Service account via Azure Data Factory - ID3242: The security token could not be authenticated or authorized

(1) Share

Report

Posted on by Community Member

Hello

I am using Azure Data Factory to pull data from on premise Dynamics 365. Version is 1612 (8.2.2.112).

When I use my personal Windows account for the credentials it works perfectly. When I change the credentials to use a service account (defined in AD) I get the error ID3242: The security token could not be authenticated or authorized.

The service account has exactly the same access in Dynamics as my personal account. I can log into the UI as the service account user and run FetchXML from the advanced find with no issues.

Anyone have any ideas on what is different between my personal account and the service account that would cause this error?

thanks

Grant

All responses (4)

Answers (1)

JimKoder 5 on at

Like (1)

Report

RE: Service account via Azure Data Factory - ID3242: The security token could not be authenticated or authorized

When attempting to log into a Microsoft Dynamics 365 / CRM instance, you will receive this error. ADFS has returned this message. The problem appears to be that authentication now requires a UPN (user principal name / MSDN – User Name Formats) logon since ADFS was upgraded. See here kodlogs.net/.../id3242-the-security-token-could-not-be-authenticated-or-authorized
Johnny Gong 6,482 Moderator on at

Like (0)

Report

RE: Service account via Azure Data Factory - ID3242: The security token could not be authenticated or authorized

Hi GrantW,

Appreciate to hear the issue resolved by the first UPN suggestion.

Could you kindly mark any helpful answer as verified to close the thread.

Thanks in advance.

Regards

Johnny
Community Member on at

Like (1)

Report

RE: Service account via Azure Data Factory - ID3242: The security token could not be authenticated or authorized

Thanks for the reply - changing the account to use the UPN rather than domain worked.
Verified answer

Johnny Gong 6,482 Moderator on at

Like (0)

Report

RE: Service account via Azure Data Factory - ID3242: The security token could not be authenticated or authorized

Good day GrantW,

Have you tried the following operations mentioned in many articles:

1. The occurred issue seems that with the upgrade of ADFS it has now required the UPN (user principal name / MSDN – User Name Formats) login in order to authenticate. That is simply going from the domain login to the email address like this:

CrmAdminUser@myDomain.com

2. Another option that worked was to use the Down-Level logon name (Domain\username)

myDomain\CrmAdminUser

Reference:

http://vjcity.blogspot.com/2018/09/id3242-security-token-could-not-be.html

https://technologyblog.rsmus.com/microsoft-dynamics/dynamics-365-customer-engagement/solve-error-id3242-security-token-not-authenticated-authorized-connecting-scribe-microsoft-dynamics-crm/

https://community.dynamics.com/crm/b/dynamicscrmpros/posts/how-to-solve-error-id3242-the-security-token-could-not-be-authenticated-or-authorized-when-connecting-scribe-to-microsoft-dynamics-crm

As your mentioned different between user account and service account could be referred to this old thread in TechNet Forum which has one good conclusion:

https://social.technet.microsoft.com/Forums/lync/en-US/3478c201-26a8-4bb1-a5e3-20c2521e321b/difference-between-service-account-and-user-account?forum=winserverDS

Hope above would help.

Regards

Johnny