Getting Data In

Microsoft Azure Add on for Splunk (TS-MS-AAD v 3.1.1) error:309 | _Splunk_ Unable to obtain access token


Hello I am installing a fresh new install of this app to replace our old version (1.2.4)

I am using the same credentials as the old working version (client id, secret and tenant)

With the new app I get the error:


2021-03-30 09:17:26,598 ERROR pid=109928 tid=MainThread | _Splunk_ Unable to obtain access token
2021-03-30 09:17:26,596 DEBUG pid=109928 tid=MainThread | "POST /27776982-d882-41b2-95ac-322f28d5a2ce/oauth2/v2.0/token HTTP/1.1" 401 471
2021-03-30 09:17:26,372 DEBUG pid=109928 tid=MainThread | Starting new HTTPS connection (1):


When reverting to the old app it works fine and I am able to collect data.
We checked all the permissions and Azure settings. What else do we need to do to get this working with the new version.

Labels (1)
0 Karma


Hi @Azeemering ,

In the new Azure Addon version, the interface and settings have been changed. So if you are trying with the old local config like Passwords.conf&ta_ms_aad_settings.conf it will not work in the new version.

Try to do a fresh config and erase all the old configs.

Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...