Mirela, thanks for your replies. Some additional detail:
- Yes, same endpoint, same credential, same target server.
- Sometimes in the same move request, in the same 1hr window, it will flip between unauthorized and not. The AD account is not expiring or getting locked out. Sometimes resubmitting the job seems to help, but not always.
- Most often, these errors stack up on move requests at 95%, claiming no 401/auth errors until that point. This is why I've started to think the auth issues are really more of a performance issue, and that auth is just being thrown generically.
- Also, yes in the IIS log, there is a high volume of successful /EWS/mrsproxy.svc entries with the migration account, with no apparent string of repeated 401's or anything like that. When I look at the 401s, they seem to be relate to a new Microsoft IP (perhaps a different move request), but then subsequent entries look healthy.
e.g.
$log Get-Content .\u_ex200429.log
$mrsproxy = $log -match '/EWS/mrsproxy.svc'
$mrsproxy | select -Last 10
// many more of these above ...
2020-04-29 04:15:24 172.16.16.100 POST /EWS/mrsproxy.svc - 443 contoso\mcrowley 52.96.82.221 - 200 0 0 78
2020-04-29 04:15:24 172.16.16.100 POST /EWS/mrsproxy.svc - 443 contoso\mcrowley 52.96.82.221 - 200 0 0 78
2020-04-29 04:15:24 172.16.16.100 POST /EWS/mrsproxy.svc - 443 contoso\mcrowley 52.96.82.221 - 200 0 0 78
2020-04-29 04:15:24 172.16.16.100 POST /EWS/mrsproxy.svc - 443 contoso\mcrowley 52.96.82.221 - 200 0 0 78
2020-04-29 04:15:25 172.16.16.100 POST /EWS/mrsproxy.svc - 443 contoso\mcrowley 52.96.82.221 - 200 0 0 78
2020-04-29 04:15:25 172.16.16.100 POST /EWS/mrsproxy.svc - 443 contoso\mcrowley 52.96.82.221 - 200 0 0 62
2020-04-29 04:15:25 172.16.16.100 POST /EWS/mrsproxy.svc - 443 contoso\mcrowley 52.96.82.221 - 200 0 0 62
2020-04-29 13:40:55 172.16.16.100 POST /EWS/mrsproxy.svc - 443 - 174.218.149.150 - 401 0 0 0
2020-04-29 13:41:00 172.16.16.100 POST /EWS/mrsproxy.svc - 443 - 174.218.21.141 - 401 1 2148074254 31
2020-04-29 13:41:00 172.16.16.100 POST /EWS/mrsproxy.svc - 443 - 52.96.18.221 - 401 1 2148074248 15
//more 200's below