Menu
Modern Workplace Blog
  • Home
  • About: Kenneth van Surksum
  • Cookie Policy
Modern Workplace Blog
March 11, 2021March 11, 2021

Create Powershell Session is failed using OAuth when using the Exchange Online V2 PowerShell module

Today, while wanting to check some settings in our Exchange Online environment, I ran into an issue where the New-ExoPSSession command let failed with the following error: Create Powershell Session is failed using OAuth. It took me some time to figure out what was causing this issue, and I’m documenting it here for future reference.

TL;DR; – The solution was to modify the set the MDM Security Baseline in Microsoft Endpoint Manager and set the “Client basic authentication” setting under Remote Management to “Not Configured”

Some more details below,

While wanting to start a PowerShell session to Exchange Online using the Exchange Online PowerShell V2 module (EXO V2), I ran into the issue that after providing my Userid, password and approve with the MFA request, I was presented with the following error: New-ExoPSSession : Create Powershell Session is failed using OAuth.

Error when connecting to Exchange Online

After some searches on the internet I ended up at the Prerequisites for the EXO V2 module, which describes the following:

WinRM needs to allow Basic authentication (it’s enabled by default). We don’t send the username and password combination, but the Basic authentication header is required to send the session’s OAuth token, since the client-side WinRM implementation has no support for OAuth.

Wait, what? – so the module doesn’t use basic authentication (userid/password) but requires it to be enabled.

I quickly checked the configuration using the following command: winrm get winrm/config/client/auth

Basic auth disabled

Based on the documentation I tried to update the setting Basic to true, but that failed because the setting was coming from a GPO. But wait a minute, my machine in Azure AD joined, and I’m not using GPO technology.

I am doing some security configuration though on my Modern Workplace, and the first place to start is the Security Baseline, I quickly found the following setting, Client basic authentication which is set to “Disabled” by default.

MDM Security Baseline for Windows 10

After modifying this setting to “Not configured” and syncing the policy using the Company portal I got another result when requesting the WinRM settings.

WinRM basic authentication enabled

With this setting now set to basic, I tried again to connect to Exchange Online, this time with an expected result.

Succesful connection to Exchange Online using PowerShell

Conclusion

This article serves as a note for myself in case I drop into this issue again in the future, and hopefully it helped you if you ran into this issue and found my blogpost.

Be careful though when implementing exceptions for the baseline, especially in large environments this might be a reason to create a different baseline for people administering the environment and not giving this exception to all your users. Even better would be to not let administrators perform these tasks from their own workstations but require the usage of Privileged Access Workstations. I’m realistic though, and consider that scenario Utopia for many environments today.

Tweet
Follow me
Tweet #WPNinjasNL

2 thoughts on “Create Powershell Session is failed using OAuth when using the Exchange Online V2 PowerShell module”

  1. Roel Heymans says:
    March 11, 2021 at 4:08 pm

    Bumped into this one a couple of weeks ago.
    Will Microsoft ever stop asking us to break security each time they are slow in removing legacy?

    Reply
  2. Pingback: Modern Workspace: PowerShell OAuth Error – PwnDefend

Leave a Reply Cancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Insight24

Founding member of:

Follow me on Twitter

My Tweets

Recent Posts

  • Announcing #WPNinjasNL “Live – Ask us Anything” #4, on Tuesday March 23 about Expediting Windows 10 Quality Updates
  • Using Conditional Access to provide more granularity when registering or joining devices
  • Designing and configuring compliance policies for your Windows Modern Workplace using Microsoft Endpoint Manager
  • Announcing #WPNinjasNL Tuesdays Webinar #23, Tuesday April 13, featuring Greg Ramsey
  • Configuring Windows Update for Business settings for your Microsoft Endpoint Manager managed Modern Workplace

Books

System Center 2012 Service Manager Unleashed
Amazon
System Center 2012 R2 Configuration Manager Unleashed: Supplement to System Center 2012 Configuration Manager
Amazon
System Center Configuration Manager Current Branch Unleashed
Amazon
Mastering Windows 7 Deployment
Amazon
System Center 2012 Configuration Manager (SCCM) Unleashed
Amazon

Archives

  • April 2021
  • March 2021
  • February 2021
  • January 2021
  • December 2020
  • November 2020
  • October 2020
  • September 2020
  • August 2020
  • July 2020
  • June 2020
  • May 2020
  • April 2020
  • March 2020
  • February 2020
  • January 2020
  • December 2019
  • November 2019
  • October 2019
  • August 2019
  • July 2019
  • November 2016
  • November 2015
  • June 2015
  • May 2015
  • November 2014
  • July 2014
  • April 2014
  • March 2014
  • February 2014
  • January 2014
  • November 2013
  • August 2013
  • April 2013
  • March 2013
  • January 2013
  • December 2012
  • November 2012
  • August 2012
  • July 2012
  • June 2012

Meta

  • Log in
  • Entries feed
  • Comments feed
  • WordPress.org

Categories

  • Advanced Threat Protection (4)
  • Announcement (28)
  • Azure (3)
  • AzureAD (41)
  • Certification (2)
  • Cloud App Security (3)
  • Conditional Access (30)
  • Configuration Manager (24)
  • Events (5)
  • Exchange Online (7)
  • Identity Protection (3)
  • Intune (10)
  • Licensing (2)
  • Microsoft Endpoint Manager (16)
  • Mobile Application Management (1)
  • Modern Workplace (41)
  • Office 365 (10)
  • Overview (10)
  • Power Platform (1)
  • PowerShell (2)
  • Presentations (4)
  • Privileged Identity Management (3)
  • Role Based Access Control (2)
  • Security (32)
  • Service Manager (4)
  • Speaking (8)
  • Troubleshooting (1)
  • Uncategorized (10)
  • Windows 10 (11)
  • Windows Update for Business (1)
  • WMUG.nl (16)
  • WPNinjasNL (17)

Tags

#AzureAD #community #conditionalaccess #m365 #MEMCM #microsoft365 #modernworkplace #security #webinar #wmug_nl Applications ATP AzureAD Branding Community Conditional Access ConfigMgr ConfigMgr 2007 ConfigMgr 2012 Configuration Manager Email EXO Identity Intune Licensing MCAS MDT Modern Workplace Office 365 OSD PIM policies Policy Sets Presentation RBAC roles Security Service Manager SSP System Center Task Sequence troubleshooting webinar Windows 10 WMUG

Recent Comments

  • Aravindh on Designing and configuring compliance policies for your Windows Modern Workplace using Microsoft Endpoint Manager
  • Kenneth on License requirements for administering Microsoft 365 services
  • Kenneth on Conditional Access demystified: My recommended default set of policies
  • Designing and configuring compliance policies for your Windows Modern Workplace using Microsoft Endpoint Manager | Modern Workplace Blog on Designing and building your Microsoft Endpoint Manager/Intune environment for Operations
  • Ben on Conditional Access demystified: My recommended default set of policies
©2021 Modern Workplace Blog | Powered by WordPress and Superb Themes!
This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Cookie settingsACCEPT
Privacy & Cookies Policy

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may have an effect on your browsing experience.
Necessary
Always Enabled

Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.

Non-necessary

Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.

SAVE & ACCEPT