Have you seen a MigrationWiz source endpoint validate and run fine in a pilot, then fail validation when you set up production on the same tenant?

Conditional access policies are often the hidden cause. The pilot succeeds because the admin account used for endpoint configuration happens to be in a CA exclusion group. Later, someone creates the production endpoint using a different admin account that is not excluded, and MigrationWiz throws an OAuth error that looks like a connectivity issue. It is actually a CA policy blocking non-interactive sign-in.

With Modern Auth, MigrationWiz authenticates via an Entra ID app registration. That means the service account must be excluded from any conditional access policy that enforces MFA or blocks non-interactive authentication flows.

Once you know what to look for, the fix is straightforward: create a dedicated migration service account, exclude it from MFA enforcement using a named CA exclusion, and use that same account for every MigrationWiz endpoint on the tenant.

What service account and CA exclusion setup are you using for MigrationWiz endpoint authentication?

#BitTitan #MigrationWiz