Splunk Phantom

Microsoft Exchange On-Premise EWS: HTTP Code: 401. Reason: Unauthorized

New Member

We are setting up the Phantom App Microsoft Exchange On-Premise EWS version: 3.0.3 to talk to our On Prem Exchange EWS instance and we are getting the below error when we do a test connection:

"HTTP Code: 401. Reason: Unauthorized. Details: . Toggling the impersonation configuration on the asset might help, or login user does not have privileges to the mailbox."


I toggled the impersonation settings but the error is the same is there any specific permissions that need to be given to the Exchange account as so far the Exchange admin team confirmed the ID has rights to impersonate?

Labels (1)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!