M365 Integration Issues - Unable to Sign in with M365 User accounts

[ems_murphy]

PBX Version: 20.0
Hosted by 3CX

As the title suggests, I've enabled the M365 Integration, following the recommendations from the support article here: https://www.3cx.com/docs/manual/microsoft-365/. (of course I've not done everything the same).

The settings I've applied are shown in the screenshot below. (for clarification, I'm syncing a single department which has only a handful of users for testing purposes).


So with this being said, now when I try to login with one of these synced accounts, the login screen just bounces back. As in I click on "Sign in with Microsoft" at the login screen


I get redirected to the Microsoft login page (running in private for test purpose)


And then I'm brought back to the 3CX login screen, and clicking on the "Sign in with Microsoft" button again just reloads through M365 login page and then back to 3CX login page.

Hopefully there is something simple I'm missing, and hopefully someone can very obviously point it out

---

What I've done.

• I've attempted to re-configure the M365 integration (using different settings / tick boxes)
• I've deleted the users that were being synced and allowed M365 to create them (no change)
• I've created the user (which is what we'd like as we want everyone to keep the same extension number from the old system), and synced not working.
• Upon request, I've deleted another system I had in my account under the: https://portal.3cx.com/customer/systems. This hasn't worked

I'd also like to confirm that other elements of this integration are working

• M365 email, sending as expected
• SharePoint, for back-up and external storage.

 

[Charles_3CX]

There are a few factors at play which may prevent the sync from operating fully. The first is to check that your users have a first and last name configured in the Azure AD/Entra users accounts section, and that they are all set to 'Member' for the user type tag.

 

[ems_murphy]

Hi Charles.

Thank you for getting back to this forum post so quickly. With regards to first and last names, yes. All users have a first and last name as this is required by M365 (as well as the on prem-AD sync we have).

When referring to the "member tag" I assume you mean within the department I've synced? This would also be correct, all users that I'm syncing are set-up as members of this group.

Thank you

 

[Charles_3CX]

Check the user type tag under the Azure AD users accounts and ensure it is set to Member.

 

[Alphabetic]

Check audit logs in 365.

Have you got any conditional access policies in play?

 

[ems_murphy]

Have you got any conditional access policies in play?

Hi, yes we do for MFA purposes

 

[ems_murphy]

Check the user type tag under the Azure AD users accounts and ensure it is set to Member

All users (at least currently in testing) all show "User Type" as Member

 

[Alphabetic]

Hi, yes we do for MFA purposes

You may need to allow the IP of your 3CX in CA as this is likely causing your problem.

Review audit logs to confirm.

 

[ems_murphy]

You may need to allow the IP of your 3CX in CA as this is likely causing your problem.

Review audit logs to confirm.

I've added an exclusion for the 3CX instance IP. I'm not quite sure what I'm looking for in the M365 audit logs, but I can only see successful login attempts from the user I've been testing with, both before and after changing the CA

 

[ArneDery]

Does it work when you have selected users instead of department? We're running into the same issue, when using selected users it works. Currently we have a support case open. Might be good to test and see if it's the same behavior.

 

[ems_murphy]

Does it work when you have selected users instead of department? We're running into the same issue, when using selected users it works. Currently we have a support case open. Might be good to test and see if it's the same behavior.

Hi ArneDery.

Thank you for the suggestion, this does appear to work!

When trying to select by "department" it's not completing the login, but then doing it by "selected user" it appears to work just fine.

Would you be willing to keep me up to date with your support case?

 

[ArneDery]

Hi ArneDery.

Thank you for the suggestion, this does appear to work!

When trying to select by "department" it's not completing the login, but then doing it by "selected user" it appears to work just fine.

Would you be willing to keep me up to date with your support case?

Best way to also log a support ticket. This way they have as much info as possible to investigate.