Is it possible to use Splunk to Alert on too many users per license or expiring licenses for Office365?

[tsomod]

Well the title says it all, I want to create an Alert for licenses that are approaching the max amount of users or are about to expire in Office365. Does anyone have any good ideas? Thank you in advance 🙂

[guarisma]

You can see if that information is pulled by the Splunk Add-on for Microsoft Office 365 (https://docs.splunk.com/Documentation/AddOns/released/MSO365/About) or see if the information can be obtained via an API call.