https://community.splunk.com/t5/Security/Microsoft-Azure-Add-on-for-Splunk-NO-authenticationDetail/m-p/561053#M12446 <P>I was able to fix this by reinstalling the app.</P> Tue, 27 Jul 2021 16:40:35 GMT zschmerber 2021-07-27T16:40:35Z https://community.splunk.com/t5/Security/Microsoft-Azure-Add-on-for-Splunk-NO-authenticationDetail/m-p/561033#M12443 <P>It seems that the&nbsp;authenticationDetail resource type is no longer part of the: Sign-ins - Azure AD sign-ins including conditional access policies and MFA</P><P>After researching the issue it seems only the Beta API NOT the v1.0 API has the data we want. However toggling the addon to Beta Has not affect on the log structure we still don't see&nbsp;authenticationDetail resource type in the logs.&nbsp;</P><P>Microsoft Azure Add-on for Splunk Version: 3.1.1<BR />Splunk Enterprise 8.1</P><P>Is this a problem with the TA not having the correct python to pull the data or the MS API changing ? worked in April this year.&nbsp;</P> Tue, 27 Jul 2021 15:27:33 GMT https://community.splunk.com/t5/Security/Microsoft-Azure-Add-on-for-Splunk-NO-authenticationDetail/m-p/561033#M12443 zschmerber 2021-07-27T15:27:33Z https://community.splunk.com/t5/Security/Microsoft-Azure-Add-on-for-Splunk-NO-authenticationDetail/m-p/561053#M12446 <P>I was able to fix this by reinstalling the app.</P> Tue, 27 Jul 2021 16:40:35 GMT https://community.splunk.com/t5/Security/Microsoft-Azure-Add-on-for-Splunk-NO-authenticationDetail/m-p/561053#M12446 zschmerber 2021-07-27T16:40:35Z