When you perform a Microsoft 365 tenant to tenant (T2T) migration and run a migration that is either staged over some time or sometime after the migration has completed you cutover the domains from the old tenant to the new tenant (that is, you were doing a rebrand and the new tenant had a new domain name and eventually you were catching up and moving the old domain name to the new tenant) you might find a flurry of calendar emails arriving unexpectedly to lots of users, but typically on the schedule of one or more once every 26 hours.
The invites come from Microsoft Outlook on behalf of a user in the old tenant and the meeting could not be located (it says in the above “it may have been moved or deleted”).
Checking the Threat Explorer (MDO Plan 2 licence) for the message in the old tenant you see that the client is a TimeBasedAgent (note that it does not show this information in the new tenant).
This information is not available in the Message Trace unless you do a “Enhanced summary report” or a “Extended report”.
The client being TimeBasedAssistants is a clue that a background process in Exchange Online has created this message, and in this case its most likely the Calendar Repair Assistant (as there are many other time based assistants in Exchange Server and Exchange Online). Disabling this time based assistant in the old tenant as migration completes is a useful tool in your migration workbook and if done early will stop the above, but can be done as you start to see these, as you will see them daily if you start to see them.
The following Exchange Online PowerShell will disable the Calendar Repair Assistant for all mailboxes. Run this in the source tenant after migration is completed and as the domains are moved to the new tenant.
Get-EXOMailbox -ResultSize Unlimited | % {Set-Mailbox $_ -CalendarRepairDisabled $true -ErrorAction SilentlyContinue}
Problem solved!
Photo by Towfiqu barbhuiya: https://www.pexels.com/photo/still-life-with-a-calendar-and-a-sandglass-14426300/
Leave a Reply