The Azure Add on seems to be working well with the exception of how behind it is. Specifically for the signins (sourcetype azure:aad:signin). I can see in the add on logs on the heavy forwarder, that it is pulling in data, but the most recent event is May 4th as of now. So it appears as though it's pulling in data as of 30 days ago, but it's just very slowly making headway.
My input for the sign ins is set to a 900 second interval (I messed around with this a little bit but didn't really seem to help). The Query limit is set to 0 and the query backoff throttle is set to 5. Any suggestions on how to speed this up?
