Hi Jconger, I am working with one of our security administrators to capture O365 Audit Data using the Splunk Add On for O365. I created a Azure Application in our cloud tenant and provided it the Office 365 Graph API Permissions Read Activity data for your organization Read Service Health for your organization Read Activity Reports The application authenticates but does not get all data that I can see in the Audit Search Log which is found in the O365 Security and Compliance portion of the Portal. Is there something missing on the Azure Permission Side? I would have thought this would provide logging for activity related to Adding and removing licences Blocking user sign in creating/deleting a user in the cloud adding roles/groups to users etc. kevin C. ... View more

Is the role group creation for the group mentioned on the Splunk side or the Azure Application Side? I only support the Azure Application Side. I don't have insight on how the Splunk Side was configured. Are the Role Groups mentioned: "ViewOnlyAuditLogs" "ViewOnlyConfiguration" "ViewOnlyRecipients" Set up in the the Azure Tenant Somewhere? Thanks, Kevin C. ... View more