https://community.splunk.com/t5/Getting-Data-In/Azure-MFA-ingestion-into-Splunk-does-quot-Splunk-Add-on-for/m-p/677479#M113260 <P>My company is transitioning from an on-premise MFA setup within ADFS to the Azure MFA setup.&nbsp; What's the best approach to getting those MFA events into Splunk?&nbsp; Does the Splunk Addon for Microsoft Azure (splunkbase 3757) meet that goal?&nbsp;&nbsp;</P> Tue, 13 Feb 2024 20:20:48 GMT dkmcclory 2024-02-13T20:20:48Z https://community.splunk.com/t5/Getting-Data-In/Azure-MFA-ingestion-into-Splunk-does-quot-Splunk-Add-on-for/m-p/677479#M113260 <P>My company is transitioning from an on-premise MFA setup within ADFS to the Azure MFA setup.&nbsp; What's the best approach to getting those MFA events into Splunk?&nbsp; Does the Splunk Addon for Microsoft Azure (splunkbase 3757) meet that goal?&nbsp;&nbsp;</P> Tue, 13 Feb 2024 20:20:48 GMT https://community.splunk.com/t5/Getting-Data-In/Azure-MFA-ingestion-into-Splunk-does-quot-Splunk-Add-on-for/m-p/677479#M113260 dkmcclory 2024-02-13T20:20:48Z https://community.splunk.com/t5/Getting-Data-In/Azure-MFA-ingestion-into-Splunk-does-quot-Splunk-Add-on-for/m-p/678690#M113416 <P>The best way is to send your Microsoft Entra ID (formerly Azure AD) data to an event hub.&nbsp; Then, use the <A href="https://splunkbase.splunk.com/app/3110" target="_self">Splunk Add-on for Microsoft Cloud Services</A> to ingest the data (hint: use the <STRONG><FONT face="courier new,courier">azure:monitor:aad</FONT> </STRONG>sourcetype).&nbsp; Here's a Lantern article for setting up the add-on =&gt;&nbsp;<A href="https://lantern.splunk.com/Data_Descriptors/Microsoft/Getting_started_with_Microsoft_Azure_Event_Hub_data" target="_blank">https://lantern.splunk.com/Data_Descriptors/Microsoft/Getting_started_with_Microsoft_Azure_Event_Hub_data</A></P><P>&nbsp;</P><P>Alternatively, you can use <A href="https://splunkbase.splunk.com/app/3757" target="_self">Splunk Add-on for Microsoft Azure</A>.&nbsp; Use the "Azure Active Directory Interactive Sign-ins" input to get the data.&nbsp; Depending on your environment size, you may hit some throttling limitations with the REST API this add-on uses =&gt;&nbsp;<A href="https://github.com/splunk/splunk-add-on-microsoft-azure/wiki/Configure-Azure-Active-Directory-inputs-for-the-Splunk-Add-on-for-Microsoft-Azure#throttling-guidance" target="_blank">https://github.com/splunk/splunk-add-on-microsoft-azure/wiki/Configure-Azure-Active-Directory-inputs-for-the-Splunk-Add-on-for-Microsoft-Azure#throttling-guidance</A></P> Mon, 26 Feb 2024 16:46:57 GMT https://community.splunk.com/t5/Getting-Data-In/Azure-MFA-ingestion-into-Splunk-does-quot-Splunk-Add-on-for/m-p/678690#M113416 jconger 2024-02-26T16:46:57Z