Getting Data In

Microsoft Azure Add on for Splunk (TS-MS-AAD v 3.1.1) error:309 | _Splunk_ Unable to obtain access token


Hello I am installing a fresh new install of this app to replace our old version (1.2.4)

I am using the same credentials as the old working version (client id, secret and tenant)

With the new app I get the error:


2021-03-30 09:17:26,598 ERROR pid=109928 tid=MainThread | _Splunk_ Unable to obtain access token
2021-03-30 09:17:26,596 DEBUG pid=109928 tid=MainThread | "POST /27776982-d882-41b2-95ac-322f28d5a2ce/oauth2/v2.0/token HTTP/1.1" 401 471
2021-03-30 09:17:26,372 DEBUG pid=109928 tid=MainThread | Starting new HTTPS connection (1):


When reverting to the old app it works fine and I am able to collect data.
We checked all the permissions and Azure settings. What else do we need to do to get this working with the new version.

Labels (1)
0 Karma


Hi @Azeemering ,

In the new Azure Addon version, the interface and settings have been changed. So if you are trying with the old local config like Passwords.conf&ta_ms_aad_settings.conf it will not work in the new version.

Try to do a fresh config and erase all the old configs.

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!