'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix MRS Proxy Access Denied Error in Exchange Cross-Tenant Migration
Question details
A cross-tenant Exchange migration fails due to an access denied error from the MRS Proxy OAuth endpoint.
- Product
- Microsoft Exchange
- Device & OS
- not provided
- Scenario
- Performing a cross-tenant mailbox migration in Microsoft 365.
- Observed behavior
- The migration fails with a MigrationTransientException because the Mailbox Replication Service (MRS) Proxy OAuth endpoint returns an 'Access is denied' error.
Ensure you have Global Administrator or Exchange Administrator privileges in both the source and target Microsoft 365 tenants, and verify that you have access to the Microsoft Entra ID (Azure AD) admin center.
Verify and Reconfigure Administrator Consent
Check the consent URL domain and OAuth application ID to ensure permissions are correctly granted between the tenants.
The 'Access is denied' error is typically caused by incorrect or missing administrator consent between the source and target tenants. For cross-tenant mailbox migrations, the target tenant must be explicitly authorized to communicate with the source tenant's MRS Proxy endpoint using OAuth.
Generate the administrator consent URL again, ensuring that the URL uses the correct source tenant domain. Any typo in the tenant domain will result in an invalid consent grant.
Open the generated consent URL in a private browser window. Log in using Global Administrator credentials for the source tenant and accept the requested permissions.
In the Exchange Admin Center, verify that the OAuth application ID registered matches the migration endpoint configuration. The Application ID must be identical to the one used in the cross-tenant migration setup.
After waiting approximately 15 to 30 minutes for the permissions to propagate across Microsoft 365, navigate to the Exchange Admin Center, select Migration, and resume the failed migration batch.
Equip Your Team with a Free, Lightweight Office Alternative
Managing complex Microsoft 365 migrations can be challenging and resource-intensive. If you are looking for a straightforward, cost-effective office suite for your users, WPS Office provides a highly compatible and lightweight alternative that requires minimal administration.
- 1. Download the Installer: Visit the official WPS Office website to download the free installation package for your operating system.
- 2. Install WPS Office: Run the downloaded executable file and follow the standard on-screen instructions to complete the setup.
- 3. Start Creating: Launch WPS Office to instantly open, edit, and save your existing Word, Excel, and PowerPoint documents without formatting loss.
Frequently Asked Questions
What is the MRS Proxy endpoint in Exchange?
The Mailbox Replication Service (MRS) Proxy endpoint is a feature in Microsoft Exchange that facilitates the secure movement of mailboxes between on-premises Exchange servers and Exchange Online, or between two different Microsoft 365 tenants.
What does MigrationTransientException mean?
A MigrationTransientException indicates a temporary failure during the migration process. It is often caused by network connectivity issues, server timeouts, or temporary authorization failures like OAuth access denials. Retrying the migration usually resolves transient errors once the underlying issue is fixed.
How long does it take for OAuth consent to apply in Microsoft 365?
After granting administrator consent for cross-tenant migrations, it can take anywhere from 15 to 60 minutes for the new permissions to fully propagate and apply across the Microsoft 365 environment.
