Issue description     

• Auditing user logins: Tracking when and where users access Microsoft 365 resources.  

• Security monitoring: Identifying unusual login activities that may indicate security threats.  

• Compliance reporting: Ensuring login data is documented for regulatory requirements.  

While generating these reports, users may encounter the following error:

Unable to generate Microsoft 365 user logon reports in ADManager Plus.

This issue may lead to blank reports, data retrieval failures, or error messages, hindering administrative tasks such as auditing and monitoring.

Possible causes   

1. Incorrect Microsoft 365 credentials: The credentials used to connect ADManager Plus to Microsoft 365 may be invalid or expired. Additionally, MFA might be enabled for the service account, preventing authentication.

2. Insufficient permissions: The account used for integration may lack the Global Reader and Security Reader permissions to generate reports.

3. Network or connectivity issues: Problems with internet connectivity or firewall restrictions blocking API calls.

Prerequisites     

Before proceeding with the resolution:

• Ensure you have an active Microsoft 365 admin account with the Global Reader and Security Reader permissions.

• Ensure the server hosting ADManager Plus has stable internet access.

• Confirm that firewall rules allow communication between ADManager Plus and Microsoft 365 APIs.

Resolution 

Step 1: Verify Microsoft 365 configuration

1. Log in to ADManager Plus as an admin.

2. Navigate to Directory/Application settings > Microsoft 365.

3. Verify the configuration status.

4. If the credentials are incorrect or expired, update them and save the changes.
   

If the service has MFA, you can either exclude the service account from MFA or set up a Conditional Access policy.

Steps to exclude the service account from MFA

1. Check sign-in logs for MFA enforcement  

1. Sign in to the Microsoft Entra Admin Center.

2. Navigate to Identity > Users.

3. Search for and select the service account.

4. Click Sign-in logs in the left menu.

5. Select a recent sign-in attempt (both successful and failed ones).

6. For failed sign-ins, check the Conditional Access tab to see which policies were applied and whether MFA caused the failure.

7. Identify the policy with a Success status that enforced MFA.

b. Modify the Conditional Access policy to exclude the service account  

1. Go to Identity > Protection > Conditional Access.
   
2. Find and select the policy that enforced MFA (identified in Step 1).

3. Under Users, go to the Exclude section and add the service account.

4. Save the changes.
   

c. Validate the exclusion  

1. Attempt to sign in with the service account.

2. Verify that MFA is no longer prompted.

3. Check the Sign-in logs again to confirm the exclusion was applied. 

Step 2: Confirm required PowerShell modules are installed  

1. Open PowerShell as an administrator.

2. Run the following command to check if the required modules are installed.

• Get-InstalledModule

3. If the modules are missing, install them using:

• Install-Module AzureAD -Force

• Install-Module MSOnline -Force

• Install-Module ExchangeOnlineManagement -Force

4. After installation, restart ADManager Plus and try running the report again.

Step 3: Check account permissions  

1. Log in to the Microsoft 365 admin center.

2. Navigate to Users > Active Users and select the account used for ADManager Plus integration. This can be verified from the tenant configuration.
   

3. Ensure the account has the following roles:

• Global Reader and Security Reader

• Exchange Admin (if Exchange Online data is required)

4. If permissions are insufficient, assign the necessary roles and retry generating the report.

Step 4: Check Firewall restrictions  

1. Ensure that your firewall is not blocking required Microsoft 365 domains.

2. Refer to ManageEngine's firewall configuration guide for a list of domains that must be allowed.

3. If necessary, allow access to these domains and restart ADManager Plus.

 Tips 

• Track client secret expiration and update it before expiry to avoid disruptions.

• Use a dedicated service account with the required permissions instead of a personal account.

• Keep PowerShell modules updated to ensure compatibility with Microsoft 365.

• Verify that ADManager Plus has the necessary API permissions to retrieve Microsoft 365 data.

 Related topics and articles   

• Microsoft 365 license reports in ADManager Plus

• Microsoft 365 group reports in ADManager Plus

• On-the-fly management from reports

How to reach support