In the Azure Splunk Enterprise Application, under Users and Groups, I add my Azure security groups that have the members that want access inside them. Then you go into the Single sign-on portion and review the Attributes and Claims. You should have an entry that says "groups" as the claim name. Under the value, it should be set to "Groups assigned to the application" and Source Attribute as "Group ID". This will send just the groups assigned to the application that the sign-in user is a part of instead of every single group which might go over the limit. In the splunk side, you enter your AD group name or sometimes with other versions it has to be the object-id of the azure group and then map it to the correct internal splunk role you have created for that team.   ... View more

Mine was failing also until I added the parameter above and install went through fine. ... View more

This is to remove a SAML user that has left the organization. Before deleting, reassign any objects, reports, and alerts that user may have.   curl -k -u <adminaccount>:<password> --request DELETE https://<instancename>.splunkcloud.com:8089/services/admin/SAML-user-role-map/username@domain.com ... View more

This is done through Azure group filtering options in the Enterprise App for Splunk that you created. Add the security groups that you want to give access to the Splunk App in users and groups Go into Single-signon, click edit Attributes and Claims. Click on the first claim option that was automatically created usually user.groups [SecurityGroup] Change from "Security groups" to "Groups assigned to the application". No more issues with users that have large membership groups. Not sure why I didn't find this answer anywhere else. @bpdubs  ... View more

For anyone getting errors, you should update the query from OLD URL: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate NEW URL: https://outlook.office365.com/ecp/MessageTrace/MessageTraceResults.aspx?$filter=StartDate   The url base in the SPL should also be udpated to:  https://outlook.office365.com/ecp ... View more