Microsoft Azure Add on for Splunk : Problem while getting AAD User logs

[admin12345678]

While configuring the AAD User log, I am getting this error. Is there anyone who can help me regrading this?

----------------------------------------------------------------------------------------

2020-12-22 08:42:59,793 ERROR pid=13688 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events.

Traceback (most recent call last):

File "C:\Program Files\Splunk\etc\apps\TA-MS-AAD\bin\ta_ms_aad\aob_py3\modinput_wrapper\base_modinput.py", line 128, in stream_events self.collect_events(ew)

File "C:\Program Files\Splunk\etc\apps\TA-MS-AAD\bin\MS_AAD_user.py", line 76, in collect_events input_module.collect_events(self, ew)

File "C:\Program Files\Splunk\etc\apps\TA-MS-AAD\bin\input_module_MS_AAD_user.py", line 36, in collect_events users_response = azutils.get_items_batch(helper, access_token, url)

File "C:\Program Files\Splunk\etc\apps\TA-MS-AAD\bin\ta_azure_utils\utils.py", line 55, in get_items_batch raise e

File "C:\Program Files\Splunk\etc\apps\TA-MS-AAD\bin\ta_azure_utils\utils.py", line 49, in get_items_batch r.raise_for_status()

File "C:\Program Files\Splunk\etc\apps\TA-MS-AAD\bin\ta_ms_aad\aob_py3\requests\models.py", line 940, in raise_for_status

raise HTTPError(http_error_msg, response=self)

requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://graph.microsoft.com/beta/users/

-------------------------------------------------------------------------------------------------------------------

Thanks in advance ....

Collapse

[jconger]

A 403 error is typically a permissions issue with the Azure AD app registration.  Check the permissions by going to https://portal.azure.com  Go to Azure Active Directory > App registrations > find your app registration the add-on is using > API permissions.  To get user data, you will need to have Microsoft Graph User.Read.All.

For details on the various permissions needed for specific inputs, refer to this link -> http://bit.ly/Splunk_Azure_Permissions