topic Re: Does Splunk Add-on For M365 app work in GCC HIGH tenants? in Getting Data In

Does Splunk Add-on For M365 app work in GCC HIGH tenants?

TestAdminHorst — Wed, 02 Jul 2025 23:30:38 GMT

We are getting the following error when trying to ingest EXO mail logs into splunk using the add-in.

line 151, in __call__ raise ValueError("{} endpoint for found".format(name)) ValueError: MessageTrace endpoint for found
if not endpoint:

raise ValueError("{} endpoint for found".format(name))

Does the Splunk add-on for M365 work when reaching out to GCC HIGH endpoints? or is the add-on not configured for such connections?

Re: Does Splunk Add-on For M365 app work in GCC HIGH tenants?

PrewinThomas — Thu, 03 Jul 2025 04:28:16 GMT

@TestAdminHorst

This add-on is primarily designed for standard Microsoft 365 environments. GCC High and DoD tenants operate in different cloud environment with restricted endpoints. So this standard add-on endpoints may not work with GCC High.

#https://learn.microsoft.com/en-us/office/dev/add-ins/publish/government-cloud-guidance

But you can consider having custom script for gcc high endpoints.
#https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-u-s-government-gcc-high-endpoints?view=o365-worldwide

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Does Splunk Add-on For M365 app work in GCC HIGH tenants?

livehybrid — Thu, 03 Jul 2025 07:39:54 GMT

Hi @TestAdminHorst

There is a good explanation around this and workaround at https://splunk.my.site.com/customer/s/article/The-Splunk-Add-on-for-Office-365-is-not-collecting-any-logs-for-certain-inputs-that-use-the-Microsoft-Graph-API-and-the-USGovGCCHigh-endpoint which is worth looking at.
Ultimately you might have more success by sending the logs from 365 to an Azure Event Hub and then ingest them that way.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful

Marking it as the solution if it resolved your issue

Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.