I got it resolved; apparently I need to learn to read better :). You can't install the Add-on in Splunk Cloud, it has to be on a heavy forwarder.  Once I did that and fixed the webhook (details here: https://community.splunk.com/t5/All-Apps-and-Add-ons/Ingesting-logs-from-Microsoft-Teams/m-p/506860/highlight/true#M62281), everything is working fine!  Thanks! ... View more

Having literally just gone through this, I'll try to help!  What was broken for me (and giving the same headache) sounds like exactly what you're seeing. If you're getting user reports then your app is correct and the permissions are correct.  What is broken is your either your subscription, webhook, or CDR.  For me, it was the webhook/subscription because they both are interconnected. First, the Webhook.  The webook has to live on the HF where the Add-on is installed.  The port you give it must be accessible from the public internet (because that's how teams works) and MUST be SSL.  Otherwise nothing will work.  Easiest way to test is to go to the public IP address (from something on the internet) and test https://<webhookName>:<portdefined> and you should get: {"success": true} My config looks like this:                 When I got my webhook URL (via https, hostname, port) I get a success. Once that's done, you configure the Subscription to reference the correct webhook URL. After that, data should start flowing.   Hope this helps, hit me up if you need more help with it! ... View more