topic Re: After configuring input for Splunk Microsoft Log Analytics Add-on, why am I getting the following "403 error"? in All Apps and Add-ons

After configuring input for Splunk Microsoft Log Analytics Add-on, why am I getting the following "403 error"?

sharma11031988 — Fri, 05 Oct 2018 18:02:57 GMT

I am trying to perform a POC for a project while trying to integrate the Microsoft Log Analytics Add-on to the Splunk Enterprise free version.

After following steps as in https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal, I have been getting the error below…..

Team could you please help me on this? What could be wrong?

2018-10-05 13:47:17,733 ERROR pid=27240 tid=MainThread file=base_modinput.py:log_error:307 | OMSInputName="Test_New" status="403" step="Post Query" response="{"error":{"message":"The provided credentials have insufficient access to perform the requested operation","code":"InsufficientAccessError"}}"

Re: After configuring input for Splunk Microsoft Log Analytics Add-on, why am I getting the following "403 error"?

samhays — Fri, 05 Oct 2018 21:48:06 GMT

You might not be getting the level of responses you want here because your question "what could be wrong" is answered within the message you posted: "Insufficient Access Error".

This is an error on the Microsoft side, likely meaning you have some configuration problem in Azure.

Edit: https://www.splunk.com/blog/2018/04/20/splunking-microsoft-azure-monitor-data-part-1-azure-setup.html may be helpful.

Re: After configuring input for Splunk Microsoft Log Analytics Add-on, why am I getting the following "403 error"?

sharma11031988 — Fri, 05 Oct 2018 22:18:19 GMT

Thanks Sam,

To be honest i am fairly new to azure thus this naive question :). However yes it was certainly limitation on my azure account role and app permission. Thanks for pushing me in right direction.

Cheers to Splunking!!!

Re: After configuring input for Splunk Microsoft Log Analytics Add-on, why am I getting the following "403 error"?

samhays — Fri, 05 Oct 2018 22:33:10 GMT

No problem 🙂

Would you mind posting the solution though for future folks? - especially if the documentation that you mentioned was lacking something important.

Re: After configuring input for Splunk Microsoft Log Analytics Add-on, why am I getting the following "403 error"?

sharma11031988 — Sun, 21 Oct 2018 23:58:51 GMT

Issue was with missing reader permission on created App at Tenant subscription level.

Re: After configuring input for Splunk Microsoft Log Analytics Add-on, why am I getting the following "403 error"?

richgalloway — Mon, 22 Oct 2018 00:25:58 GMT

@sharma11031988 If your problem is resolved, please accept the answer to help future readers.