All Apps and Add-ons

Microsoft Azure Add on - ERROR403 Client Error: Forbidden

klowk
Path Finder

Hi all,

we configured the Input Microsoft Azure Active Directory Sign-ins in Microsoft Azure Add on and get always following error message.

10-27-2020 11:05:23.938 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_signins.py" ERROR403 Client Error: Forbidden for url: https://graph.microsoft.com/beta/auditLogs/signIns*

We configured it as described in the App itself app/TA-MS-AAD/aad_app_registration.

Can someone explain what is still missing to get the data in?

kind regards

Kathrin

Labels (1)
0 Karma

mattcosa
Explorer

Hey did you ever resolve? There's a stack of threads for other users with the same error.

 

 

Client Error: Forbidden for url: https://graph.microsoft.com/beta/auditLogs/signIns?$

 

 

I've setup the permissions per http://bit.ly/Splunk_Azure_Permissions.Specifically:

Microsoft Azure Active Directory Sign-insMicrosoft Graph(Application) AuditLog.Read.All - Read all audit log data

 

mattcosa_0-1613023315717.png


I have tried with two tenancies both resulting the same 403.

 
Other reference threads:
https://community.splunk.com/t5/All-Apps-and-Add-ons/Microsoft-Azure-Add-on-for-Splunk-version-confi...

0 Karma

LCelley
Explorer

We solved this problem in our environment by adding Directory.Read.All as an app permission.

Microsoft lists both Directory.Read.All and AuditLog.Read.All as a requirement to be able to use graph to grab sign in logs.
https://docs.microsoft.com/en-us/graph/api/signin-list?view=graph-rest-1.0&tabs=http

mattcosa
Explorer

🙏 @LCelley 

This config change worked with Directory.Read.All, however I can't seem to get this working on a second AAD.

I'm investigating if the cause is related to the AAD P1 or P2 entitlement (i.e. doesn't have it). 

There's some confusion buried in the Github issue list on that article:
https://github.com/microsoftgraph/microsoft-graph-docs/issues/10987

 

0 Karma

mattcosa
Explorer

For completeness - Azure Active Directory P1 or P2 licensing is required for the signIns sourcetype.

I've also raised a Github issue with Microsoft to address consistency errors between documentation that discusses the prerequisite license requirement. 

https://docs.microsoft.com/en-us/graph/api/signin-list?view=graph-rest-1.0&tabs=http

https://docs.microsoft.com/en-us/graph/api/resources/azure-ad-auditlog-overview?view=graph-rest-1.0#...

Tags (3)
0 Karma

klowk
Path Finder

We had still no resolution for this error. Our workaround is to send these events over the Eventhub.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!