SFB Hybrid move accounts using onmicrosoft.com account

[Plamen Gavrailov]

hi 

we have recently setup SFB hybrid in the LAB and we moved some users across using on-prem csadministrator synced to the cloud ( Glob Admin in o365 ). After that, we tried moving users using o365 Glob Admin but that failed. Here is what we did:

On-prem CsAdminitrator logged in on SFB FE server (FE has access to o365). SkypeOnline powershell module installed on the FE server + Sign-In assistant. It is possible to create remote PSh session to SFBO using onmicrosoft.com account (as I mentioned before that account is Glob Admin). MFA for the cloud account is disabled. When we try to move an user using move-csusers and providing -credentials of the o365 Glob Admin the command fails with the following error: 

Getting web ticket for the given user is failed. Error Code: 28000 , Error Reason: User is not SIP enabled.  

 Any idea what the issue might be?

[#2]

ok, problem solved :). It appeared to be one of those RTFM things you don't pay too much attention to especially when you are in a rush. The msft doc https://docs.microsoft.com/en-us/skypeforbusiness/skype-for-business-hybrid-solutions/deploy-hybrid-... says :

---

select and copy the URL in the address bar up to lync.com. An example URL looks similar to the following:
https://webdir0a.online.lync.com/lscp/?language=en-US&tenantID=

----

and that is what we did, missing the next step that says "and now replace webdir with admin"

Now the funny part is that actually the webdir url actually worked when we used the sync on-prem csadmin account, and it started failing after we decided to use onmicrosoft.com account to  move users to SFBO.

[#3]

@Plamen Gavrailov

so correct at times microsoft tools can be real headache,

on windows 10 to get powershell working a challenge if you ws-manangement or WinRM config define first it will not let you connect if BASIC auth in WinRM is disabled

then the Move-CSUser has credential parameter which it will not work with what a stupidity ? how are you suppose to get this stupid command working if you have MFA enabled on this user ?