Trying to run this script, it doesn't accept any locations I've tried.
any advice?

.\SetupCrossTenantRelationshipForTargetTenant.ps1 -ResourceTenantDomain source.onmicrosoft.com -TargetTenantDomain destination.onmicrosoft.com -ResourceTenantId 1231413f09 -SubscriptionId 114151515 -resourcetenantadminemail [email protected] -ResourceGroup "Cross-TenantMoves" -KeyVaultName "Cross-TenantMovesVault" -KeyVaultAuditStorageAccountLocation "UK South" -azureresourcelocation "UK South"

All i get is: A valid Azure location was not specified

I cannot execute with success the script setupcrosstenantrelationshipfortargettenant.ps1 because contoso.onmicrosoft.com is hardcoded in line 801.

Can you update and fix the script?

Thank you.

Getting the following error with the invitation not being able to send -

Removing the -UseAppAndCertGeneratedForSendingInvitation switch results results in the AADSTS50011 error as detailed in the various other issues raised. I have also checked whether I have the target and resource domains backwards, as this was the resolution for one of the issues raised here.

Switches Used -
SetupCrossTenantRelationshipForTargetTenant.ps1 -ResourceTenantDomain -TargetTenantDomain -ResourceTenantAdminEmail -ResourceTenantId -SubscriptionId _{-ResourceGroup <"RG Name"> -KeyVaultName <"KV Name"> -CertificateSubject <"Cert CN Name"> -AzureAppPermissions Exchange, MSGraph -AzureResourceLocation -ExistingApplicationId -UseAppAndCertGeneratedForSendingInvitation}

I've made some progress with this today, however then i hit the following snag.
It looks like the script is trying to create a group twice?
The newly created resource group is empty.

Resource Group Cross-TenantMoves2 successfully created
New-AzKeyVault : The vault name 'Cross-TenantMovesVault2' is already in use. Vault names are globaly unique so it is
possible that the name is already taken. If you are sure that the vault name was not taken then it is possible that a
vault with the same name was recently deleted but not purged after being placed in a recoverable state. If the vault
is in a recoverable state then the vault will need to be purged before reusing the name. For more information on soft
delete and purging a vault follow this link https://go.microsoft.com/fwlink/?linkid=2147740.
At C:\Windows\system32\SetupCrossTenantRelationshipForTargetTenant.ps1:364 char:15
+ ...       $kv = New-AzKeyVault -Name $kvName -Location $arLocation -Resou ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [New-AzKeyVault], CloudException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.NewAzureKeyVault

I receive the following error when running SetupCrossTenantRelationshipForTargetTenant.ps1:

COMMENTS : Sending invitation
COMMENTS : POST https://graph.microsoft.com/v1.0/invitations with -1-byte payload
Invoke-RestMethod : Le serveur distant a retourné une erreur : (400) Demande incorrecte.
Au caractère C:\O365\Cross-tenant\SetupCrossTenantRelationshipForTargetTenant.ps1:669 : 17

• ... $resp = Invoke-RestMethod -Method POST -Uri "https://graph.micros ...
• CategoryInfo : InvalidOperation : (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebEx
  ception
• FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodComman

The error appears to occur when line 668 is executed inside the function: Send-AdminConsentUri

Both SetupCrossTenantRelationshipForTargetTenant.ps1 and SetupCrossTenantRelationshipForResourceTenant.ps1 have the synopsis:

This script can be used by a tenant that wishes to pull resources out of another tenant.
For example contoso.com would run this script in order to pull mailboxes from fabrikam.com tenant.

The second line in SetupCrossTenantRelationshipForResourceTenant.ps1 should be changed.

When reading (https://docs.microsoft.com/en-us/microsoft-365/enterprise/cross-tenant-mailbox-migration?view=o365-worldwide) it says:

-ResourceTenantDomain | Source tenant domain, such as fabrikam.onmicrosoft.com.

but in the synopsis you have

SetupCrossTenantRelationshipForTargetTenant.ps1 -ResourceTenantDomain contoso.onmicrosoft.com -TargetTenantDomain fabrikam.onmicrosoft.com

It makes it a bit confusing to tell which tenant is which, since the documentation clearly shows in the image the that you're pulling mailboxes from the source tenant, but the examples in the synopsis are reversed.

Finally you in SetupCrossTenantRelationshipForResourceTenant.ps1 have:

this script is intended for the resource tenant in above example fabrikam.com

but the example shows -ResourceTenantDomain contoso.onmicrosoft.com

Am I just completely misreading something?

Unfortunately hit another error:

Line |
 208 |          $azureADAccount = Connect-AzureAD
     |                            ~~~~~~~~~~~~~~~
     | One or more errors occurred. (Could not load type 'System.Security.Cryptography.SHA256Cng' from assembly 'System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'.): Could not load type
     | 'System.Security.Cryptography.SHA256Cng' from assembly 'System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'.

This is using powershell 7, and the latest module versions for Az.

I'm receiving when executing SetupCrossTenantRelationshipForTargetTenant.ps1:

Line |
329 | $desiredAzureModules.Keys | Import-Module -verbose:$false | Out-N …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Assembly with same name is already loaded

I receive no errors on the two setup scripts and then when running the verification script for the target tenant the organization relationship is still reporting failed.

Is there a location to receive more assistance in troubleshooting? The output doesn't explain why.

Tried to run this to finally finish it.. and got the following:

PS C:\Windows\system32> SetupCrossTenantRelationshipForResourceTenant.ps1 -SourceMailboxMovePublishedScopes "MigScope","
NSSMigration" -ResourceTenantDomain source.onmicrosoft.com -TargetTenantDomain target.onmicrosoft.com
-ApplicationId 77784916-1f66-42d0-b28f-b5ae4f1778c9 -TargetTenantId 645473a2-62c5-4bab-8a6d-837c0d96587c
At C:\Windows\system32\SetupCrossTenantRelationshipForResourceTenant.ps1:1 char:91
+ ...  "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+                                                                          ~
Missing file specification after redirection operator.
At C:\Windows\system32\SetupCrossTenantRelationshipForResourceTenant.ps1:94 char:30
+ /* Created by Arian Stolwijk <http://www.aryweb.nl> */
+                              ~
The '<' operator is reserved for future use.
At C:\Windows\system32\SetupCrossTenantRelationshipForResourceTenant.ps1:111 char:38
+     background: -moz-linear-gradient(top, rgba(246,246,246,1) 0%, rgb ...
+                                         ~
Missing argument in parameter list.
At C:\Windows\system32\SetupCrossTenantRelationshipForResourceTenant.ps1:112 char:37
+     background: -webkit-gradient(linear, left top, left bottom, color ...
+                                        ~
Missing argument in parameter list.
At C:\Windows\system32\SetupCrossTenantRelationshipForResourceTenant.ps1:112 char:76
+ ... webkit-gradient(linear, left top, left bottom, color-stop(0%,rgba(246 ...
+                                                                  ~
Missing expression after unary operator ','.
At C:\Windows\system32\SetupCrossTenantRelationshipForResourceTenant.ps1:112 char:76
+ ... it-gradient(linear, left top, left bottom, color-stop(0%,rgba(246,246 ...
+                                                              ~~~~
Unexpected token 'rgba' in expression or statement.
At C:\Windows\system32\SetupCrossTenantRelationshipForResourceTenant.ps1:112 char:76
+ ... webkit-gradient(linear, left top, left bottom, color-stop(0%,rgba(246 ...
+                                                                  ~
Missing closing ')' in expression.
At C:\Windows\system32\SetupCrossTenantRelationshipForResourceTenant.ps1:112 char:112
+ ... ft bottom, color-stop(0%,rgba(246,246,246,1)), color-stop(8%,rgba(225 ...
+                                                                  ~
Missing expression after unary operator ','.
At C:\Windows\system32\SetupCrossTenantRelationshipForResourceTenant.ps1:112 char:112
+ ... ottom, color-stop(0%,rgba(246,246,246,1)), color-stop(8%,rgba(225,225 ...
+                                                              ~~~~
Unexpected token 'rgba' in expression or statement.
At C:\Windows\system32\SetupCrossTenantRelationshipForResourceTenant.ps1:112 char:112
+ ... ft bottom, color-stop(0%,rgba(246,246,246,1)), color-stop(8%,rgba(225 ...
+                                                                  ~
Missing closing ')' in expression.
Not all parse errors were reported.  Correct the reported errors and try again.
    + CategoryInfo          : ParserError: (:) [], ParseException
    + FullyQualifiedErrorId : MissingFileSpecification

Is it something i did, or something in the script needs changing?

Hi, I'm trying to run the first script from the Microsoft site, they create the resource and key vault, but stop and show this issue:
I run this:

Source: https://docs.microsoft.com/pt-br/microsoft-365/enterprise/cross-tenant-mailbox-migration?view=o365-worldwide

.\SetupCrossTenantRelationshipForTargetTenant.ps1 -ResourceTenantDomain xxxxxx
-ResourceTenantAdminEmail XXXX@XXXXXX -TargetTenantDomain xxxxxx
-ResourceTenantId xxxx -ResourceGroup "Cross-TenantMoves-TESTE-XXX"
-KeyVaultName "CrossTesteUCB" -CertificateName "XXXTESTE-XXXXTESTE-cert"
-CertificateSubject "CN=XXXTESTE_XXXTEST" -AzureAppPermissions Exchange, MSGraph
-UseAppAndCertGeneratedForSendingInvitation -KeyVaultAuditStorageAccountName "t2tstorageaccount"
-KeyVaultAuditStorageResourceGroup "Demo" -SubscriptionId xxxxxx
-AzureResourceLocation 'West US'

C: \ Script \ SetupCrossTenantRelationshipForTargetTenant.ps1: It is not possible to validate the argument in the 'Location' parameter. The argument is null or empty. Provide an argument that is not null or empty
and try the command again.

Thankyou.

When running .\SetupCrossTenantRelationshipForTargetTenant.ps1 always getting the following error:
`SetupCrossTenantRelationshipForTargetTenant.ps1 : Cannot validate argument on parameter 'Location'. The argument is null or empty. Provide an argument that is not null or empty, and then try the command again.
At line:1 char:1

• .\SetupCrossTenantRelationshipForTargetTenant.ps1 -ResourceTenantDoma ...

•   + CategoryInfo          : InvalidData: (:) [SetupCrossTenan...argetTenant.ps1], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,SetupCrossTenantRelationshipForTargetTenant.ps1`
  
  

Location is specified, Vault is created but nothing happens afterwards

We have been trying to get the SetupCrossTenantRelationshipForResourceTenant.ps1 script to run. The docs are pretty out of date to the current version but we have been working through it, We are now hitting an issue with it at the point where we have to consent to the application, section 6 in the step by step guide. We have clicked the link and accepted as a global admin in the target tenant. In Azure we can see the app and it all looks ok. We then get a message where it appears to be trying to get a token so that it can send an email to the admin in the source tenant. We get a log in prompt, we assume its the GA for the target tenant though we have tried both, and when we put in our credentials we get a error dialog as shown in the attachment. In the script we believe this is happening in the function Get-AccessTokenWithUserPrompt as we have put on verbose output and we see the output from line 577
Write-Verbose "Acquiring token resourceAppIdURI $resourceUri"
just before the error is raised. At this point the script exits

Please consent to the app for newcollegeonline.onmicrosoft.com before sending invitation to [email protected]:

C:\Exchange Online Setup\SetupCrossTenantRelationshipForTargetTenant.ps1 : Exception calling "GetResult" with "0" argument(s): "User canceled authentication"
At C:\Exchange Online Setup\CommandLineTarget.ps1:1 char:1

• .\SetupCrossTenantRelationshipForTargetTenant.ps1 `

•   + CategoryInfo          : NotSpecified: (:) [SetupCrossTenan...argetTenant.ps1], MethodInvocationException
    + FullyQualifiedErrorId : AdalServiceException,SetupCrossTenantRelationshipForTargetTenant.ps1
  
  

PS C:\Exchange Online Setup>

During the script process, the user copies the first URL and accepts the app permissions within the browser. Following this, pressing return in the PowerShell session prompts for authentication. Once authentication is given, the error is presented.

I have tried consenting to both URLs, tried authentication with/without MFA, authenticating with the source tenant admin as well.

If I check the app that has been registered, before pressing return in PS, I can see that the redirect URL is office.com within Azure AD > App Registrations > Authentication > redirect (if that is of use).

Admin consent URI for xxxxx.onmicrosoft.com tenant admin is -
https://login.microsoftonline.com/xxxxx.onmicrosoft.com/adminconsent?client_id=5c53a70b-b548-45de-838c-64b5d7198301&redirect_uri=https://office.com
Admin consent URI for yyyyy.onmicrosoft.com tenant admin is -
https://login.microsoftonline.com/yyyyy..onmicrosoft.com/adminconsent?client_id=5c53a70b-b548-45de-838c-64b5d7198301&redirect_uri=https://office.com

Application details to be registered in organization relationship: ApplicationId: [ 5c53a70b-b548-45de-838c-64b5d7198301 ]. KeyVault secret Id: [ https://aaaaa.vault.azure.net:443/certificates/bbbbb/d861f72b6c30476c96201924ef584b72 ]. These values are available in variables $AppId and $CertificateId respectively
Please consent to the app for xxxxx.onmicrosoft.com before sending invitation to [email protected]:

PowerShell version (on W10)

PS C:\Temp\cross-tenant-main> $PSVersionTable.PSVersion
Major  Minor  Build  Revision
-----  -----  -----  --------
5      1      19041  1023

Before running script (from the main branch)

Connect-ExchangeOnline -UserPrincipalName global-admin@targetpublicdomain

Script invoked with

.\SetupCrossTenantRelationshipForTargetTenant.ps1 -ResourceTenantDomain <source>.onmicrosoft.com -TargetTenantDomain <target>.onmicrosoft.com -ResourceTenantAdminEmail Admin@<sourcepublicdomain> -ResourceTenantId <redacted> -SubscriptionId <redacted> -ResourceGroup "<redacted>" -KeyVaultName "JC-G-Migration-Vault" -AzureResourceLocation "West US" -CertificateName "JC-G-Migration-Cert" -CertificateSubject "<redacted>" -AzureAppPermissions Exchange, MSGraph -MigrationEndpointMaxConcurrentMigrations 20 -UseAppAndCertGeneratedForSendingInvitation

After invoking script, there was a single modern auth prompt, which from the page https://docs.microsoft.com/en-us/microsoft-365/enterprise/cross-tenant-mailbox-migration?view=o365-worldwide I presumed was for the target

Script errors with

Verifying that your script is up to date with the latest changes.

Beginning download of SetupCrossTenantRelationshipForTargetTenant.ps1 and creation of temporary files.

Verifying that a valid location was specified for Azure


You are using the latest version of the script. Removing temporary files and proceeding with setup.
WARNING: TenantId '<redacted>' contains more than one active subscription. First one will be
selected for further use. To select another subscription, use Set-AzContext.
Setting up key vault in the <redacted>.onmicrosoft.com tenant

Name                                     Account             SubscriptionName    Environment         TenantId
----                                     -------             ----------------    -----------         --------
<redacted> (<redacted> <redacted>. <redacted>. AzureCloud          <redacted>
Resource Group <redacted> successfully created
KeyVault JC-G-Migration-Vault successfully created
Exchange app given access to KeyVault JC-G-Migration-Vault
Self signed certificate requested in key vault - JC-G-Migration-Vault. Certificate name - JC-G-Migration-Cert
Certificate JC-G-Migration-Cert successfully created
C:\Temp\cross-tenant-main\SetupCrossTenantRelationshipForTargetTenant.ps1 : You cannot call a method on a null-valued
expression.
At line:1 char:1
+ .\SetupCrossTenantRelationshipForTargetTenant.ps1 -ResourceTenantDoma ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [SetupCrossTenan...argetTenant.ps1], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull,SetupCrossTenantRelationshipForTargetTenant.ps1

"WARNING: TenantId 'xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx' contains more than one active subscription. First one will be
selected for further use. To select another subscription, use Set-AzContext.

Check-AzurePowershellConnection : A valid Azure location was not specified, please run Get-AzLocation to determine a
valid location."

I do not have full permssion to the first subscription in the azure tenant.
I've tried connecting before running the script with Connect-AzAccount -Subscription 'xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx'.
The subscriptionID is specified as a parameter when running and I have tried to set the context with the Set-AzContext command befor running but it still selects the first subscription for the validation check and then the script closes.

Hey guys,

The current procedure does not work for me. I can't migrate any mailboxes from source to destination.

In the other Issue I received the new procedure (documentation 2.0). But it does not work. I get the error below:

------->

PS C:\WINDOWS\system32> Test-MigrationServerAvailability -Endpoint "amb-to-n1" -TestMailbox "[email protected]"

RunspaceId : db613b45-d96c-4376-a1f3-b092bb1548df
Result : Failed
couldn't be found on 'CP2PR80A001DC03.LAMPR80A001.prod.outlook.com'.
SupportsCutover : False
ErrorDetail : Microsoft.Exchange.Configuration.Tasks.ManagementObjectNotFoundException: Could not perform operation because object '[email protected]' em could not be found on 'CP2PR80A001DC03.LAMPR80A001.prod.outlook.com'.
at
Microsoft.Exchange.Configuration.Tasks.DataAccessTask1.GetDataObject[TObject](IIdentityParameter id, IConfigDataProvider session, ObjectId rootID, OptionalIdentityData optionalData, Func2
notFoundError, Func`2 multipleFoundError, ExchangeErrorCategory errorCategory)
at Microsoft.Exchange.Configuration.Tasks.RecipientTaskHelper.ResolveDataObject[TDataObject](IConf
igDataProvider dataSession, IConfigDataProvider globalCatalogSession, Boolean viewEntireForest,
IIdentityParameter identity, ObjectId rootId, OptionalIdentityData optionalData, String
domainController, CategorizedGetDataObjectDelegate getDataObjectHandler, TaskVerboseLoggingDelegate
logHandler, ErrorLoggerDelegate errorHandler)
at Microsoft.Exchange.MailboxReplicationService.RequestTaskHelper.ResolveADRecipient[T](IRecipient
Session dataSession, IRecipientSession globalCatalogSession, ADServerSettings serverSettings,
IIdentityParameter identity, OptionalIdentityData optionalData, String domainController,
CategorizedGetDataObjectDelegate getDataObjectHandler, TaskVerboseLoggingDelegate logVerbose,
ErrorLoggerDelegate writeError, Boolean checkScopes)
at Microsoft.Exchange.Management.Migration.MigrationService.Endpoint.TestMigrationServerAvailabili
ty.InternalProcessEndpoint(Boolean fromAutoDiscover)
TestedEndpoint :
IsValid : True
Identity :
ObjectState : New

------->

If I specify an account that is not in the mailbox-enabled security group on the source, I get this error:

Message : You can't use the domain because it's not an accepted domain for your organization.

If I specify an account that is in the mailbox-enabled security group on the source, I get this error:

ErrorDetail : Microsoft.Exchange.Configuration.Tasks.ManagementObjectNotFoundException: Could not perform operation because object '[email protected]' em could not be found on 'CP2PR80A001DC03.LAMPR80A001.prod.outlook.com'.

Is there a solution for this error?

Cross-tenant.mailbox.migration.preview.v2.pdf

Just after the script creates the AAD enterprise application "targetDomain_Friends_sourceDomain_####" and I approve the app for the organization (both following the link and through the Azure portal), I'm getting prompted with another login window. I re-enter my Global Admin credentials for the target domain, but get the error "AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the application: 'a0c73c16-a7e3-4564-9a95-2bdf47383716'. " This application ID is the same every time I encounter the error, even though the new enterprise application ID has a different number. There's no way to go back to re-enter credentials and the script bombs out with a "User canceled authentication" message.

I've looked through all the enterprise applications in the target domain and for the life of me I cannot find the application ID referenced in the error message.

I am getting an error "Assembly with the same name is already loaded" as seen in the screenshot below.

Get-Host:

Name : ConsoleHost
Version : 7.1.3
InstanceId : ********************
UI : System.Management.Automation.Internal.Host.InternalHostUserInterface
CurrentCulture : en-US
CurrentUICulture : en-US
PrivateData : Microsoft.PowerShell.ConsoleHost+ConsoleColorProxy
DebuggerEnabled : True
IsRunspacePushed : False
Runspace : System.Management.Automation.Runspaces.LocalRunspace

Get-Module:

ModuleType Version PreRelease Name ExportedCommands

Script 2.2.8 Az.Accounts {Add-AzEnvironment, Clear-AzContext, Clear-AzDefault, Connect-AzAccount…}
Script 3.4.3 Az.KeyVault {Add-AzKeyVaultCertificate, Add-AzKeyVaultCertificateContact, Add-AzKeyVaultKey, Add-AzKeyVaultManagedStorageAccount…}
Script 2.5.0 Az.Monitor {Add-AzAutoscaleSetting, Add-AzLogProfile, Add-AzMetricAlertRule, Add-AzMetricAlertRuleV2…}
Script 3.5.0 Az.Resources {Add-AzADGroupMember, Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzADAppCredential…}
Binary 2.0.2.130 AzureAD {Add-AzureADApplicationOwner, Add-AzureADDeviceRegisteredOwner, Add-AzureADDeviceRegisteredUser, Add-AzureADDirectoryRoleMember…}
Script 2.0.5 ExchangeOnlineManagement {Get-EXOCasMailbox, Get-EXOMailbox, Get-EXOMailboxFolderPermission, Get-EXOMailboxFolderStatistics…}
Manifest 7.0.0.0 Microsoft.PowerShell.Management {Add-Content, Clear-Content, Clear-Item, Clear-ItemProperty…}
Manifest 7.0.0.0 Microsoft.PowerShell.Utility {Add-Member, Add-Type, Clear-Variable, Compare-Object…}
Script 2.1.0 PSReadLine {Get-PSReadLineKeyHandler, Get-PSReadLineOption, Remove-PSReadLineKeyHandler, Set-PSReadLineKeyHandler…}
Script 1.0 tmp_xg2qm3nq.e1y {Add-ATPEvaluation, Add-AvailabilityAddressSpace, Add-DistributionGroupMember, Add-MailboxFolderPermission…}

D:\new\SetupCrossTenantRelationshipForTargetTenant.ps1 : Cannot validate argument on parameter 'SkuName'. The argument "" does not belong to the set
"Standard_LRS,Standard_ZRS,Standard_GRS,Standard_RAGRS,Premium_LRS,Premium_ZRS,Standard_GZRS,Standard_RAGZRS" specified by the ValidateSet attribute. Supply an argument that is in the set
and then try the command again.
At line:1 char:1

• .\SetupCrossTenantRelationshipForTargetTenant.ps1 -ResourceTenantDoma ...

•   + CategoryInfo          : InvalidData: (:) [SetupCrossTenan...argetTenant.ps1], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,SetupCrossTenantRelationshipForTargetTenant.ps1
  

I receive the following error when running SetupCrossTenantRelationshipForTargetTenant.ps1:

"AADSTS90002: Tenant 'token' not found. This may happen if there are no active subscriptions for the tenant. Check to make sure you have the correct tenant ID. Check with your subscription administrator."

The error appears to occur when line 607 is executed inside the Get-AccessTokenWithUserPrompt function:

return $authContext.AcquireTokenAsync($resourceUri, $FIRSTPARTY_POWERSHELL_CLIENTID, $FIRSTPARTY_POWERSHELL_CLIENT_REDIRECT_URI, $platformParams).GetAwaiter().GetResult()

A fiddler trace shows that the script is attempting to use this URL to acquire the token:

https://login.microsoftonline.com/token/oauth2/authorize...

That URL appears incorrect. Instead of "token" it should have the target tenant domain/ID or "common"

Note that the Get-AccessTokenWithUserPrompt function has a parameter called authContextTenant that contains the target tenant domain name, but it never actually gets used in the function, which appears to be related to the issue.

I have already set up both the Source or Target Tenant but stuck on the next step

1. Can show me an example of "users.csv" which will used in the Create Migration batches step?
   

2. How to set objects and attributes in the target organization that will match with the sources tenant?
   

Hope can make a easier version for (https://docs.microsoft.com/en-us/microsoft-365/enterprise/cross-tenant-mailbox-migration?view=o365-worldwide)

I dont understand this error as it is not even in the script.

this is on the source side, when running with all the parameters.

Getting this error.

VERBOSE : Creating Organization Relationship: Domain_Sync_9193 in domain.onmicrosoft.com
The parent object for Domain_Sync_9193 could not be found. Please check that domain.onmicrosoft.com \federation exists.

Thank you for writing a great script.

An AADSTS1000031 error is recorded when inviting a user on the resource tenant side, even though the migrating application exists on both the Resource Tenant and Target Tenant.

I think that the 1000031 error itself is an error that is logged when the application does not exist in the target or resource tenant.

As shown in the screenshot below, we can register the application for migration in each tenant by executing Admin Consent as a global administrator from the Admin Consent URLs for the Target and Resource tenants output in PowerShell.

In this case, since the application exists, I thought there would be no error when I invite a user from the Resource tenant to the Target tenant as a guest user, but in fact, an error was recorded in the URL as shown in the screenshot below.

However, the error was recorded in the URL as shown in the screenshot below. In fact, the mailbox migration was completed even if this error was ignored, so I think it is appropriate that the 1000031 error is not output if the migration application is registered in both tenants.

This line throws a "You cannot call a method on a null-valued expression" error if there are no errors in the $Error variable or if $Error[0] doesn't contain an ErrorRecord, which is almost always the case. So the script almost always fails on this line.

$Error[0].Exception.ErrorRecord.FullyQualifiedErrorId.Contains("MaximumConcurrentMigrationLimitExceededException")

Does anyone know what I can do to see where the org relationship is incorrect?

The following error is received while running the script:

C:\SetupCrossTenantRelationshipForTargetTenant.ps1 : The term '=' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1

• .\SetupCrossTenantRelationshipForTargetTenant.ps1 -ResourceTenantDoma ...

•   + CategoryInfo          : ObjectNotFound: (=:String) [SetupCrossTenan...argetTenant.ps1], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException,SetupCrossTenantRelationshipForTargetTenant.ps1
  
  
  

This is because the script compares the values using == instead of -eq

it does so several times as noted in the following reference:

if ($Government == $true) {
    Write-Host ("https://login.microsoftonline.us/{0}/adminconsent?client_id={1}&redirect_uri={2}" -f $targetTenantDomain, $appCreated.AppId, $appCreated.ReplyUrls[0])
} else {
    Write-Host ("https://login.microsoftonline.com/{0}/adminconsent?client_id={1}&redirect_uri={2}" -f $targetTenantDomain, $appCreated.AppId, $appCreated.ReplyUrls[0])
}

Write-Host "Admin consent URI for $resourceTenantDomain tenant admin is -" -Foreground Yellow
if ($Government == $true) {
    Write-Host ("https://login.microsoftonline.us/{0}/adminconsent?client_id={1}&redirect_uri={2}" -f $resourceTenantDomain, $appCreated.AppId, $appCreated.ReplyUrls[0])
} else {
    Write-Host ("https://login.microsoftonline.com/{0}/adminconsent?client_id={1}&redirect_uri={2}" -f $resourceTenantDomain, $appCreated.AppId, $appCreated.ReplyUrls[0])
}

found on lines 530 and 537

if ($Government == $true) {
    $authority = "https://login.microsoftonline.us/$authContextTenant/oauth2/token"
} else {
    $authority = "https://login.microsoftonline.com/$authContextTenant/oauth2/token"
}

found on line 547

if ($Government == $true) {
    $authority = "https://login.microsoftonline.us/common/oauth2/token"
} else {
    $authority = "https://login.microsoftonline.com/common/oauth2/token"
}

found on line 569

    if ($Government == $true) {
        $msGraphResourceUri = "https://graph.microsoft.us"
    } else {
        $msGraphResourceUri = "https://graph.microsoft.com"
    }

found on line 583

    if ($Government == $true) {
        $invitationBody = @{
            invitedUserEmailAddress = $resourceTenantDomainAdminEmail
            inviteRedirectUrl = ("https://login.microsoftonline.us/{0}/adminconsent?client_id={1}&redirect_uri={2}" -f $resourceTenantDomain, $appId, $appReplyUrl)
            sendInvitationMessage = $true

found on line 600

    if ($Government == $true) {
        $resp = Invoke-RestMethod -Method POST -Uri "https://graph.microsoft.us/v1.0/invitations" -Body $invitationBodyJson -ContentType 'application/json' -Headers $headers
    } else {
        $resp = Invoke-RestMethod -Method POST -Uri "https://graph.microsoft.com/v1.0/invitations" -Body $invitationBodyJson -ContentType 'application/json' -Headers $headers
    }

found on line 632

Hi Support,

I am wondering if there is any way to get whole process performed under condition, where Target tenant does not have Azure Subscription to setup keyvault and is not willing to have one. Any workaround?

When we run SetupCrossTenantRelationshipForTargetTenant.ps1 it stops with "AADSTS90002: Tenant 'token' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. Check with your subscription administrator, this may happen if there are no active subscriptions for the tenant." and I need your advice / help in order to get this done.

Resource Tenant ID = 856989e9-72d0-40b0-98e4-0e4d628c4066
Target Tenant ID = af95f9d5-5b17-481b-a96b-6896de999ac3

Request Id: 98b3a2ef-6fa9-49fc-bb68-f600b1e15400
Correlation Id: 40c6e8dc-8911-463a-a8f9-c4a95f1cf835
Timestamp: 2021-09-25T22:10:19Z
Message: AADSTS90002: Tenant 'token' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. Check with your subscription administrator, this may happen if there are no active subscriptions for the tenant.

ResourceTenantId = 856989e9-72d0-40b0-98e4-0e4d628c4066

Hi,

I´m running the script with following arguments:

.\SetupCrossTenantRelationshipForTargetTenant.ps1 -ResourceTenantDomain xpto -ResourceTenantAdminEmail xpto -TargetTenantDomain xpto -ResourceTenantId xpto -SubscriptionId xpto -ResourceGroup "xpto" -KeyVaultName "xpto" -CertificateName "xpto" -CertificateSubject "CN=xpto" -AzureAppPermissions Exchange, MSGraph -UseAppAndCertGeneratedForSendingInvitation -KeyVaultAuditStorageAccountName "xpto" -KeyVaultAuditStorageResourceGroup "xpto"

The RG and KV is created without problems, but when goes to the next step gives me this error:

Can anyone help me, please ?

BR
David Lalim

Line 801 has this:

New-OrganizationRelationship -DomainNames contoso.onmicrosoft.com -Name Contoso -WhatIf -ErrorAction Stop

Contoso is hardcoded, I'm sure this should be a variable

Getting the following error. I am able to get through the login prompt before receiving this error. When I try and run without the "=" in the certificate subject, the script fails to validate. Am I missing something simple?

PS C:\Users\jerem\OneDrive - ALICE Training Institute\Powershell> .\SetupCrossTenantRelationshipForTargetTenant.ps1 -ResourceTenantDomain healthec.onmicrosoft.com -ResourceTenantAdminEmail [email protected] -TargetTenantDomain healthecind.onmicrosoft.com -ResourceTenantId redacted -SubscriptionId redacted -ResourceGroup "Migration" -KeyVaultName "healthecind-vault" -CertificateName "MigrationCert" -CertificateSubject "CN=healthecind" -AzureAppPermissions Exchange, MSGraph 


Welcome to the Cross-tenant mailbox migration preview! Before running this script, please be sure to review the details provided on docs.microsoft.com at the following URL: 
https://docs.microsoft.com/en-us/microsoft-365/enterprise/cross-tenant-mailbox-migration

It is also recommended before running this script to review the script in a script editor or Notepad prior to running. 

For general feedback and / or questions, please contact [email protected].
This is not a support alias and should not be used if you are currently experiencing an issue and need immediate assistance. 

Setting up key vault in the healthecind.onmicrosoft.com tenant

Name                                     Account                            SubscriptionName                  Environment                       TenantId                         
----                                     -------                            ----------------                  -----------                       --------                         
Azure subscription 1 (redacted... [email protected]... Azure subscription 1              AzureCloud                        redacted...
Exchange app given access to KeyVault healthecind-vault
Application healthecind_Friends_healthec_1462 created successfully in healthecind.onmicrosoft.com tenant with following permissions. MSGraph - User.Invite.All. Exchange - Mailbox
.Migration
Admin consent URI for healthecind.onmicrosoft.com tenant admin is -
redacted\SetupCrossTenantRelationshipForTargetTenant.ps1 : The term '=' is not recognized as the name of a cmdlet, 
function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1
+ .\SetupCrossTenantRelationshipForTargetTenant.ps1 -ResourceTenantDoma ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (=:String) [SetupCrossTenan...argetTenant.ps1], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException,SetupCrossTenantRelationshipForTargetTenant.ps1

I'm try running this script, but now found a new issue. Probably is my mistake, if possible, help me.

Im my case, i want to cross tenant fabrikam.onmicrosoft.com with tenant contoso.onmicrosoft.com, but in each place where I search, says one thing. Maybe somebody can help.

What I need to write here:
(some docs show this)
-ResourceTenantDomain fabrikam.onmicrosoft.com
-TargetTenantDomain contoso.onmicrosoft.com
-ResourceTenantAdminEmail [email protected]

Or
(I tryed like this)
-ResourceTenantDomain fabrikam.onmicrosoft.com
-TargetTenantDomain contoso.onmicrosoft.com
-ResourceTenantAdminEmail [email protected]

Im tryed the last, and after all steps, I received this message:

ASSERT: The resource tenant and the accessing tenant cannot be equal

cmdlet SetupCrossTenantRelationshipForTargetTenant.ps1 at command pipeline position 1
Supply values for the following parameters:
(Type !? for Help.)
AzureResourceLocation: East US

Welcome to the Cross-tenant mailbox migration preview! Before running this script, please be sure to review the details provided on docs.microsoft.com at the following URL:
https://docs.microsoft.com/en-us/microsoft-365/enterprise/cross-tenant-mailbox-migration

It is also recommended before running this script to review the script in a script editor or Notepad prior to running.

For general feedback and / or questions, please contact [email protected].
This is not a support alias and should not be used if you are currently experiencing an issue and need immediate assistance.

Confirm: Configure Cross-Tenant mailbox migration preview.

If you are ready to begin configuring your tenants, select 'Y'.
If you need to review any additional details and proceed at a later time, select 'N'.

Do you wish to proceed?
[Y] Yes [N] No [?] Help (default is "N"): Y

We are verifying that you are using the latest version of the script.

This requires that we download the latest version of the script from GitHub to compare with your local copy.
This file will be stored on your local computer temporarily, as well as overwrite your existing script file if it is out of date.

Confirm: Allow for download from GitHub.

If you are ready to begin this step, select 'Y'.
If you would prefer to manually download the scripts to make sure you have the latest version, select 'N'
[Y] Yes [N] No [?] Help (default is "N"): Y

Beginning verification steps.

Verifying ability to create a new organization relationship in the tenant.
What if: Creating organization relationship "Contoso" with domains "'contoso.onmicrosoft.com'".

Verifying that your script is up to date with the latest changes.

Beginning download of SetupCrossTenantRelationshipForTargetTenant.ps1 and creation of temporary files.
Remove-Item : Access to the cloud file is denied
At path removed for privacy\SetupCrossTenantRelationshipForTargetTenant.ps1:810 char:9

•     Remove-Item -Path $ScriptDir\XTenantTemp\ -Recurse -Force | O ...
  

•     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [Remove-Item], Win32Exception
  • FullyQualifiedErrorId : System.ComponentModel.Win32Exception,Microsoft.PowerShell.Commands.RemoveItemCommand

I was nearing completing of the Target tenant setup and hit a block. I got through the consent, and the email was sent to the source tenant admin email. Then, after it was attempting to finish configuring the exchange side, I get the null error. See screenshots and appreciate any insights or further troubleshooting. Thanks!

here's the script/parameters screenshot

Hi There,

I'm probably missing a prerequisite but I'm getting parameter not found issues on both sides:
Target: MailboxMoveCapability, RemoteTenant
Resource: MailboxMoveCapability, OAuthApplicationId

It seems the version of Set/New OrganizationRelationship I have does not have these parameters - how do I update this?

p.s. Sorry If I'm posting this in the wrong place not sure where else to go.

When using the SetupCrossTenantRelationshipForTargetTenant.ps1 script, the AppRegistration is not able to invite Resource Tenant account specified in ResourceTenantAdminEmail. The Azure AD Guest Invitation result in the Error: "Insuficient privileges to perform the requested operation by the application '00000003-0000-0000-c000-000000000000', ControllerName=MSGraphInviteAPI, ActionName=CreateInvite, URL absolute path=/api/GuidOfTheGuestAccountHere/Invites" in line 523

Quick and dirty fix was to:

1. Replace:
   $MS_GRAPH_APP_ROLE = "Directory.ReadWrite.All"
   by:
   $MS_GRAPH_APP_ROLE = 'Directory.ReadWrite.All','User.Invite.All'
2. Replace:

        $msGraphAppPermission = $msGraphSpn.AppRoles | ? { $_.Value -eq $MS_GRAPH_APP_ROLE }
        $reqGraph = New-Object -TypeName "Microsoft.Open.AzureAD.Model.RequiredResourceAccess"
        $reqGraph.ResourceAppId = $msGraphSpn.AppId
        $reqGraph.ResourceAccess = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" -ArgumentList $msGraphAppPermission.Id,"Role"
        $appPermissions += $reqGraph

by:

    $reqGraph = New-Object -TypeName "Microsoft.Open.AzureAD.Model.RequiredResourceAccess"
    $reqGraph.ResourceAppId = $msGraphSpn.AppId
    foreach ($role in $MS_GRAPH_APP_ROLE) {
            $reqGraph.ResourceAccess += New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" -ArgumentList ($msGraphSpn.AppRoles | Where-Object -FilterScript { $_.Value -eq $role }).Id, 'Role'
        }
    }
    $appPermissions += $reqGraph

3. Replace:

    if ($azAppPermissions.HasFlag([ApplicationPermissions]::MSGraph)) {
        $permissions += "MSGraph - $MS_GRAPH_APP_ROLE. "
    }

by:

    if ($azAppPermissions.HasFlag([ApplicationPermissions]::MSGraph)) {
        foreach ($role in $MS_GRAPH_APP_ROLE) {
            $permissions += "MSGraph - $role. "
        }
    }

Issue solved

During the tenant relationship for target tenant script, the script is failing consistently with the error:

C:\SetupCrossTenantRelationshipForTargetTenant.ps1 : Method invocation
failed because [Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext] does not contain a method named
'AcquireToken'.
At line:1 char:1

• .\SetupCrossTenantRelationshipForTargetTenant.ps1 -ResourceTenantDoma ...

•   + CategoryInfo          : InvalidOperation: (:) [SetupCrossTenan...argetTenant.ps1], RuntimeException
    + FullyQualifiedErrorId : MethodNotFound,SetupCrossTenantRelationshipForTargetTenant.ps1
  
  

I have been unable to modify the script in any helpful way to bypass this error but with some digging I was finding that the method does not seem to be documented per the docs page (https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.clients.activedirectory.authenticationcontext?view=azure-dotnet)

The script is able to complete the Admin consent URI's for both tenants but its failing as soon as the script is continued.

For a large organization that has many SPNs it could cause timeouts for pulling all the SPNs rather we should filter on the SPN lookup itself.

Grab all the SPNs

    $spns = Get-AzureADServicePrincipal -All $true
    $exoAppSpn = $spns | ? { $_.AppId -eq $EXO_APP_ID }

This should be:

Get-AzureADServicePrincipal -Filter "AppId eq '$EXO_APP_ID'"

I'm curious on the length of time to wait or if there are errors not being reported/captured, but after running the TargetTenant script, the process stops. Is there a way to log the scripts to see where this may be hung up?

Where it stops:
Beginning verification steps.

Verifying ability to create a new organization relationship in the tenant.
What if: Creating organization relationship "Contoso" with domains "'contoso.onmicrosoft.com'".

Verifying that your script is up to date with the latest changes.

Beginning download of SetupCrossTenantRelationshipForTargetTenant.ps1 and creation of temporary files.

Verifying that a valid location was specified for Azure

You are using the latest version of the script. Removing temporary files and proceeding with setup.

Hi, I just ran into an error with the script for the Target Tennant:

SetupCrossTenantRelationshipForTargetTenant.ps1 : Parameter set cannot be resolved using the specified named parameters.
At line:1 char:1

• .\SetupCrossTenantRelationshipForTargetTenant.ps1

•   + CategoryInfo          : InvalidArgument: (:) [SetupCrossTenan...argetTenant.ps1], ParameterBindingException
    + FullyQualifiedErrorId : AmbiguousParameterSet,SetupCrossTenantRelationshipForTargetTenant.ps1
  
  

Can somebody help with this?

When running the SetupCrossTenantRelationshipForTargetTenant.ps1 with its parameters, i am faced with such error, that requires a login technique deprecated by Microsoft
Thank you for your advise

Check-ExchangeOnlinePowershellConnection : Please connect to the Exchange Online Management module or Exchange Online
through basic authentication before running this script!
At D:\ps\SetupCrossTenantRelationshipForTargetTenant.ps1:840 char:5
Check-ExchangeOnlinePowershellConnection
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Check-ExchangeOnlinePowershellConnecti
on

after running the script and getting the Admin consent URI .
I enter the URI link in the browser and grant the permission for the applications

and comes back to the powershell window and hit enter, i get new pop-up to sign-in and enters the target domains creds and gets the error message.

"AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the application: 'a0c73c16-a7e3-4564-9a95-2bdf47383716'. "

Both of my source and target tenants do not have the MailboxMoveCapability parameter for the New/Set-OrganizationRelationship. Both tenants also are missing the RemoteTenant, ApplicationId and AppSecretKeyVaultUrl parameters for New-MigrationEndpoint. Has the cross-tenant migration been rolled out to all tenants yet? Is there anything I can do to enable this for my tenants?

When you run the script, you get the following error:
#############################################
At C:\SetupCrossTenantRelationshipForTargetTenant.ps1:581 char:200

• ... ing]$appId, $appSecretCert, [string]$appReplyUrl, [string]$appName) {

•                                                                     ~
  

Missing closing '}' in statement block or type definition.
+ CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : MissingEndCurlyBrace
##############################################

Adding a closing bracket on line 642 fixes the issue.

last commit causes syntax issue
`At C:\migration\CrossTenantMailboxMigration\SetupCrossTenantRelationshipForTargetTenant.ps1:541 char:1

• }
• ~
  Unexpected token '}' in expression or statement.
  • CategoryInfo : ParserError: (:) [], ParseException
  • FullyQualifiedErrorId : UnexpectedToken`
    removing "}" on line 541 char:1 leads to

`C:\migration\CrossTenantMailboxMigration\SetupCrossTenantRelationshipForTargetTenant.ps1 : Parameter set
cannot be resolved using the specified named parameters.
At line:1 char:1

• .\SetupCrossTenantRelationshipForTargetTenant.ps1

•   + CategoryInfo          : InvalidArgument: (:) [SetupCrossTenan...argetTenant.ps1], ParameterBindingException
    + FullyQualifiedErrorId : AmbiguousParameterSet,SetupCrossTenantRelationshipForTargetTenant.ps1
  

`

Getting this error after copy and pasting the URLs.

I tried adding UseAppAndCertGeneratedForSendingInvitation but this results in -

Any thoughts?

Hi Team,

i am getting an error after Script creates the unique Keyvault in Azure. saying WARNING: System.ArgumentException: Argument passed in is not serializable.

Hi Roman - my cross-tenant migrations have been working fine for the past few weeks, and I needed to add a new user to a migration batch.

When I create this single mailbox batch, just like all the previous, when I get to the Configuration step to select the "Target delivery domain" there is nothing in dropdown.

I haven't had to create any batches for about 2 weeks. I ran the verify script and everything passes and appears fine.

Any thoughts on this? Thanks!

Patrick