Surface Hub - Active Sync policies error 0x80131509

Question

Gets an error on the device that reads "Microsoft Surface Hub exchange online There is a problem with this account. Unable to validate Exchange Active Sync policies error 0x80131509 Has set up policies and accounts according to all the rules of the art. Also reset the device. Verified that the settings in AD/Exchange Online are correct including the policy with Microsoft's own script. https://learn.microsoft.com/en-us/surface-hub/appendix-a-powershell-scripts-for-surface-hub

Have also checked using these suggestions https://learn.microsoft.com/en-us/surface-hub/troubleshoot-surface-hub

ave run control programs on the device without any remarks and the device is reinstalled. Someone who has an idea as Mr. Google cannot answer.

Answer 1

We found this article https://www.gurot.com/blog/eas-access-rules-exchange-online

The text line "Once a user is affected by conditional access in Azure AD in any way, which includes him being listed in an exception in a particular rule setting, then the ABQ rule on the Exchange server is completely ignored" made us react.

It made us check all the terms of access in Azure. It turned out that we had some conditions for MFA. We excluded the Surface Hub account from these, and then we made it work.

Now everything works as it should

We can only hope that this can help someone else as there have been very few articles on Google that have addressed the error.

Answer 2

@Michael Wiskman

Under what circumstances did you encounter this error? Do you try to configure Exchange online mailbox on Surface Hub? If you could configure your mailbox on other Windows PC, I think this error may caused by the Surface Hub, you could contact the Surface Hub teams to confirm whether this is a know issue:

• Surface Hub help & learning

  ---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Hi,

Please find the below suggestions based on my experience. Surface hub connects to the exchange using ActiveSync and device ID needs to be allowed. Also, while configuring, it has to be set as regular mailbox and convert it to room mailbox.

1.Create a new Active sync mailbox policy for Surface Hub

New-MobileDeviceMailboxPolicy -Name MSHUB -PasswordEnabled $false –AllowNonProvisionableDevices $true

2.Create a new user mailbox and apply the policy

Set-CASMailbox "mailboxname" -ActiveSyncMailboxPolicy "MSHUB"

3.Login to the Surface Hub using this account
4.Allow the DeviceID

Get-MobileDevice -Mailbox "mailboxname"
Set-CasMailbox -Identity "mailboxname" -activesyncalloweddeviceids **device ID*

DeviceID can be retrieved from "About" options.

5.Set the mailbox type to room and enable the AD account

Set-Mailbox "mailboxname" -Type room

Once done, you can use the Set-CalendarProcessing for this room mailbox and set it to autoaccept for the meetings.

If the above suggestion helps, please click on Accept Answer and upvote it.

http://cloudexchangers.com/configure-microsoft-surface-hub-for-video-conferencing-room-system/

Answer 4

We have downloaded a tool called EAS Admin 1.0. It says that the account called "The mayor's office" is in quarantine. But if we look in Exchange Admin, it is not quarantined. Look at the attached picture for more information.

Answer 5

We have exactly the same issue and can see that the surface hub is Quarantined in Exchange Mobile Device and Device AccessStateReason is "AadBlockDueToAccessPolicy". I can't free the device from quarantine, it just does not work.