Microsoft Azure Add on for Splunk (TS-MS-AAD v 3.1.1) error:309 | _Splunk_ Unable to obtain access token

Azeemering — Tue, 30 Mar 2021 08:40:45 GMT

Hello I am installing a fresh new install of this app to replace our old version (1.2.4)

I am using the same credentials as the old working version (client id, secret and tenant)

With the new app I get the error:

2021-03-30 09:17:26,598 ERROR pid=109928 tid=MainThread file=base_modinput.py:log_error:309 | _Splunk_ Unable to obtain access token 2021-03-30 09:17:26,596 DEBUG pid=109928 tid=MainThread file=connectionpool.py:_make_request:437 | https://login.microsoftonline.com:443 "POST /27776982-d882-41b2-95ac-322f28d5a2ce/oauth2/v2.0/token HTTP/1.1" 401 471 2021-03-30 09:17:26,372 DEBUG pid=109928 tid=MainThread file=connectionpool.py:_new_conn:959 | Starting new HTTPS connection (1): login.microsoftonline.com:443

When reverting to the old app it works fine and I am able to collect data.
We checked all the permissions and Azure settings. What else do we need to do to get this working with the new version.

Re: Microsoft Azure Add on for Splunk (TS-MS-AAD v 3.1.1) error:309 | _Splunk_ Unable to obtain access token

Vardhan — Tue, 30 Mar 2021 10:38:09 GMT

Hi @Azeemering ,

In the new Azure Addon version, the interface and settings have been changed. So if you are trying with the old local config like Passwords.conf&ta_ms_aad_settings.conf it will not work in the new version.

Try to do a fresh config and erase all the old configs.

topic Re: Microsoft Azure Add on for Splunk (TS-MS-AAD v 3.1.1) error:309 | _Splunk_ Unable to obtain access token in Getting Data In

Microsoft Azure Add on for Splunk (TS-MS-AAD v 3.1.1) error:309 | _Splunk_ Unable to obtain access token

Re: Microsoft Azure Add on for Splunk (TS-MS-AAD v 3.1.1) error:309 | _Splunk_ Unable to obtain access token