Add-on Microsoft Office 365: what is the most efficient way of tracking what the token expiry date is?

[tomapatan]

Recently we needed to update the Client Secret for one of our tenants and I wanted to ask what is the most efficient way of tracking what the token expiry date is  and to create an alert in Splunk?

I had a look at the logs and couldn`t find anything to indicate when the access token is about to expire.

[PaulPanther · Accepted solution]

1. Easiest but static & manual way could be filling token name and expiry date into a lookup table & set a scheduled search on top

2. Setup a scripted input and call the API endpoint to get the expiry date for the token, write the information in a index, save them into a lookup table & set a scheduled search on top