topic Re: Service Principal configuration for Splunk Add-on for Microsoft Cloud Services in Getting Data In

Service Principal configuration for Splunk Add-on for Microsoft Cloud Services

regarza — Wed, 04 Dec 2024 21:29:07 GMT

We are looking to configure the Splunk Add-on for Microsoft Cloud Services to use a Service Principal as opposed to a client key. The documentation for the Add-On does not provide insight into how one would configure the Splunk Add-on for Microsoft Cloud Services to work with a Service Principal. Does the Splunk Add-on for Microsoft Cloud Services service principals for authentication?

Re: Service Principal configuration for Splunk Add-on for Microsoft Cloud Services

rishabhshah — Mon, 09 Dec 2024 10:28:24 GMT

MSCS TA uses service principle for authentication. Please review below document to configure and connect with TA with the same - https://splunk.github.io/splunk-add-on-for-microsoft-cloud-services/ConfigureappinAzureAD/

Re: Service Principal configuration for Splunk Add-on for Microsoft Cloud Services

regarza — Mon, 09 Dec 2024 18:32:46 GMT

When I attempted to configure the input to use the service principal, I started to get the following error message:

<?xml version="1.0" encoding="utf-8"?><Error><Code>PublicAccessNotPermitted</Code><Message>Public access is not permitted on this storage account.
RequestId:3d827a38-b01e-003e-7d90-46bd5c000000
Time:2024-12-04T21:05:06.5396465Z</Message></Error>

Are there other items that I must reconfigure to get the service principal configured?

Re: Service Principal configuration for Splunk Add-on for Microsoft Cloud Services

rishabhshah — Wed, 11 Dec 2024 10:31:32 GMT

Can check from the Azure end. Refer https://techcommunity.microsoft.com/blog/azurepaasblog/public-access-is-not-permitted-on-this-storage-account/3521288

Re: Service Principal configuration for Splunk Add-on for Microsoft Cloud Services

nirajc_splunk — Tue, 17 Dec 2024 12:35:16 GMT

As per error logs it seems that public access for the storage account overrides the public access settings for all containers in that storage account, preventing anonymous access to blob data in that account. When public access is disallowed for the account, it is not possible to configure the public access setting for a container to permit anonymous access, and any future anonymous requests to that account will fail.

To set the AllowBlobPublicAccess property for the storage account, a user must have permissions to create and manage storage accounts. Azure role-based access control (Azure RBAC) roles that provide these permissions include the Microsoft.Storage/storageAccounts/write action. Built-in roles with this action include:

The Azure Resource Manager Owner role
The Azure Resource Manager Contributor role
The Storage Account Contributor role

Once you have an account with such permissions, you can work your way through any of the following ways to enable the "Blob public access" setting on your Storage Account:

After that you can also set the public access setting at the container and blob levels:

This above information will help you to resolve this issue