All Apps and Add-ons

Splunk Add-on for Microsoft Office 365: Will not return any DLP events but returns all others. Any ideas?

Path Finder

I've confirmed that, as required, the Splunk API account has the correct Application and Delegated permissions to read the service health, activity data, and DLP policy events. These permissions are selected, saved and then granted within the Office 365 Management Activity API configuration on Azure Active Directory.

Also confirmed that the account has Microsoft Office 365 E3 license applied.

We are really at wit's end and have had a support case open since 7/21.

Hopefully, someone here has some experience with this issue.


Bumping this up because we have the same issue

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...