Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk Add-ons
We’re excited to announce an important update about the Splunk-supported add-ons available for bringing your Microsoft data into Splunk. To ensure you benefit from the latest features, best practices, and full Splunk support, we are transitioning all Splunk Add on for Microsoft Azure inputs to Splunk supported Technology Add-ons: Splunk Add-on for Microsoft Cloud Services, Splunk Add-on for Microsoft Office 365, and Splunk Add-on for Microsoft Security
Why Are We Doing This?
The Splunk Add-on for Microsoft Azure enables comprehensive data collection from Microsoft Azure, including Microsoft Entra ID data, Azure Log Analytics, billing, inventory, and security information - while also providing alert actions such as stopping Azure VMs, adding users to groups, and dismissing security alerts. However, it’s not officially supported by Splunk and will no longer receive updates or maintenance. By moving to Splunk-supported add-ons, you’ll benefit from:
- Ongoing updates and maintenance
- Full Splunk support and documentation
- Compliance with best practices
- Improved compatibility with Microsoft’s evolving APIs
What’s Changing?
- The Splunk Add-on for Microsoft Azure will not be supported by its creators. It will remain available for download, but no further updates will be provided.
What Do You Need to Do?
If you’re currently using the Splunk Add-on for Microsoft Azure, we recommend you start migrating your data inputs as soon as possible. The process is manual, but we’ve prepared comprehensive guides to help you every step of the way.
Step-by-Step Migration Instructions
We’ve created a consolidated migration guide that walks you through migrating each input, including:
- Microsoft Entra ID (Users, Groups, Applications, Devices, Sign-ins, Audit, and Risk Detection)
- Azure Metrics, Subscriptions, Resource Groups, Virtual Networks, Compute, KQL Log Analytics
- Azure Billing and Consumption, Reservation Recommendations, Resource Graph, Topology
- Alert Actions (Add member to M365 Group, Stop Azure VM, Dismiss Azure Alert)
- Microsoft Graph Security API and Defender for Cloud data
For each input, you’ll find:
- Which Splunk-supported Add-on now handles it
- Step-by-step disablement of the old input and creation of the new one
- Direct links to official Splunk documentation for each data source
>>> Access the full migration guide here <<<
We also recommend bookmarking this guide for future reference!
What If I Need Help?
While this migration is not officially supported by Splunk Support as a unique service, our support team will have all migration documentation ready, and they will answer your questions. If you run into issues, please use your standard customer support channels.
What Happens to the Splunk Add-on for Microsoft Azure?
The Splunk Add-on for Microsoft Azure will remain downloadable for now, but no further updates or fixes will be released.
The documentation will be archived and will direct users to the migration guide and supported Add-ons.
Deprecation notes will be added to the Splunkbase page and the Add-on documentation.
Spread the Word
To ensure everyone is informed:
- We’ll add deprecation and migration notices to the Splunk Add-on for Microsoft Azure repository and documentation.
- This blog post will serve as your central migration resource.
We’re Here for You
We know migrations can be daunting, but moving to supported Splunk Add-ons sets you up for success. You’ll be better positioned for future Microsoft and Splunk enhancements, and your integrations will be fully supported.
Thank you for being a valued part of the Splunk community! If you have questions, don’t hesitate to reach out through your usual support channels.
