Office 365 Add-On connection errors - unhandled exceptions

[craigkleen]

Hello,

We've followed the instructions for version 2.0.2 of splunk_ta_o365, running on a Splunk 8.0.2 HF. But in the logs we're getting:

2020-05-28 07:45:25,328 level=ERROR pid=2827626 tid=MainThread logger=splunk_ta_o365.modinputs.management_activity pos=utils.py:wrapper:67 | datainput=b'O365_Management_Activity' start_time=1590677124 | message="Data input was interrupted by an unhandled exception."
Traceback (most recent call last):
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/utils.py", line 65, in wrapper
return func(*args, **kwargs)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/management_activity.py", line 102, in run
executor.run(adapter)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunksdc/batch.py", line 47, in run
for jobs in delegate.discover():
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/management_activity.py", line 127, in discover
subscription.start(session)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/common/portal.py", line 160, in start
response = self.perform(session, 'POST', '/subscriptions/start', params)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/common/portal.py", line 169, in _perform
return self._request(session, method, url, kwargs)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/common/portal.py", line 181, in _request
raise O365PortalError(response)
File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/common/portal.py", line 26, in __init_
message = str(response.status_code) + ':' + payload
TypeError: can only concatenate str (not "bytes") to str

We've checked and rechecked our Azure permissions, which look like:

Hoping someone has a lead on what's going wrong. At least one poster with a similar error said that "Grant Permissions" was missed on the Azure side, but as far as we can tell it looks OK there.

Thanks

[craigkleen · Accepted solution]

Yeah, answering my own post.

The issue was that we used the wrong "endpoint". We chose "USGovGCCHigh" instead of "Worldwide", because Worldwide kept erroring out. Lesson-learned that the Worldwide looked different to our Palo Alto Firewall as far as the "app ID" went, so the PAN blocked it. Once the firewall was open, and we switched the Endpoint to Worldwide, it worked perfectly.