The Authentication Requirement field from Azure is not showing up in Splunk cloud. According to https://docs.microsoft.com/en-us/graph/api/signin-list?view=graph-rest-beta&tabs=http, I need to add both AuditLog.Read.All & Directory.Read.All to my API permissions. I did that but I am still not seeing all the fields listed. Specifically, I am looking for the Authentication Requirement field. Does anyone know how to get fields added or what I may be missing?
I found the issue. I had to change the input for Azure AD Sign-ins from 1.0 to beta and then the information started coming in.