I'm not sure if this is the correct board.
We run Splunk 8.2.1 on Linux. Lately a number of our domain users have been logging in via MFA to Azure. These are domain users logging in using domain credentials, but the logon is never recorded in the domain controller logs and as a result it's not see in the Splunk reports
I have not been able to get much info from the Azure folks. I'm told that Azure, although it verifies the credentials, does not close the loop back to the domain controller. No solution is offered. I have to believe there is more to the story.
Has anyone encountered this issue?
