Merge pull request #9567 from simonxjx/simon-6

AB#6992: Create a KB article with known issues related to Exchange On…

Author: Cloud-Writer

Exchange/ExchangeOnline/administration/wam-integration-issues.md

@@ -0,0 +1,85 @@
+---
+title: Resolve Issues in Exchange Online PowerShell Module after WAM Integration
+description: Resolves compatibility issues when using Exchange Online PowerShell after Web Account Manager integration.
+author: cloud-writer
+ms.author: meerak
+audience: ITPro
+ms.topic: troubleshooting
+ms.custom: 
+  - sap:Administrative Tasks
+  - Exchange Online
+  - CSSTroubleshoot
+manager: dcscontentpm
+search.appverid: 
+  - MET150
+appliesto: 
+  - Exchange Online
+ms.date: 08/21/2025
+ms.reviewer: vivepai, ninob
+---
+# Resolve issues in Exchange Online PowerShell module after WAM integration
+
+Beginning in Exchange Online PowerShell module version 3.7.0, Microsoft is implementing Web Account Manager (WAM) as the default authentication broker for user authentication. Although WAM offers improved security and a streamlined user experience, it might cause compatibility challenges in some situations. This article discusses these situations and provides workarounds for them.
+
+> [!NOTE]
+> Although you can use the **DisableWAM** switch together with the [Connect-ExchangeOnline](/powershell/module/exchangepowershell/connect-exchangeonline) command to disable WAM when you connect to Exchange Online PowerShell, you should use this option only as a temporary method. If you require assistance to resolve issues without having to disable WAM, contact Microsoft Support at [[email protected]](mailto:[email protected]).
+
+## Scenario: Using the RunAs option
+
+### Symptoms
+
+When you run the `Connect-ExchangeOnline` PowerShell command under a different user context than the credentials that were used to sign in to Windows, WAM-based authentication fails.
+
+In this scenario, you receive the following error message:
+
+> One or more errors occurred. (Unknown Status: Unexpected    Error: 0xffffffff80070520    Context: A specified logon session does not exist. It may already have been terminated.    Tag: 0x21420087 (error code -2147023584) (internal error code 557973639))- at Microsoft.Exchange.Management.ExoPowershellSnapin.GetConnectionContext.ProcessRecord()     at System.Management.Automation.CommandProcessor.ProcessRecord();InnerException : Unknown Status: Unexpected    Error: 0xffffffff80070520    Context: A specified logon session does not exist. It may already have been terminated.    Tag: 0x21420087 (error code -2147023584) (internal error code 557973639)…;
+
+### Cause
+
+WAM relies on the active user session to load its plugins and to access cryptographic keys and certificates that are associated with a user profile. If you run PowerShell under a different context, this action isolates the session and prevents WAM from functioning correctly.
+
+### Workaround
+
+For security, you shouldn't use the `RunAs` option to run PowerShell commands. This method bypasses key protections and introduces risks that are associated with impersonation and session isolation.
+
+Run PowerShell only in the same context as that of the signed-in Windows user to ensure compatibility with WAM. You can disable WAM temporarily by using the DisableWAM parameter together with the `Connect-ExchangeOnline` PowerShell command to connect to Exchange Online and then re-enable WAM.
+
+## Scenario: Running GDAP flows
+
+### Symptoms
+
+In certain Granular Delegated Admin Privileges (GDAP) flows, WAM-based authentication causes tokens to miss required WIDS claims.
+
+In this scenario, you receive the following error message:
+
+> The role assigned to user '[email protected]' isn't supported in this scenario.
+
+### Cause
+
+WAM might not correctly populate all the required claims in GDAP flows, especially if you use the `-DelegatedOrganization` parameter.
+
+### Workaround
+
+Disable WAM temporarily to connect to Exchange Online PowerShell in GDAP flows.
+
+Collect diagnostic logs by using the -EnableErrorReporting parameter together with the `Connect-ExchangeOnline` PowerShell command, and send the logs to [[email protected]](mailto:[email protected]).
+
+## Scenario: Using Windows Task Scheduler
+
+### Symptoms
+
+Scripts that use WAM-based authentication fail when they're run in the Windows Task Scheduler by having the **Run whether user is logged on or not** security option enabled.
+
+In this scenario, you receive the following error message:
+
+> One or more errors occurred. (Unknown Status: Unexpected    Error: 0xffffffff80070520    Context: A specified logon session does not exist. It may already have been terminated.    Tag: 0x21420087 (error code -2147023584) (internal error code 557973639))- at Microsoft.Exchange.Management.ExoPowershellSnapin.GetConnectionContext.ProcessRecord()     at System.Management.Automation.CommandProcessor.ProcessRecord();InnerException : Unknown Status: Unexpected    Error: 0xffffffff80070520    Context: A specified logon session does not exist. It may already have been terminated.    Tag: 0x21420087 (error code -2147023584) (internal error code 557973639)…;  
+
+### Cause
+
+WAM requires an active user session in order to function. In inactive sessions, critical components such as **%LOCALAPPDATA%**, cryptographic keys, and certificates are inaccessible.
+
+When the script execution starts, it has to sign in to Exchange Online. However, if the user doesn't sign in to the system, the script sign-in fails because WAM doesn't have the required user information to facilitate the script's sign-in attempt.
+
+### Workaround
+
+To run automated scripts, use certificate-based authentication. This method is secure and recommended. Alternatively, you can run scripts by using scheduling methods that preserve the user session context.

Exchange/ExchangeOnline/onlinetoc/toc.yml

@@ -132,6 +132,8 @@ items:
           href: ../administration/view-update-address-list-membership.md
         - name: Voice mail settings are missing from Options
           href: ../administration/voice-mail-settings-missing-from-options.md
+        - name: WAM integration issues
+          href: ../administration/wam-integration-issues.md
         - name: Windows Mail app not blocked by ActiveSync settings
           href: ../administration/windows-mail-app-not-blocked.md
         - name: WinRM client cannot process the request