topic Re: Has anyone had this Microsoft Office 365 Reporting Mail Add-on for Splunk Login Issue? in All Apps and Add-ons

Has anyone had this Microsoft Office 365 Reporting Mail Add-on for Splunk Login Issue?

tasteless_dove — Fri, 10 Jun 2022 05:11:06 GMT

Hi Everyone,

Had a question and apologies in advanced if the topic has already been brought up. We are currently utilizing the Microsoft Office 365 Reporting Mail Add-on for Splunk to ingest message trace logs, but just recently we've been running into consistent 401 unauthorized errors. We've double checked and triple checked that the account used to query the API is not locked and we are able to get results when we manually call the URI:

Invoke-RestMethod -Method GET -Uri "https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?" -Credential $cred

Has anyone run into this issue? If so, would be very appreciated if there would be any feedback as to how it was resolved (or at least a pathway to remediation).

Thank you again

Re: Has anyone had this Microsoft Office 365 Reporting Mail Add-on for Splunk Login Issue?

Azmeentun — Fri, 10 Jun 2022 11:37:40 GMT

NO, I have Microsoft office 365. it is working very well and does cause any issues for me.I think there is some type of bug in your device. You need to fix that carefully than might be it will work for you.

Re: Has anyone had this Microsoft Office 365 Reporting Mail Add-on for Splunk Login Issue?

jwalzerpitt — Thu, 23 Jun 2022 14:13:53 GMT

Have you opened a case with Microsoft by any chance as I believe the issue lies with them?

Re: Has anyone had this Microsoft Office 365 Reporting Mail Add-on for Splunk Login Issue?

tasteless_dove — Thu, 23 Jun 2022 16:31:14 GMT

Went through a long trial and error period and we got it somewhat stable. For whatever reason, we had to increase our interval from 5 minutes to 10 minutes and lower the delay throttle from 24 hours to 12 hours. We are getting the logs consistently (at least within the 24hour period). Weird the issue decided to start just recently, but at least we are getting logs 🙂

Re: Has anyone had this Microsoft Office 365 Reporting Mail Add-on for Splunk Login Issue?

jwalzerpitt — Thu, 23 Jun 2022 17:07:41 GMT

Thx for the update and for sharing your settings for the add-on / one would think Microsoft would have a better API for message trace logs knowing the importance of those logs

Glad you got it working and hope it stays that way!