topic Re: Picking your brain - Splunk Add-on for Microsoft Office 365 - No Exchange Message Trace activity in Splunk Cloud Platform

Picking your brain - Splunk Add-on for Microsoft Office 365 - No Exchange Message Trace activity

jorge_1800 — Sat, 30 Mar 2024 18:58:12 GMT

Hello there, we're in process of deploying Splunk Cloud. We have installed the Microsoft Office 365 App for splunk along with all the required add-ons. The app is working as intended except that we're not getting any Message Trace data. We followed the instructions to properly setup the the Add-on Input and assigned the API permissions on the Azure side. For whatever reason we're still not getting any Trace Data. It looks like problem it's on the Azure side, we have assigned the appropriate API permissions as stated in the documentation. Is there anything else that needs to be setup on the Azure - or Splunk side to get Exchange Trace data?

We followed this instructions for Splunk add-on for Microsoft Office 365 integration.

https://docs.splunk.com/Documentation/AddOns/released/MSO365/ConfigureappinAzureAD

Any help would be highly appreciated.

Re: Picking your brain - Splunk Add-on for Microsoft Office 365 - No Exchange Message Trace activity

jconger — Fri, 05 Apr 2024 15:42:47 GMT

The Message Trace input requires an additional step that isn't needed for the other inputs. Did you add the Azure AD app registration to one of the following IAM roles?

Exchange Administrator
Global Administrator
Global Reader role (recommended)

https://docs.splunk.com/Documentation/AddOns/released/MSO365/Configureinputmessagetrace

Re: Picking your brain - Splunk Add-on for Microsoft Office 365 - No Exchange Message Trace activity

jorge_1800 — Mon, 08 Apr 2024 16:45:49 GMT

Hello jconger,

Thanks for the comment. My system admin did the registration and added the permissions during the original setup. We're not getting any message trace data. I can ask him to double-check the roles, but as far as I know, it was done properly.