Picking your brain - Splunk Add-on for Microsoft Office 365 - No Exchange Message Trace activity

[jorge_1800]

Hello there, we're in process of deploying Splunk Cloud. We have installed the Microsoft Office 365 App for splunk along with all the required add-ons. The app is working as intended except that we're not getting any Message Trace data. We followed the instructions to properly setup the the Add-on Input and assigned the API permissions on the Azure side. For whatever reason we're still not getting any Trace Data. It looks like problem it's on the Azure side, we have assigned the appropriate API permissions as stated in the documentation. Is there anything else that needs to be setup on the Azure - or Splunk side to get Exchange Trace data?

We followed this instructions for Splunk add-on for Microsoft Office 365 integration.

https://docs.splunk.com/Documentation/AddOns/released/MSO365/ConfigureappinAzureAD

Any help would be highly appreciated. 

[jconger]

The Message Trace input requires an additional step that isn't needed for the other inputs.  Did you add the Azure AD app registration to one of the following IAM roles?

• Exchange Administrator
• Global Administrator
• Global Reader role (recommended)

https://docs.splunk.com/Documentation/AddOns/released/MSO365/Configureinputmessagetrace

[jorge_1800]

Hello jconger,

Thanks for the comment. My system admin did the registration and added the permissions during the original setup.  We're not getting any message trace data. I can ask him to double-check the roles, but as far as I know, it was done properly.