APP Microsoft Office User error Message: Access denied for the resource. Tag: 4usqa //Exchange Hybrid

The error message "Access denied for the resource" when users are trying to access the network externally can be caused by several factors. Here are some steps you can take to troubleshoot the issue:

1. Check User Permissions: Ensure that the users have the necessary permissions to access the resources they are trying to reach. This includes verifying that they are part of the correct groups and roles within Microsoft 365.
2. Role Assignment Policy: If this issue is related to Outlook Web App, make sure that the MyBaseOptions user role is enabled in the Default Role Assignment Policy. You can check this by signing into the Microsoft 365 portal, going to the Exchange admin center, and reviewing the permissions under user roles.
3. Security Defaults: If security defaults are enabled in your tenant, they might restrict access for certain accounts. You may need to adjust these settings or add users to the appropriate role groups to grant them access.
4. Network Policies: Review any network policies that might restrict access based on the user's location. Ensure that external access is allowed for the users trying to connect.
5. Firewall and ACLs: Check if there are any firewall rules or Access Control Lists (ACLs) that might be blocking access to the resources from external networks.

If the issue persists after checking these areas, consider running the Troubleshoot Microsoft 365 Mailbox Migration tool or consulting the Microsoft Community for further assistance.

References:

• 403 Sorry Access denied error when a user tries to sign in to Outlook Web App in Microsoft 365
• Access is denied error when you connect to Exchange Online by using remote Windows PowerShell

Please note that our forum is a public platform, and we will modify your question to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data. 

Hi Meier, Jürgen

Thank you for reaching out to the Microsoft Q&A forum. 

Based on your description, I understand that users are encountering an “Access denied for the resource” error when accessing Microsoft 365 services from outside the internal network, even though licensing and Microsoft Information Protection have already been checked. 

According to Microsoft documentation, this issue can be addressed following the guidance in the article below: Errors CAA2000B, 4usqa, and 49dvs when trying to sign in to classic Outlook and Outlook for Mac

Since you mentioned that the sign-in enablement steps have already been reviewed, from my perspective, I would suggest focusing on the scenarios below: 

1.Review Conditional Access policies for external access 

In this scenario, a Conditional Access policy may be preventing users from signing in, particularly when accessing from an external network. You may want to review the sign-in events in Microsoft Entra ID by following the guidance in the article below: 

Troubleshooting sign-in problems with Conditional Access - Microsoft Entra ID | Microsoft Learn 

The sign-in event details may provide additional context about why access was denied and help guide the next troubleshooting steps. 

2.Reconfirm user licensing status 

Although licensing has been checked, you may consider verifying again that all affected users have the appropriate Microsoft 365 licenses assigned. In some cases, a license mismatch can contribute to access-related issues.  If everything appears correct, you could also try removing and reassigning the license, then allowing 2–4 hours for the changes to take effect. 

While doing so, you may also try a quick client-side test by clearing the cache of the affected Office apps and testing again. 

If the issue persists after completing all of the checks above, you may consider raising a support ticket via the Microsoft 365 admin center for further assistance. 

You can refer to the following article for guidance: Get support - Microsoft 365 admin | Microsoft Learn

I hope this helps. Please let me know if you need any further assistance.

 If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".    

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.