Question: Unexpected Error on User Investigation

[akshaiprakash1]

Your Question

The following error occurs while running User Investigation on my tenant:

[2025-05-13 10:20:31Z] - [ACTION] - Starting User Investigation.

[2025-05-13 10:20:31Z] - [ACTION] - Running Get-HawkUserConfiguration.
[2025-05-13 10:20:31Z] - [INFO] - Not Connected to Exchange Online
[2025-05-13 10:20:31Z] - [ACTION] - Connecting to EXO using Exchange Online Module
Error Acquiring Token:
Unknown Status: Unexpected
Error: 0xffffffff80070520
Context: (pii)
Tag: 0x21420087 (error code -2147023584) (internal error code 557973639)
Unknown Status: Unexpected
Error: 0xffffffff80070520
Context: (pii)
Tag: 0x21420087 (error code -2147023584) (internal error code 557973639)
At C:\Program
Files\WindowsPowerShell\Modules\ExchangeOnlineManagement\3.7.2\netFramework\ExchangeOnlineManagement.psm1:754 char:21

•                 throw $_.Exception.InnerException;
  

•                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : OperationStopped: (:) [], MsalServiceException
  • FullyQualifiedErrorId : Unknown Status: Unexpected
    Error: 0xffffffff80070520
    Context: (pii)
    Tag: 0x21420087 (error code -2147023584) (internal error code 557973639)

[BenGall-Qss]

I too have this issue:

[2025-10-20 14:22:05Z] - [ACTION] - Starting Tenant Investigation.

[2025-10-20 14:22:05Z] - [ACTION] - Running Get-HawkTenantConfiguration.
[2025-10-20 14:22:05Z] - [ACTION] - Initiating collection of tenant configuration settings from Exchange Online.
[2025-10-20 14:22:05Z] - [INFO]   - Not Connected to Exchange Online
[2025-10-20 14:22:05Z] - [ACTION] - Connecting to EXO using Exchange Online Module
Error Acquiring Token:
Unknown Status: Unexpected
Error: 0xffffffff80070520
Context: (pii)
Tag: 0x21420087 (error code -2147023584) (internal error code 557973639)
Unknown Status: Unexpected
Error: 0xffffffff80070520
Context: (pii)
Tag: 0x21420087 (error code -2147023584) (internal error code 557973639)
At C:\Program
Files\WindowsPowerShell\Modules\ExchangeOnlineManagement\3.9.0\netFramework\ExchangeOnlineManagement.psm1:766 char:21
+                     throw $_.Exception.InnerException;
+                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (:) [], MsalServiceException
    + FullyQualifiedErrorId : Unknown Status: Unexpected
Error: 0xffffffff80070520
Context: (pii)
Tag: 0x21420087 (error code -2147023584) (internal error code 557973639)

Version information:

Name              : HAWK
Path              : C:\Program Files\WindowsPowerShell\Modules\HAWK\4.0\HAWK.psd1
Description       : A free, open-source forensics PowerShell module for conducting incident response and threat
                    hunting of Microsoft Cloud environments.
                        Hawk streamlines the collection of forensic data from Microsoft 365 and Entra ID environments
                    to help security professionals,
                        incident responders, and administrators quickly gather critical log data and identify
                    potential security concerns.
                        While it includes basic analysis capabilities to flag items of interest, it focuses on
                    efficient data collection rather than automated detection.
ModuleType        : Script
Version           : 4.0
NestedModules     : {}
ExportedFunctions : {Get-HawkTenantConfiguration, Get-HawkTenantEDiscoveryConfiguration, Get-HawkTenantConsentGrant,
                    Get-HawkTenantRBACChange...}
ExportedCmdlets   :
ExportedVariables :
ExportedAliases   :

This is being ran from an elevated tenant, with a global admin account.
The Graph consent has been completed:

 Connect-MGGraph -Scopes 'User.Read.All', 'Directory.Read.All',
>>         'DeviceManagementServiceConfig.Read.All', 'AuditLog.Read.All', 'IdentityRiskEvent.Read.All', 'IdentityRiskyUser.Read.All'
Welcome to Microsoft Graph!

Connected via delegated access using XXXX-XXXX-XXXX-XXXX-XXXXX
Readme: https://aka.ms/graph/sdk/powershell
SDK Docs: https://aka.ms/graph/sdk/powershell/docs
API Docs: https://aka.ms/graph/docs

NOTE: You can use the -NoWelcome parameter to suppress this message.

[T0pCyber]

At first glance it looks like an error connecting to Exchange Online. In a new PowerShell window run "Connect-ExchangeOnline" and then try running Hawk.

[BenGall-Qss]

At first glance it looks like an error connecting to Exchange Online. In a new PowerShell window run "Connect-ExchangeOnline" and then try running Hawk.

Thanks for the response.
This does indeed work, connecting first then running the tool works as expected.
Is this expected behaviour or a weird bug?

[T0pCyber]

Thanks for reporting this issue. The root cause is that Test-EXOConnection only catches CommandNotFoundException when testing the Exchange Online connection, so MSAL authentication errors (MsalServiceException) and stale/expired session failures are completely unhandled.

We'll refactor the error handling in Test-EXOConnection to catch these errors in a future release. A fix has been submitted in PR #300 that:

• Catches all exceptions from Get-OrganizationConfig (not just CommandNotFoundException)
• Wraps Connect-ExchangeOnline with error handling and a retry for transient MSAL failures
• Provides a clear error message with the manual workaround if connection fails

In the meantime, the workaround is to run Connect-ExchangeOnline manually before running Hawk.