MSFT Azure AD Reporting Add-On for Splunk

All Apps and Add-ons

So we followed the instructions for the document to a T but when i do a search of the index, there's no data. We have an Azure AD Premium P1 and double checked the granted permissions and they're perfect.

https://splunkbase.splunk.com/app/3757/#/details
https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-configure-prerequis...

Any tips on what to look for in terms of troubleshooting this? Or this because we haven't installed the add-on for the heavy forwarder?

Thanks

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...