Splunk Add-on for Microsoft Cloud Services: What does "Authorization has been denied for this request" error mean after the installation of the add-on?

[viktdm]

Hi,

I installed Splunk Add-on for MicroSoft Cloud Services and configured it as instructed on this page. Initially everything looked ok and O365 Troubleshooting tab showed all green. However, after I configured inputs and went to check O365 Troubleshooting tab again, it reported 1 invalid account and there was the following error in the internal log:

2018-02-02 17:58:58,946 +0000 log_level=ERROR, pid=2111, tid=MainThread, file=o365_subscription.py, func_name=_subscription_request, code_line_no=88 | [account="XXXXXXX.onmicrosoft.com" proxy_enabled="false" proxy_type="http" proxy_rdns="false" ]Subscription request failed, [proxy_enabled="false" proxy_type="http" proxy_rdns="false" ] GET request to https://manage.office.com/api/v1.0/1bd5432d-xxxx-xxxx-xxxx-xxxxxxx22206/activity/feed/subscriptions/... failed, reason: 401, {"Message":"Authorization has been denied for this request."}

What does "Authorization has been denied for this request." mean? Any ideas and help to resolve this issue would be appreciated.

Thanks!

[alexistremblay]

Same issue here, the only way to recover is to go back into UI and enter the password again to force a token refresh every couple of days, very annoying.

[pedrolito]

Hello,

Following this thread as I am facing this same issue. However, I keep getting logs from o365 despite this error in _internal logs.

[Bloodnite]

did you have an O365 admin use their login/pw during the setup process to add the app's authorization?

[viktdm]

Yes, I did.

[geraldcontreras]

Hi Viktdm,
Did you end up getting a resolution to this?