Does Splunk Add-on For M365 app work in GCC HIGH tenants?

[TestAdminHorst]

We are getting the following error when trying to ingest EXO mail logs into splunk using the add-in.

line 151, in __call__ raise ValueError("{} endpoint for found".format(name)) ValueError: MessageTrace endpoint for found
if not endpoint:

raise ValueError("{} endpoint for found".format(name))


Does the Splunk add-on for M365 work when reaching out to GCC HIGH endpoints? or is the add-on not configured for such connections? 

[livehybrid]

Hi @TestAdminHorst 

There is a good explanation around this and workaround at https://splunk.my.site.com/customer/s/article/The-Splunk-Add-on-for-Office-365-is-not-collecting-any... which is worth looking at. 
Ultimately you might have more success by sending the logs from 365 to an Azure Event Hub and then ingest them that way. 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

[PrewinThomas]

@TestAdminHorst 

This add-on is primarily designed for standard Microsoft 365 environments. GCC High and DoD tenants operate in different cloud environment with restricted endpoints. So this standard add-on endpoints may not work with GCC High.

#https://learn.microsoft.com/en-us/office/dev/add-ins/publish/government-cloud-guidance

But you can consider having custom script for gcc high endpoints.
#https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-u-s-government-gcc-high-end...

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!