How to get log from o365 on azure

[sittipornbaycom]

Hi

I would like to know step or document for integrate between splunk with o365 on azure, But it's want "Client Secret" from azure to insert into Splunk. Where can i get it ?

I try solution this URL:https://splunkbase.splunk.com/app/4055/ but it can't find any splunk URL for register on azure to get "Client Secret".

Thanks

Regards

[dsoni_splunk]

@sittipornbaycoms

Client Secret-key can be found over here:

Login to Azure platform >> Go to Azure Active Directory >> App Registartions >> Select your registered Application >> Select App >> Click on Settings >> Keys >> Generate Key

[nickhills]

Getting the o365/azure apps to work is a multi step process.

Once you have installed the Splunk add-in you need to configure an 'integration application' inside your Azure portal to allow your Splunk server to be authorized and authenticate.
https://docs.splunk.com/Documentation/AddOns/released/MSO365/ConfigureappinAzureAD

Then you have to configure your 365 tenant in Splunk with the relevant credentials from the step above.
https://docs.splunk.com/Documentation/AddOns/released/MSO365/Configuretenant

When you have done both of those, you can configure your inputs to collect the required data.
https://docs.splunk.com/Documentation/AddOns/released/MSO365/Configureinputs

[sittipornbaycom]

I try solution this but it can't connect with azure because it not have URL for splunk app register on azure to get "Client Secret".

[nickhills]

Have you done this?
(Step 1 from the first link)

https://docs.microsoft.com/en-us/office/office-365-management-api/get-started-with-office-365-manage...

[sittipornbaycom]

I try to follow Use the Azure Management Portal to register your application in Azure AD in "Get started with Office 365 Management APIs".
But I can not find the sign-on url and app id url in steps 7 Enter the appropriate App properties.