New version 1.0.3 gives a request error when querying the Microsoft Graph

[raoul]

I upgraded to version 1.0.3 and now I get the following error in the _internal log:

07-27-2018 14:30:01.195 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_signins.py" HTTP Request error: 400 Client Error: Bad Request for url: https://graph.windows.net/notTheRealDomain.onmicrosoft.com/activities/signinEvents?api-version=beta&...

[ajayshikant2782]

I was having the same issue but only running the code directly from Azure (inside an Azure Website). I solved upgrading 'Microsoft.IdentityModel.Clients.ActiveDirectory' package to '2.6.1-alpha'. Linksys Support

Should you have any suggestions, please let me know.

[jconger · Accepted solution]

This is most likely an issue with a previous checkpoint Date/Time value. Try disabling the existing input and creating a new input specifying a Date/Time to start gathering data.

[jralston]

Can someone provide me a sample timestamp that works? Having trouble with this as well.

[ChrisBell04]

The following is working for us

\TA-MS-AAD\local\inputs.conf
[MS_AAD_signins://Tenant_X]
index = mscs
interval = 60
max_records = 10
start_date = 2018-07-19T00:00:00Z
tenant_domain = X.onmicrosoft.com

[shirishkamat84]

Thanks, it worked for me as well

[raoul]

Thanks. That did work.

[ChrisBell04]

Would be great if the code handled this 'gotcha' during an upgrade. Also if it was in the upgrade notes so a user doesnt need to search the forum for a solution.

[swong2]

I got the same error after upgraded to 1.0.3.

I added a debug statement to the script and it showed the following error response:

DEBUG pid=3794 tid=MainThread file=base_modinput.py:log_debug:286 | {u'code': u'', u'message': u"The time zone information is missing on the DateTimeOffset value '2018-07-27T13:49:59.986522'. A DateTimeOffset value must contain the time zone information."}