After receiving same error, i have switched from user account to to app account and its working again. Check if app has proper permissions according to:  https://www.michev.info/blog/post/4067/modern-authentication-oauth-support-for-the-reporting-web-ser... Especially: "Remember that if you are running in the delegate permissions model, the user will need to have an appropriate admin role assigned as well. The supported roles for the Reporting Web Service are Global Reader and Security Reader." and "ReportingWebService.Read.All for application ones, can only be found under the Office 365 Exchange Online resource. As Microsoft has since hidden the relevant entry under the Request API permissions pane, you will have to follow the instructions from this article to get to it." After switching to OAuth it went form 401 to 403, and after setting all roles and permissions right from 403 to working. All using following splunk app : Splunk Add-on for Microsoft Office 365 splunk_ta_o365 4.2.1   With input Message Trace. ... View more