Overview 💥
Some Microsoft 365 (M365) inspectors may fail during Partner Center authentication with the following error:
Unable to get partner center consent:"Application 00000002-0000-0ff1-ce00-000000000000 doesn't exist in customer tenant"
This error indicates that the target tenant is missing the Exchange Online Service Principal, a Microsoft-owned application required for inspecting Exchange-related datasets through Graph API.
This issue is most commonly seen in tenants that do not have Exchange Online provisioned, licensed, or enabled.
Why Does This Happen? 🤔
The GUID 00000002-0000-0ff1-ce00-000000000000 refers to the Exchange Online Service Principal, a core Microsoft application automatically created in every tenant where Exchange Online is provisioned.
Liongard’s M365 inspector interacts with several Microsoft Graph API endpoints that require this service principal to exist. If Microsoft has not activated or deployed the Exchange Online workload in that tenant, Liongard cannot complete delegated authentication via Partner Center, resulting in the failure.
This issue arises under any of the following conditions:
1️⃣ The Tenant Does NOT Use Exchange Online (Most Common Scenario)
Tenant uses only Azure AD / Entra ID.
Tenant uses 3rd-party email (Google Workspace, on-prem Exchange, etc.).
No Exchange Online licenses exist for any user.
The Exchange workload has never been provisioned.
When Exchange Online is not part of the tenant’s services, the service principal is never created.
2️⃣ Exchange Online Licenses Exist but Are Not Assigned
Even if the tenant owns Microsoft 365 SKUs, if no user has an Exchange Online SKU applied, Microsoft may not initialize the service principal automatically.
3️⃣ Service Principal Deleted or Never Provisioned
Rare edge cases include:
The service principal was accidentally deleted.
A Microsoft backend provisioning issue prevented the creation.
Legacy tenants created before M365 defaults were standardized.
4️⃣ Tenant Was Recently Converted or Migrated
In cross-tenant migrations or EDU-to-commercial conversions, the Exchange Online service may be temporarily unprovisioned, causing transient failures.
Symptoms in Liongard 🤒
Partners may see one or more of the following:
Symptom | Explanation |
Partner Center consent failure | Occurs because Partner Center cannot retrieve Exchange-related delegated permissions. |
Missing service principal = missing API permissions. | |
Exchange-related inspector fields are blank or missing | Mailbox/transport/retention data cannot be retrieved. |
Inspector fails immediately after renewal | Liongard renews Partner Center delegated permissions, detects missing SP. |
Is This Error Expected? 👀
Yes — in tenants without Exchange Online, this is fully expected and normal.
Nothing is broken in Liongard. The tenant simply does not use Exchange Online, so the Microsoft-owned Exchange application does not exist.
Steps to Resolve 👨💻
✅ Scenario 1 — Tenant Does NOT Use Exchange Online
This is the most common scenario.
In this case, Liongard cannot collect any Exchange-related data because the tenant does not have Exchange Online.
Recommended Action:
✔ Disable the affected M365 inspector(s).
✔ Ensure that the partner does not require historical Exchange data before deletion.
✔ This avoids repeated, unnecessary inspection failures.
No further action is needed.
✅ Scenario 2 — Tenant SHOULD Have Exchange Online but Error Appears Unexpectedly
If the tenant is supposed to have Exchange Online:
Step 1: Confirm Licensing
Check if any user has an Exchange Online license:
Microsoft 365 E1/E3/E5
Microsoft 365 Business Basic/Standard/Premium
Exchange Online Plan 1/2
F1/F3 licenses
If the tenant has no Exchange Online licenses assigned, the service principal may never have been created.
👉 Assign at least one EXO license temporarily to trigger provisioning.
Step 2: Wait for Provisioning (Up to 24 Hours)
Microsoft needs time to generate the Exchange Online service principal.
Provisioning times vary:
Small tenants: 30–90 minutes
Large tenants: 6–24 hours
Step 3: Re-Run the Liongard Inspector
After the service principal appears, Liongard will successfully complete Partner Center delegated authorization.
Step 4: If Still Missing, Contact Microsoft Support
Rarely, the Exchange Online workload fails to initialize.
Open a ticket with Microsoft and request:
“Please reprovision the Exchange Online service principal (GUID 00000002-0000-0ff1-ce00-000000000000) for this tenant. It is missing from the Enterprise Applications list.”
✅ Scenario 3 — Uncertain or Mixed-Licensing Tenants
If you're unsure:
✔ Verify whether Exchange Online is actually needed.
✔ Validate user licensing.
✔ Review MX records (if pointing away from Microsoft).
✔ Review mailboxes in Exchange Admin Center (if none exist, EXO may be unprovisioned).
Partner Checklist 📝
✔ For Partners Not Using Exchange Online
Disable inspector.
Verify tenant uses non-Microsoft email.
Confirm no Exchange Online workloads exist.
Confirm no EXO licenses in use.
✔ For Partners Using Exchange Online
Assign at least one EXO license.
Wait for service activation.
Validate the Exchange Online Service Principal exists.
Re-run M365 inspector.
Contact Microsoft if SP does not appear.
How to Check if Exchange Online Service Principal Exists 🧑🏫
Microsoft Entra Admin Center → Enterprise Applications
Search for:
“Microsoft Exchange Online”
or
Application ID:
00000002-0000-0ff1-ce00-000000000000
If not found → the workload is not active.
Reference Links 🔗
Microsoft Docs — Azure AD Service Principals
Microsoft Docs — Exchange Online provisioning
Liongard KB — Microsoft 365 Inspector
Liongard KB — Required Roles & Application Permissions
External Resource Disclaimer 🚨
This article references external Microsoft resources and tools. Liongard does not control availability, functionality, or accuracy of third-party sites. Use them as optional reference resources.