Hi,
I installed Splunk Add-on for MicroSoft Cloud Services and configured it as instructed on this page. Initially everything looked ok and O365 Troubleshooting tab showed all green. However, after I configured inputs and went to check O365 Troubleshooting tab again, it reported 1 invalid account and there was the following error in the internal log:
2018-02-02 17:58:58,946 +0000 log_level=ERROR, pid=2111, tid=MainThread, file=o365_subscription.py, func_name=_subscription_request, code_line_no=88 | [account="XXXXXXX.onmicrosoft.com" proxy_enabled="false" proxy_type="http" proxy_rdns="false" ]Subscription request failed, [proxy_enabled="false" proxy_type="http" proxy_rdns="false" ] GET request to https://manage.office.com/api/v1.0/1bd5432d-xxxx-xxxx-xxxx-xxxxxxx22206/activity/feed/subscriptions/... failed, reason: 401, {"Message":"Authorization has been denied for this request."}
What does "Authorization has been denied for this request." mean? Any ideas and help to resolve this issue would be appreciated.
Thanks!
Same issue here, the only way to recover is to go back into UI and enter the password again to force a token refresh every couple of days, very annoying.
Hello,
Following this thread as I am facing this same issue. However, I keep getting logs from o365 despite this error in _internal logs.
did you have an O365 admin use their login/pw during the setup process to add the app's authorization?
Yes, I did.
Hi Viktdm,
Did you end up getting a resolution to this?