During the sync process, you may encoutner sync errors. The Sync Now button will show Sync Failure and display in red:

Sync Failure

The article provides instructions how to handle the following common erros:

Invalid Client Error

If you see the Acquiring Microsoft Access Token - invalid_client ierror, it means that the Microsoft Office 365 tenant is not fully set up, or the setup has failed. This may happen for the following reasons:

Office 365 internal setup has failed

In rare cases, for example, when Teams is under heavy load due to extraordinary circumstances, the O365 system services may be provisioned out of sequence. This leads to a lock-state on some of the elements within the O365 permissions database. 

To resolve the issue, the Azure permissions for TeamsConnector have to be removed and the setup run again:

  1. Browse to portal.azure.com
  2. Select All Services > Azure Active Directory
  3. In the Manage section, click on Enterprise Applications > TeamsConnector
  4. Click Properties > Delete > Confirm:
    Delete permissions
  5. Allow ~1 minute for propagation. Access TeamsConnector again and give consent

The API needed for authentication is missing from the Microsoft 365 tenant

For the automatic setup process to function, a standard Microsoft API is required. On some Microsoft tenants this API is absent which causes the process to fail.

To install the API:

  1. On a Windows PC, run PowerShell as administrator. PowerShell will now launch in Administrator mode
  2. To avoid possible errors, run:

    Set-ExecutionPolicy RemoteSigned

  3. Run the following command to install the Azure module:

    Install-Module -Name Az -AllowClobber
    Install Azure module

    Note: you may also read the Microsoft Knowledge Base article on Install the Azure Az PowerShell module for more information.
  4. PowerShell will take a few moments to install some dependant modules. Approve these installation requests:
    Delete permissions
  5. Run the following commands to log in and install the API endpoints to the tenant:

    New-AzADServicePrincipal -ApplicationId "39624784-6cbe-4a60-afbe-9f46d10fdb27"

  6. The following should be returned from PowerShell:

Setup Partially Complete - Cannot Find Specified Gateway

The most common reason for the following error message:

Setup partially complete, sync again in 2 minutes seconds. Office 365 is not ready

is that the setup process cannot find specified Gateway. Review the Sync Log from the drop-down on the Sync Now button for more details.

Office 365 is not ready

The platform can see the domain and is voice activated, but the PSTN gateway is not yet visible when setting the voice routes. Allow 2.5 mins for the system to automatically check again which normally works. However, sometimes propagation may take a few hours. You may try to click the Sync Now button again later. If this error is not resolved within 24 hours, a Microsoft support ticket needs to be created as the issue is with their network.

In the Suppor ticket, specify the following details:

  • This is an issue using Skype for Business Powershell to set up Teams Direct Routing.
  • The environment is multi-tenant, so the PSTN Gateways are defined on the carrier tenant and not in the customer tenant.
  • The PSTN Gateways listed below are domains on the customer tenant that have been validated and appear in the DomainUrlMap property of Get-CsTenant
  • Add errors from the Sync Log

Setup Partially Complete - Domains Waiting Activation

This error will go away as soon as Microsoft completes their part of the configuration process. In extremely rare cases, it can take days. You can try removing the domains from the MS tenant and starting the Sync process over:

  1. Delete the Teams service and any user in the tenant called Temporary Domain Voice Activation User
  2. Delete the Teams service by clicking on the trash icon:

    Delete Teams

  3. Click Enable Sync

This will create new domains that may not have the Microsoft delay issue.

Important: this process is service affecting and will be subject to configuration delays.

You can also contact Microsoft Support regarding this issue.

Cannot find specified Online PSTN usage/PSTN Usage not ready yet

This message can occur when the tenant is set up and there are no licensed users to sync with the phone system. In this case, license some users and retry.
The issue also can be caused by the Microsoft platform not being updated in time for the check. In this case wait and try again later.
To get more information, view the most recent Sync history from the drop-down on the Sync Now button:

Show sync history

View the recent Sync log using the chevron in the left column:

View sync log

Look for the following error: Cannot find specified Online PSTN usage "Servicename-xxx". It will mean that the Microsoft 365 tenant has not been properly set up.

To resolve the issue:

  1. Wait and retry the Sync Now process periodically for a few hours
  2. If after several hours the not issue is not resolved, create a ticket with Microsoft Support. Provide the following details:
    • The tenant is being configured for Direct Routing
    • The domains are activated for voice on the tenant
    • The command Get-CsOnlinePstnUsage -Identity "Global" confirms the PSTN Usage setting exist
    • The command New-CsOnlineVoiceRoute produces an error: Cannot find specified Online PSTN usage when trying to use the domain.
  3. Alternatively, you may consider removing the Teams service from the portal, removing the 2 domains created in the MS 365 tenant and then re-enabling the Teams service. This will start the Sync process afresh, creating new domains.
    Important: this process is service affecting and will be subject to configuration delays.

Getting more information (advanced)

If Microsoft ask to reproduce the error in PowerShell:

  1. On a Windows PC, run PowerShell as administrator. PowerShell will now launch in Administrator mode
  2. To avoid possible errors, run:

    Set-ExecutionPolicy RemoteSigned

  3. Install the Microsoft Teams Module by using the following command:

    Install-Module MicrosoftTeams -AllowClobber

  4. By default, the PowerShell Gallery (PSGallery) isn't configured as a trusted repository for PowerShellGet. The first time you use the PSGallery, you'll see the following message:
    Untrusted repository
    You are installing the modules from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running the `Set-PSRepository` cmdlet.
     Are you sure you want to install the modules from 'PSGallery'? [Y] Yes  [A] Yes to All  [N] No   [L] No to All  [S] Suspend  [?] Help (default is "N"):
    Answer Yes or Yes to All to continue with the installation.
  5. Run the following commands:

    Import-Module MicrosoftTeams
    $sfbSession = New-CsOnlineSession
    Import-PSSession $sfbSession

    You should get a 365 pop up in which you will need to enter the Global 365 admin details.
  6. Run the command:

    Get-CsOnlinePstnUsage -Identity Global

    to provide a list of the recorded PSTN usages that are setup
  7. Locate the command in the sync log that starts with

    New-CsOnlineVoiceRoute -Name

    and immediately precedes the error message. For example, the command will resemble this:

    New-CsOnlineVoiceRoute -Name "Branddomain-xxxx" -OnlinePstnGatewayList @('5lesvgit4j3o.AUSEA02.branddomain.com') -OnlinePstnUsages @('branddomain-USE') -Priority "0" -NumberPattern ".*"

  8. Send the PowerShell transcript to Microsoft.

Other Sync Errors

Review the Sync log from the drop-down on the Sync Now button. Other common errors and possible causes include:

Message Likely cause
Management object not found for identity

That typically occurs if the users have only recently been given licenses in O365 and Microsoft is still setting them up behind the scenes. Allow up to 24 hours for propagation and keep trying to run the sync process.

Cannot modify the parameter: "EnterpriseVoiceEnabled" because it is restricted for the user service plan: MCOProfessional 
The Sync process sees the user has a Phone System license in one of Microsoft's systems, but this has not been propagated to the Microsoft subsystem responsible for voice yet. MCOEV is the Phone System plan, and if this is not listed in the error message then the Skype for Business PowerShell server does not see it yet.

Wait and try again later.
Cannot modify the parameter: "EnterpriseVoiceEnabled" because it is restricted for the user service plan: MCOEV_VIRTUALUSER,MCOProfessional

A Virtual Phone System license is applied to a real user and the service cannot be configured. Virtual Phone System licenses can only be used on Auto Attendants (AAs) and Call Queues.

Purchase or obtain trial licenses for a valid type to apply to the user. Read the Knowledge Base article on Which Microsoft Licenses Do I Need For TeamsConnector? for more information.

Domain takeover failed    

The admin first logged in with the wrong global admin account (from another M365 tenant) and the Sync Now feature has created the same DNS in the two different tenants. Remove the TeamsConnector DS from the wrong Microsoft tenant.

PSERROR> Failed to start remote PowerShell -or-
Unexpected PS Runspace is null 

Most likely, you're not logged in as Global Admin when running sync. Look into the logs further for messages like No cmdlets have been authorized for use by the RBAC role that the user belongs to to confirm this.

At the top of the log, the admin role will be detailed. If this reads something like Connected as 'test@test.com: with roles: User Account Administrator then it is clear that the logged-in user is not Company Administrator, which is the required role.

The term 'Set-CsUser' is not recognized as the name of a cmdlet, function, script file, or operable program
The term 'Get-CsMeetingRoom' is not recognized as the name of a cmdlet
Cannot modify the parameter: "OnPremLineURI" because it is restricted for the user service plan

This error occurs in two scenarios:

  • A number is being applied to a user who is recently licensed and Microsoft have not yet updated the user database to acknowledge phone system capability
  • The number is being moved from one user with the license recently removed, to a new user. Microsoft produce this error as the act of removing a number from an unlicensed user is not needed

Allow some time for propagation and run the Sync process again.

Failed To Validate Domain  

This is usually caused by a domain configuration delay on the Microsoft side. Re-trying to run the Sync process should eventually resolve the issue, but allow some time for propagation.

You can also contact Microsoft Support. Refer to the Setup Partially Complete - Domains Waiting Activation section for more information.

Cannot modify the parameter: "OnPremLineURI" because it is restricted for the user service plan: MCOEV,MCOPSTN2,MCOMEETADD,MCOProfessional The user has a Calling Plan applied and will not be configured for calling via the service. The element MCOPSTNX is the calling plan license.
Normally this user would be excluded by the Sync Now function except if the customer is using Large Tenant Mode where licenses are not checked.