All Apps and Add-ons

Splunk Add-on for Microsoft Office 365: Will not return any DLP events but returns all others. Any ideas?

ChadLangUAB
Path Finder

I've confirmed that, as required, the Splunk API account has the correct Application and Delegated permissions to read the service health, activity data, and DLP policy events. These permissions are selected, saved and then granted within the Office 365 Management Activity API configuration on Azure Active Directory.

Also confirmed that the account has Microsoft Office 365 E3 license applied.

We are really at wit's end and have had a support case open since 7/21.

Hopefully, someone here has some experience with this issue.

esalmon
Explorer

Bumping this up because we have the same issue

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...