Hi @mlichtjx ! There are quite a few attributes 😁 and it will likely be different than what we ingest (e.g. we have some sync'ed attributes with our on-premise infrastructure).  However, I would recommend that you try using the following tool:  Microsoft Graph Explorer  to replicate the API query that the add-on uses to pull user data.  You might have to meddle w/ some permissions in your azure environment to ensure that the user making the query has permissions to pull that data from Azure.  To find what url the add-on is using, check out the file in the addon's /bin directory (TA-MS-AAD/bin/), named "input_module_MS_AAD_user.py".  In our use-case, we modified the query with some filters to exclude certain users. Once we got the data in (we run it on a 24 hour interval), I wrote a scheduled search that would transform the data into a table into ES-relevant fields, then piped it to "outputlookup" to write it to the CSV that ES leverages for it's identity lookup table. Hope this helps!  Let me know if you have any additional questions! ... View more

Found a solution, was working with version 2.1.0: This code is a snippet from "input_module_MS_AAD_user.py", located at $SPLUNK_HOME/etc/apps/TA-MS-AAD/bin First, I found the syntax error in the second item, "nusers...". After changing that, the query was working successfully, but returning no data. I then tried the v1.0 version and success! Our organization has >600K users and the query took over an hour. EDIT: After additional troubleshooting I simplified the answer even more. I thought I had found two problems, but actually only one. The second part I thought that also needed fixing was the version of the API it was using. I thought that v1.0 had to be used, and while it does work, and pulls significantly less fields than it's beta variant, and is not compatible with the Microsoft Azure App for Splunk. I thought it wasn't working because the BETA API responses were yielding an HTTP 200 w/ 0 bytes transferred....but reviewing logs in our Splunk environment, it was successfully querying/ingesting the data. ... View more