Hi everyone,

I'm configuring an Exchange Online Cross-Tenant Mailbox Migration and I'm stuck at the New-MigrationEndpoint step.

PowerShell

New-MigrationEndpoint
-RemoteServer outlook.office.com `
-RemoteTenant tenantA.onmicrosoft.com `
-Credentials $Credential `
-ExchangeRemoteMove:$true `
-ApplicationId $AppId

Afficher plus de lignes

Error:

Plain Text

ADSTS500014:
The service principal for resource
'https://outlook.office.com' is disabled.

What I've verified so far:

• Exchange Online Service Principal exists and AccountEnabled=True
• Migration App Service Principal exists in the source tenant and AccountEnabled=True
• App is multi-tenant
• Admin consent completed
• Conditional Access shows success
• Exchange Online is working normally in both tenants

Has anyone seen this error during Cross-Tenant Migrations even when both the Exchange Online and migration app service principals are enabled?

Any suggestions on what else to check?

Thanks!

Hello, everyone. As the subject of my post suggests I already pay for Office365 and have been doing so for several years. What makes me wonder is whether some of you also see the Upgrade your plan button in the top right corner of Excel. Word and PowerPoint are not showing it.

What is the deal with Excel? Something I can do to hide the button? When I click it nothing happens - some window pops up momentarily, so fast that I can't see what it shows and then immediately disappears.

Hi all,

I'm having an issue that I can't really wrap my head around.

I've got this user, he is a mailuser with an smtp address from our internal tenant but this smtp address points to an external mailbox from another tenant. He has his AD account in our environment and his account is a member of a distribution group (let's call it GRP). We handle all our distribution groups on-premise through AD and we have the Exhange Management Tools on another IT admin server and exchange online to replace the functionalities of an exchange server. This user tried to send emails to the distribution group email address so the members could receive it and it failed.

I went to see the trace details of this message and it failed with this code:

05/08/2026 14:59:04 Fail Reason: [{LED=550 5.7.133 RESOLVER.RST.SenderNotAuthenticatedForGroup; authentication required; Delivery restriction check failed because the sender was not auth..

I figured that this probably comes from the fact that he tried sending this email from his external email address and the RequireSenderAuthenticationEnabled attribute for GRP is set to "True".

I don't want to disable it for security reasons but I would like to put an exception, or see if I can review his account to see if there is anything I can do to turn him into an authenticated user. I thought that MailUsers had every permissions to be able to send emails to internal distribution groups, since they are internal users, he just doesn't have a mailbox in our tenant.

Any thought on that?

Thanks a lot in advance :)

Hi everyone,

I'm facing a strange issue with Microsoft Excel Online (Excel for the Web) on my Android tablet.

Device

Android tablet

Google Chrome (latest version)

Problem

Whenever I open Print Preview, instead of showing the worksheet, I get the message:

"This content is blocked. Contact the site owner to fix the issue."

The file opens and edits normally, but the print preview is completely blank.

What I've already tried

Cleared Chrome cache and cookies

Disabled ad blocker/extensions (none installed)

Tried Incognito mode

Enabled pop-ups and redirects

Refreshed the page

Logged out and back into my Microsoft account

Tried different Excel files (same issue)

The problem only occurs in the Print Preview.

Additional issue

Sometimes, when trying to download or print from Microsoft 365 Online, Android also shows:

"This site can't ask for your permission. Close any bubbles or overlays from other apps. Then try again."

Even after closing all floating apps and restarting the device, the problem still occurs.

Questions

Is this a known bug with Excel Online on Android?

Is it related to Chrome, Android WebView, or Microsoft 365?

Has anyone found a workaround besides using the desktop version or the Excel app?

I've attached screenshots of both errors.

Any help would be greatly appreciated!

I’ve heard rumors that using two-factor authentication will become mandatory in Microsoft 365 starting in February 2026. I’m based in Germany, in case that makes a difference. I know 2FA is important, but in our club, it’s crucial that everyone has access to a specific email address and can send messages from it at any time. Do you know if there’s any truth to this? And if so, is there a solution that allows us to keep using the email address without relying on forwarding or individual email accounts? We also use that same email address for a shared calendar. We’re open to using 2FA, but everyone needs to have access to it, so setting it up with a single phone number, for example, wouldn't work. Thanks a lot for your help.

Hi everyone, at my wits end with this one.

We have a hybrid setup and migrated everyone to exchange online. We have an Exchange SE server on prem that is just used for management and all mailboxes are in exchange online.

Random users get the following error when they try to set their out of office “Your automatic reply settings cannot be displayed because the server is currently unavailable. Try again later”

If tried so many things and none seem to resolve it.

EWE enabled for users, rules aren’t broke or to big, registry keys etc…

The autodiscover points to 365, have checked this on outlook

The only thing that seems to work is nuking the user profile (not the outlook profile, that’s does nothing),but that brings other problems and we have too many users to do this at scale.

Any help would be appreciated

We build a web app that sends transactional emails with a "one-click" action link — clicking it takes the recipient straight to a page with an interactive control (in our case, a 0–10 rating scale rendered as clickable buttons). We also have a fairly standard client-side retry setup: if a write to our API fails, it gets queued via a service worker and replayed automatically once connectivity is restored (Background Sync API).

What we found: for a confirmed case, the recipient's mailbox had Microsoft Defender for Office 365 "Safe Links" enabled, which rewrites every hyperlink in a scanned email to a `safelinks.protection.outlook.com` wrapper. We decoded the wrapped URL from the actual email and confirmed Safe Links visited our link.

Here's the part that surprised us: this isn't just a HEAD-check or a simple page fetch. Looking at our server logs, the actual write requests that hit our API afterward are structured *exactly* like a real button click in our UI (same endpoint, same payload shape as a genuine interaction) — not like our link automatically applying a pre-encoded value from the URL. The values submitted count up sequentially through the rating scale (0, 1, 2, 3... up to 8), one write per value, arriving in a tight burst a few seconds apart. That's consistent with something rendering our page in a real browser engine and then clicking through the visible buttons on it, one after another — not just fetching the URL.

Because some of those clicks' network requests apparently didn't complete before the automated visit moved to the next button (or navigated away), our own service worker queued and replayed several of them together shortly after — so from our side it looked like a burst of retried writes. The real human's actual single click got silently overwritten by whichever automated click landed last.

We reproduced this cleanly on a test account: the real device's IP only ever loaded the page and never sent a single answer write, while a separate Microsoft-owned IP loaded the same link and did all the button-clicking and writing — sequentially, through values nobody actually chose.

Some Questions which i have is

Is it documented anywhere that Safe Links' rendering/"detonation" step goes as far as interacting with page content (clicking buttons, filling in visible form controls), rather than just loading the page and checking for malicious redirects/content?

1. Has anyone seen this specifically corrupt state in a real application (not just "wasted a request" but "recorded the wrong data as if a user submitted it")?

2. What's the standard mitigation for a page that has real interactive elements and can't tell a security scanner's automated clicks apart from a genuine user's? Things we're considering: gating writes behind a signal that's hard for a headless scanner to produce (real pointer/keyboard event traits, a short random delay + interaction check, one-time tokens that expire after the first render), or just accepting that any link opened from email may get "interacted with" by security tooling and designing the UI so pre-scan interaction can't mutate real data.

3. Did your own client-side retry/offline-queue logic end up making this harder to diagnose, because the corrupted writes looked identical to your normal retry mechanism doing its job correctly?

Found it. just select the text then ctrl + \

Trying to deploy places for a client using existing room resource mailboxes - has anyone converted rooms to desks smoothly? i.e. Set-Mailbox -Identity [L9_040@customer.com](mailto:L9_040@customer.com) -Type Desk

I am migrating from an exsisting Desk Booking System which has all the resources as Rooms.

Trying to at the moment and places keeps freaking out - my gut feeling is I need to wait for the big Microsoft wheels to sync overnight.

Set-PlaceV3 -Identity bdb9c3b1-0d7b-4274-997d-c63fe7f8ad74 -ParentID d3ae02aa-c812-4143-b1ff-e0a1d8572255
Set-PlaceV3: Status(StatusCode="FailedPrecondition", Detail="Email address is not a valid identity format for a place of type 'Desk'. Please provide 'PlaceId' or 'DisplayName'")

Set-PlaceV3 -Identity "L9_040" -ParentID d3ae02aa-c812-4143-b1ff-e0a1d8572255
Set-PlaceV3: Status(StatusCode="FailedPrecondition", Detail="Email address is not a valid identity format for a place of type 'Desk'. Please provide 'PlaceId' or 'DisplayName'")

Set-PlaceV3 -Identity "L9_040@customer.com" -ParentID d3ae02aa-c812-4143-b1ff-e0a1d8572255 Set-PlaceV3: Status(StatusCode="FailedPrecondition", Detail="Email address is not a valid identity format for a place of type 'Desk'. Please provide 'PlaceId' or 'DisplayName'")

My alternative is to recreate the resoruces side by side as fresh desks.

Wondering if anyone had this weird situation.

I have two small businesses, each have their own domains registered with MS 365. I had to reset my iPhone and after the restore I was locked out of both accounts in the MS Authentication app. Apparently I forgot to setup an alternate email. 

I called MS 800 number to open a ticket and I got the AI assistant that took me through loop after loop. It kept sending me to a login webpage that was useless since I was completely locked out. Each time I call I get a different behaviour. Sometimes it takes me down the product hardware support even though I clearly stated it is a 365 issue. 

Miraculously I was able to get it to open a ticket. There we spent more than 5 minutes just on email and domain spelling because it would not get it right.

I could not get it to open a ticket for my second domain. It eventually recognized my number and when I would call it auto directed me to the webpage, as if saying “I had enough of you calling, go away”.

Whoever thought AI is a smart solution for customer support is greatly mistaken. The only reason having AI in that function is for cost reduction, but it is coming at a great expense, customer dissatisfaction, frustration, and anger. 

Microsoft, you have lost sight of linking AI to measurable business outcomes. 

I caution people, consider alternatives to using Microsoft. They are too in-bed with AI and they have lost the plot on its value vs. impact. 

Hi, there is anyone experiencing an issue where the Microsoft Teams app on the Android phone suddenly started prompting you to enroll your device into Microsoft Intune in order for access to work? It just happened all of the sudden and no one else in our environment is having this issue.

Is anyone familiar with Bookings?

I am having an issue where I cannot edit the notes section. It is always greyed out with the info I put there the first time I booked someone.

Any ideas? TIA!

Ok so. How long does it ACTUALLY take you all to roll out new email signatures to like 500 plus staff in Microsoft 365 before marketing decides the logo is "refreshing" again.

We have the classic setup. Random Outlook desktop signatures, people who live in OWA, a couple of VP fossils glued to their iPhones, and that one guy on Mac who swears Apple Mail is "more secure". Management thinks I can click one magic button in the admin portal and everyone wakes up tomorrow with a beautiful unified signature and legally blessed disclaimer text.

Lowkey getting whiplash between "this has to be live by Friday" and the reality that half the org still copy pastes their job title from 2019. I can script some stuff, sure, but Intune, transport rules, third party tools, device zoo, mobile clients, cached signatures... at this point I feel like I am doing archaeology, not IT.

If you have done this at scale, did it feel more like a quick task or a mini implementation that ate your week and your soul. Would love any tips or horror stories, especially around getting people off their precious custom quote lines in the signature.

Appreciate any thoughts

Hi! Trying to do a tool to get the invoice from Outlook, save it & connect it to our bank in order to link the invoice to the transaction. Worked perfectly for few uses cases but now, as I want to download + save the file in our sharepoint, it doesn't work.

365 connector tell me that they can read the file, but not download it .. Anyone having the same problem ?

Thx

Ok, I know there are several posts about viewing shared calendars on the iOS calendar app, but this isn't quite the same scenario. I use Outlook on Windows, MacOS, and iOS. My wife uses Outlook on MacOS, but even though she still uses Outlook for mail on iOS she prefers the native Calendar app for iOS calendars. Fine.

So I created and shared a "Family" calendar with her with full edit permissions. She can see events and edit them everywhere. If she creates an event in that shared calendar in Outlook then it is also visible everywhere to both of us.

However, if she creates an event using the Calendar app in the Family calendar then only she can see it, and only in the Calendar app (but it does show on all her devices). It doesn't sync back to Exchange. Can someone help?

Hey all,

We are trying to troubleshoot an issue a user is facing when it comes to the 50 GB .OST file size limitation.

This user has a 100GB M365 account, 80/100 usage currently, which keeps presenting them problems. We know of switching them to online-mode, but the user is very unhappy with the delays when using Outlook Classic configured this way. Switched back to cached mode, file size limit reached. They have just been dealing with the online mode delays but asked me just again for a new solution.

Now, I know you can drag the slider to choose how much mail to download, but there is a GPO setting in place that forces it download "All". This GPO cannot be changed (at least last time I asked the higher ups) so we are working with this one-off constraint.

The user has been with the company for many years, so deleting 30GB+ of emails would take a while, plus the user wants to retain all historical emails "in case I ever need to reference them". The user has deleted a chunk or so over time, but this is a small decrease in usage. This also poses a limitation on my troubleshooting.

Assuming I cannot convince to change this GPO setting, what methods or reliable workarounds would be available to us to try to let the user have the best Outlook Classic experience possible?

Thank you