topic Steps for Configuring Splunk Add-on for Microsoft Office 365 for China Tenant in All Apps and Add-ons

Steps for Configuring Splunk Add-on for Microsoft Office 365 for China Tenant

Tilakram — Fri, 15 Nov 2024 18:07:25 GMT

Hello Splunkers,

I’m working on integrating a Microsoft Office 365 tenant hosted in China (managed by 21Vianet) with Splunk Cloud. I am using the Splunk Add-on for Microsoft Office 365 but need help configuring it specifically for the China tenant.

I understand that the endpoints for China are different from the global Microsoft 365 environment. For instance:

Graph API Endpoint: https://microsoftgraph.chinacloudapi.cn
AAD Authorization Endpoint: https://login.partner.microsoftonline.cn

Could someone provide step-by-step instructions or point me to the necessary configuration files (like inputs.conf) or documentation to correctly set this up for:

Subscription to O365 audit logs
Graph API integration
Event collection

Additionally, if there are any known challenges or limitations specific to the China tenant setup, I’d appreciate insights on those as well.

Thank you in advance for your guidance!

Tilakram

Re: Steps for Configuring Splunk Add-on for Microsoft Office 365 for China Tenant

Meett — Mon, 18 Nov 2024 05:17:57 GMT

Hello @Tilakram Add-on doesn’t support Azure china ByDefault so i am afraid if it will work or not.

Re: Steps for Configuring Splunk Add-on for Microsoft Office 365 for China Tenant

Tilakram — Mon, 18 Nov 2024 06:45:09 GMT

Hello @Meett ,

Thank you for the quick response! I appreciate your insight.

If the Splunk Add-on for Microsoft Office 365 doesn’t natively support Azure China, are there any recommended workarounds or custom configurations (e.g., modifying inputs.conf or using custom scripts) that could enable data collection for China tenants?

Alternatively, are there other Splunk-supported methods or integrations that you’d recommend for ingesting Microsoft Office 365 logs from Azure China tenants? For instance, could a custom API integration with the Graph API endpoint https://microsoftgraph.chinacloudapi.cn be a feasible approach?

Looking forward to your thoughts!

Regards,
Tilakram

Re: Steps for Configuring Splunk Add-on for Microsoft Office 365 for China Tenant

Moni — Wed, 13 Aug 2025 14:50:35 GMT

Hello, I am having similar issues. @Tilakram @Meett
Were you able to fix it or know if 21V is supported within Splunk for log ingestion?

Re: Steps for Configuring Splunk Add-on for Microsoft Office 365 for China Tenant

PickleRick — Wed, 13 Aug 2025 15:06:45 GMT

Not knowing the app itself I might say that if the Chinese tenants differ _only_ on the service URI, you might try to edit the app yourself and see if changing the URI(s) in the code helps.

The downside is that you'll have to do it again on each app upgrade and your version would be unsupported - in case something doesn't work you're on your own.