https://community.splunk.com/t5/Security/Why-splunk-is-indexing-only-o365-management-activity-status/m-p/625871#M16522 Wed, 04 Jan 2023 17:36:37 GMT karu0711 2023-01-04T17:36:37Z https://community.splunk.com/t5/Security/Why-splunk-is-indexing-only-o365-management-activity-status/m-p/625871#M16522 Wed, 04 Jan 2023 17:36:37 GMT https://community.splunk.com/t5/Security/Why-splunk-is-indexing-only-o365-management-activity-status/m-p/625871#M16522 karu0711 2023-01-04T17:36:37Z https://community.splunk.com/t5/Security/Why-splunk-is-indexing-only-o365-management-activity-status/m-p/625963#M16523 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/250407">@karu0711</a>,</P><P>could you share more infos?</P><P>what is the app you are speaking of ?</P><P>I suppose that you have a Singl Sign On environment, probably you see only the succeses after the main SSO that's always successful.</P><P>Ciao.</P><P>Giuseppe</P> Thu, 05 Jan 2023 08:41:36 GMT https://community.splunk.com/t5/Security/Why-splunk-is-indexing-only-o365-management-activity-status/m-p/625963#M16523 gcusello 2023-01-05T08:41:36Z