Needs a lot of more context from your side but generally speaking the add-on makes a checkpoint based off an offset value that is present in the data, which helps it to recognize as to what it pulled the last time and start ingesting the next log to avoid duplication. Which also answers your other question, how far is the add-on scanning the data.
To identify your issue, a lot more context about the integration would be needed but since you are using Splunk_TA_microsoft-cloudservices, I'd recommend opening a support case with Splunk and submitting a diag file of the server where the add-on is hosted and working. They will be able to help you out.
Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
