I've noticed that this Add-on simply pulls the last 7 days of log data from the Azure API, but makes no effort to create a marker. Thus when I enable pulls, it just duplicates the log data over and over. I've tested this by pulling in the Audit.Exchange blobs and by watching a 2 hr time period in the past. I can see the event count going up for that range every time the Add-on fires. I also can run a streamstats to check for duplicate _raw,_time events, and I see them as well.
The following is added on line 117: // 86400 * 86400 + 86400
This should limit the duplicates, however, Microsoft still duplicates events on their side that this doesn't catch (by design), so using this search can help eliminate seeing duplicates (but doesn't help on the ingestion side):