Enable-OnlinePasswordWriteBack - Unable to configure the password reset service : Error getting authtoken

Issue: Enable-OnlinePasswordWriteBack fails with error:

Error getting authtoken from https://login.windows.net/[TENANT].onmicrosoft.com/oauth2/token

Additional details:

• Forest and domain are 2003 level or above
• DirSync tool installed this week using newest version from office 365 portal
• No outbound proxy server in use
• Port TCP 8xx / 80 /443 outbound allowed
• Self-Service Password reset enabled on Azure Tenancy

Process Details:

1.       Open elevated PowerShell Window using an account with Enterprise Admin rights:
2.       Run import-module DIRSYNC
3.       Run Enable-OnlinePasswordWriteBack
   1.       Local AD account used : an account with Enterprise Admin rights
   2.      Azure AD account used - an account with Global Administrator rights

PS Error Output:

PS C:\> Enable-OnlinePasswordWriteBack

cmdlet Enable-OnlinePasswordWriteBack at command pipeline position 1

Supply values for the following parameters:

LocalADCredential

AzureADCredential

Enable-OnlinePasswordWriteBack : Unable to configure the password reset service

: Error getting authtoken from https://login.windows.net/[TENANT].onmicrosoft.com/oauth2/token.

At line:1 char:31

+ Enable-OnlinePasswordWriteBack <<<<

    + CategoryInfo          : InvalidOperation: (Microsoft.Onlin...sswordWrite

   Back:EnableOnlinePasswordWriteBack) [Enable-OnlinePasswordWriteBack], Cmdl

  etInvocationException

    + FullyQualifiedErrorId : 400,Microsoft.Online.Coexistence.PS.Config.Enabl

   eOnlinePasswordWriteBack

Event Log Output:

Log Name:      Application

Source:        PasswordResetService

Event ID:      32015

Level:         Error

TrackingId: [TRACKINGID], Error getting authtoken from https://login.windows.net/[tenant].onmicrosoft.com/oauth2/token, Details: System.Net.WebException: The remote server returned an error: (400) Bad Request.

   at System.Net.HttpWebRequest.GetResponse()

   at Microsoft.CredentialManagement.OnPremisesPasswordReset.Library.OAuthUtils.GetAuthenticationToken(String stsUrl, String stsClientId, String authenticationResourceUrl, String teanantAdminUPN, String tenantAdminPassword, String tenantDomain)

<EventData>

    <Data>TrackingId: [TRACKINGID], Error getting authtoken from https://login.windows.net/[tenant].onmicrosoft.com/oauth2/token, Details: System.Net.WebException: The remote server returned an error: (400) Bad Request.

   at System.Net.HttpWebRequest.GetResponse()

   at Microsoft.CredentialManagement.OnPremisesPasswordReset.Library.OAuthUtils.GetAuthenticationToken(String stsUrl, String stsClientId, String authenticationResourceUrl, String teanantAdminUPN, String tenantAdminPassword, String tenantDomain)</Data>

  </EventData>