"1007 AccessDenied" or "Ensure your system time is correct" error when you run the Hybrid Configuration wizard

Applies to: Exchange OnlineExchange Server 2013 EnterpriseExchange Server 2013 Standard Edition


When you run the Hybrid Configuration wizard, you receive one of the following error messages:

Set-FederatedOrganizationIdentifier': An error occurred while attempting to provision Exchange to the Partner STS. Detailed Information "An unexpected result was received from Windows Live. Detailed information: "1007 AccessDenied: Access Denied.".".

Unable to federate your domain, your system time appears to be more than five minutes out of sync with the time on our federation servers. Ensure your system time is correct and retry the Hybrid Configuration Wizard.


This problem occurs because the local system time is out of sync with a valid time server. This problem occurs if the system time of your local system and the system time of the server from which you're running the Hybrid Configuration wizard differ by five minutes or more.


Make sure that your local system time and the server time are in sync. For more information about how to do this, see the following Microsoft Knowledge Base article:


If you experience problems that affect the Hybrid Configuration wizard, you can run the Exchange Hybrid Configuration Diagnostic. This diagnostic is an automated troubleshooting experience. Run it on the same server on which the Hybrid Configuration wizard failed. Doing this collects the Hybrid Configuration wizard logs and parses them for you. If you're experiencing a known issue, a message is displayed that tells you what went wrong. The message includes a link to an article that contains the solution. Currently, the diagnostic is supported only in Internet Explorer.

Still need help? Go to Microsoft Community or the Exchange TechNet Forums.