EWS O365 Instance - Not allowed to access Non IPM folder. (85)

[WillNguyen]

XSOAR stopped fetching incidents from our assigned email address on April 3rd. I opened the EWS O365 instance to investigate and did a "test" for troubleshooting and the test result shows:

Error

(April 9, 2024 11:14 AM)

Not allowed to access Non IPM folder. (85) 

We did not make any settings changes to the instance. After doing some research it appears that there was a recent change with Microsoft O365. Is anyone else running into this issue? Is there a work around or fix?

#EWSO365 #EWSO365Instance

[CJNTS]

Apparently the fix in the code is very simple, but if we don't want to clone and maintain our own integrations, we'll have to wait for the update.

The fix is described here.

https://stackoverflow.com/questions/78264205/not-allowed-to-access-non-ipm-folder

If we could get some XSOAR engineer to push this badboy, that'd pretty cool.

[CJNTS · Accepted solution]

Looks like there is a content pack update that addresses this in the marketplace.

1.3.3 - 940291 (April 7, 2024)

Reinstall 1.3.3Installed

Integrations

EWS O365

• Fixed the ews-get-folder command which failed when given a folder ID as folder-path.
• Fixed an issue in Fetch incident with inline image attachments in PreprocessEmail script by adding description field to attachments to distinguish file attachments from inline images.
• Updated the Docker image to: demisto/py3ews:1.0.0.91453.

EWS Extension Online Powershell v3

Fixed an issue where the following commands returned an error when no response was received:

• ews-new-tenant-allow-block-list-items
• ews-get-tenant-allow-block-list-items
• ews-get-tenant-allow-block-list-count
• ews-remove-tenant-allow-block-list-items

[WillNguyen]

Thanks!

I updated the content pack - Microsoft Exchange Online to latest version 1.3.3 and it is now working.

Appears a fix on April 5th addressed this "Not Allowed Access" error.
1.3.0 - R936713 (April 5, 2024)

Integrations

EWS O365

• Fixed an issue where the integration has failed with ‘Not Allowed Access’ error due to breaking changes on Microsoft’s side.