Hello all,
I recently upgraded the Microsoft Azure Add-on TA to version 2.1. Not only did it break the configuration, but there are also some added permissions that need to be applied on the Azure portal side. I worked with someone on our Windows AD team who has the necessary access but he did not see what is referenced below in the details of the Add-on.
https://splunkbase.splunk.com/app/3757/
Microsoft Azure Active Directory Sign-ins Microsoft Graph Read all audit log data
Windows Azure Active Directory "(Application) Read directory data
(Delegated) Read directory data"
Microsoft Azure Active Directory Users Microsoft Graph Read all audit log data
Windows Azure Active Directory "(Application) Read directory data
(Delegated) Read directory data"
Microsoft Azure Active Directory Audit Microsoft Graph Read all audit log data
Windows Azure Active Directory "(Application) Read directory data
(Delegated) Read directory data"
These are the errors in the internal logs. Any ideas?
04-28-2020 15:58:03.014 -0400
ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_audit.py"
ERROR401 Client Error: Unauthorized for url: https://graph.microsoft.com/beta/auditLogs/directoryAudits?
$orderby=activityDateTime&$filter=activityDateTime+gt+2020-04-21T15:58:02.316173Z+and+activityDateTime+le+2020-04-28T19:51:02.559995Z
↧