All Apps and Add-ons

Why are the management_api tokens failing to renew in Splunk Add-on for Microsoft Cloud Services?

dimarra
Explorer

It appears that the management_api access token do not renew during normal operations and requires a restart of the splunk instance to force a renewal. These tokens are short-lived (59 min 59 sec). After which no ms:o365:management sourcetype data are successfully retrieved. Waited several hours before restarting. No data was retrieved until a restart was performed which resumed the data ingestion for this sourcetype.

Has anyone observed this behavior and resolved this successfully?

Is this a known TA bug?

Thanks

jconger
Splunk Employee
Splunk Employee

Did you configure a certificate? The certificate it used in the background to refresh API tokens -> https://msdn.microsoft.com/en-us/office-365/get-started-with-office-365-management-apis#configure-an...

For details on configuring a certificate, see this blog (step 29) https://www.splunk.com/blog/2017/07/27/splunking-microsoft-cloud-data-part-1.html

You can check the status of your certificate by going to O365 Troubleshooting tab in the add-on. You should see the text "Auto-generated and verified as valid" or similar depending on whether you used generated certificate or your own certificate.
,Did you configure a certificate? The certificate it used in the background to refresh API tokens -> https://msdn.microsoft.com/en-us/office-365/get-started-with-office-365-management-apis#configure-an...

For details on configuring a certificate, see this blog (step 29) https://www.splunk.com/blog/2017/07/27/splunking-microsoft-cloud-data-part-1.html

You can check the status of your certificate by going to O365 Troubleshooting tab in the add-on. You should see the text "Auto-generated and verified as valid" or similar depending on whether you used generated certificate or your own certificate.

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...