I recently found that if using a third-party Authentication provider (Duo Authentication, etc.), you will need to create an <domain>.onmicrosoft.com service account and give the necessary permissions to Impersonate as well as give permissions to the ...