I did follow that when assigning permissions to the Azure AD app registration. Good call on the AAD P1 license. Let me check on the AAD license! ... View more

@jconger  Does the Azure AD inputs (audit and signins) require a subscription even if the logs don't go through the EventHub resource?  So far we've configured an App Registration with the recommended permissions (application type) assigned, and our tenant doesn't have any subscriptions or other resources. It's barebones with Azure AD only. When we configured the inputs using the Azure Add-on for Splunk We tried 3 inputs: 1) Users 2) audit 3) signin However, only Users input worked. Other inputs are getting the 403 error. Would you happen to know why? Maybe other inputs require a subscription in place? ... View more

We tried creating a new Azure app under the App Registrations, now we're getting unauthorized access errors. ... View more

For both sign-ins and audit inputs. ... View more