All Apps and Add-ons

Splunk Add-on for Microsoft Office 365: Will not return any DLP events but returns all others. Any ideas?

Path Finder

I've confirmed that, as required, the Splunk API account has the correct Application and Delegated permissions to read the service health, activity data, and DLP policy events. These permissions are selected, saved and then granted within the Office 365 Management Activity API configuration on Azure Active Directory.

Also confirmed that the account has Microsoft Office 365 E3 license applied.

We are really at wit's end and have had a support case open since 7/21.

Hopefully, someone here has some experience with this issue.


Bumping this up because we have the same issue

0 Karma
Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...