Steps for Configuring Splunk Add-on for Microsoft Office 365 for China Tenant

[Tilakram]

Hello Splunkers,

I’m working on integrating a Microsoft Office 365 tenant hosted in China (managed by 21Vianet) with Splunk Cloud. I am using the Splunk Add-on for Microsoft Office 365 but need help configuring it specifically for the China tenant.

I understand that the endpoints for China are different from the global Microsoft 365 environment. For instance:

• Graph API Endpoint: https://microsoftgraph.chinacloudapi.cn
• AAD Authorization Endpoint: https://login.partner.microsoftonline.cn

Could someone provide step-by-step instructions or point me to the necessary configuration files (like inputs.conf) or documentation to correctly set this up for:

• Subscription to O365 audit logs
• Graph API integration
• Event collection

Additionally, if there are any known challenges or limitations specific to the China tenant setup, I’d appreciate insights on those as well.

Thank you in advance for your guidance!

Tilakram

[Meett]

Hello @Tilakram Add-on doesn’t support Azure china ByDefault so i am afraid if it will work or not.

[Tilakram]

Hello @Meett ,

Thank you for the quick response! I appreciate your insight.

If the Splunk Add-on for Microsoft Office 365 doesn’t natively support Azure China, are there any recommended workarounds or custom configurations (e.g., modifying inputs.conf or using custom scripts) that could enable data collection for China tenants?

Alternatively, are there other Splunk-supported methods or integrations that you’d recommend for ingesting Microsoft Office 365 logs from Azure China tenants? For instance, could a custom API integration with the Graph API endpoint https://microsoftgraph.chinacloudapi.cn be a feasible approach?

Looking forward to your thoughts!

Regards,
Tilakram

[Moni]

Hello, I am having similar issues. @Tilakram @Meett 
Were you able to fix it or know if 21V is supported within Splunk for log ingestion?

[PickleRick]

Not knowing the app itself I might say that if the Chinese tenants differ _only_ on the service URI, you might try to edit the app yourself and see if changing the URI(s) in the code helps.

The downside is that you'll have to do it again on each app upgrade and your version would be unsupported - in case something doesn't work you're on your own.