prompt and give it a few then it will start syncing again.
After some research i found that it may be my internal DNS preventing seamless communication. I added the CNAME and SRV records to my local server and the issue still presents itself.
Anyone run into this issue and have a resolution? I have tried killing my local credentials on the machine im using outlook on just in case, and verified with all the proper office tools that the autodiscover service is working. I have synced up my
phone in seconds with no issues as well.
Any input would be great!
Thanks!

Since we have alot of users still using the hosted exchange (slowly moving users over 1 by 1 to 365)
You really don't need to do this one by one, Office 365 will take care of most things. You might want to take a look at this article for a step by step guideline of how to migrate from Exchange 2007 to Office 365:
http://blogs.technet.com/b/canitpro/archive/2013/11/20/step-by-step-migrating-from-exchange-2007-to-office-365.aspx
Anyway, for the specific issue you met, I would suggest you to post in the forum of
Office 365 Community.
This forum focuses on questions and feedback for Microsoft Office client. There is not so much about Office 365 Admin\hosted\plan\Cloud aspects here.
The reason why we recommend posting appropriately is you will get the most qualified pool of respondents, and other partners who read the forums regularly can either share their knowledge or learn from your interaction with us. Thank you for your understanding.
Regards,
Ethan Hua
TechNet Community Support
It's recommended to download and install
Configuration Analyzer Tool (OffCAT), which is developed by Microsoft Support teams. Once the tool is installed, you can run it at any time to scan for hundreds of known issues in Office
programs.

Migrating SP 2010 to SharePoint Online (Office 365) - Site Template issue - Any advice?

Hi there,
I am migrating our SP 2010 site collection to O365 SharePoint Online. The new sites do not show up fine, I suspect this is because I am choosing wrong site templates. Any advice on this will be appreciated.
Thank you.

You can test this if you open your office 365 site in your browser, and then off IE menu, view source, and search for
g_wsaSiteTemplateId
then you can see what that results in, possibly g_wsaSiteTemplateId = BLANKINTERNET#0'
do same steps for your SharePoint site, if they have the same value for g_wsaSiteTemplateId, you'll need to export content granually, each list and library and then upload to your Office 365. There are 3rd party tools out there that will do this for
you too. for ex,
http://www.metalogix.com/cloud1/cloud-acceleration-suite-for-Office-365?utm_source=Bing%20Ads&utm_medium=cpc&utm_campaign=701a0000000ug99
Stacy www.sharepointpapa.com

Steps to deploy Lync for users who own Office 365 E1/E2 licenses, but don't have Office 365 E3, using Office Deployment tool.

After many hours of debugging with Microsoft support the system to install the Lync Client silently can be done with a SINGLE LINE command. The steps to take are below. It should be an easy next step to put this as GPO installation since
it is a simple command.
Comments appreciated.
side question: Why is there no Lync 2013 or Lync Office 365 forum?
Basic steps to deploy Lync for users who own Office 365 E2 licenses, but don’t have Office 365 E3, using Office Deployment tool.
This also applies for other Office 365 service types where the full office suite download is not included. In April 2015 This was impossible to find online and not know by the Lync support team.
Steps are:
Download the Office deployment tool from
http://www.microsoft.com/en-in/download/details.aspx?id=36778 and extract it to a folder. For this
example we will use the \\server\sharename
location.
Extracting it creates a setup.exe file and it show a sample XML file.
2. Create XML file and give it a name such as LyncEntryRetail.xml
Note: The key is the productID that has to be the “LyncEntryRetail”. Other product IDs will download a version that needs another office 365 license. The productID “LyncRetail” needs an E3 license of Office 365.
<Configuration>
<Add SourcePath="\\server\sharename" OfficeClientEdition="32" >
    <Product ID="LyncEntryRetail">
      <Language ID="en-us" />
    </Product>
</Add>
</Configuration>
3. From the folder where you extracted the Office deployment tool, run the following command on the command prompt to download the source files and store them on the shared drive:
(on single line)
Setup.exe /download LyncEntryRetail.xml
(This is the name of the XML file created above)
One can also run the same on a server share by using UNC path names such as (on single line)
\\servername\sharename\Setup.exe /download
\\servername\sharename\LyncEntryRetail.xml
(This is the name of the XML file created above)
4. Run the following command on the command prompt on a machine where you want to install the software: (on single line)
\\servername\sharename\Setup.exe /configure
\\servername\sharename\LyncEntryRetail.xml
(This is the name of the XML file created above)
Once you are comfortable that it all works, you may want to edit the XML file if you want to have silent installation and add the following lines.
<Display Level="None" AcceptEULA="TRUE" />
<Property Name="AUTOACTIVATE" Value="1" />
Regards
Bart
Bart Louwagie

Hi Chudly，
For the office365 issue, I also recommend you can post in dedicated forum for more efficient support:
http://community.office365.com/en-us/f/166.aspx
If you want to modify the powershell script, please post the current script and the issue, we will notice and continue to follow up.
If there is anything else regarding this issue, please feel free to post back.
If you have any feedback on our support, please click here.
Best Regards,
Anna Wang
TechNet Community Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Exchange ActiveSync doesn't have sufficient permissions to create the..

I have just upgrade my DC to 2012r2 and Exchange 2010 from an SBS 2003 environs.
I am running into the above issue even thought I have added the Exchange server to the security at domain level, enabled the inheritance and it is still coming up with this issue.
The exchange 2010 is running on the 2012r2 server. This is the first step before migrating the 2010 to 2013
Any help will be deeply appreciated.
thanks

Hi,
From your description, I would like to clarify the following thing:
Exchange 2010 is not supported to run on the Windows Server 2012 R2. If you install the Exchange server 2010 on the Windows Server 2012 R2, some unexpected issues will occur.
Here is an article for your reference.
Exchange Server Supportability Matrix
http://technet.microsoft.com/library/ff728623(v=exchg.150).aspx
Hope this can be helpful to you.
Best regards,
Amy Wang
TechNet Community Support

Office 365 MP Config Issue - Account doesn't have administrator permissions

Similar Messages

Maybe you are looking for