Getting Data In

Microsoft Azure Add on for Splunk (TS-MS-AAD v 3.1.1) error:309 | _Splunk_ Unable to obtain access token


Hello I am installing a fresh new install of this app to replace our old version (1.2.4)

I am using the same credentials as the old working version (client id, secret and tenant)

With the new app I get the error:


2021-03-30 09:17:26,598 ERROR pid=109928 tid=MainThread | _Splunk_ Unable to obtain access token
2021-03-30 09:17:26,596 DEBUG pid=109928 tid=MainThread | "POST /27776982-d882-41b2-95ac-322f28d5a2ce/oauth2/v2.0/token HTTP/1.1" 401 471
2021-03-30 09:17:26,372 DEBUG pid=109928 tid=MainThread | Starting new HTTPS connection (1):


When reverting to the old app it works fine and I am able to collect data.
We checked all the permissions and Azure settings. What else do we need to do to get this working with the new version.

Labels (1)
0 Karma


Hi @Azeemering ,

In the new Azure Addon version, the interface and settings have been changed. So if you are trying with the old local config like Passwords.conf&ta_ms_aad_settings.conf it will not work in the new version.

Try to do a fresh config and erase all the old configs.

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.