I recently installed the Splunk Add-on for Microsoft Security to Splunk Cloud and configured it to connect via API to an app registered in Azure. The data is still not loading on the Security section of the Microsoft 365 App for Splunk. I checked in Azure and Incident.Read has permissions enabled on the app. The Splunk documentation says that I should go to Add-on > Inputs and click Create New Input to complete the configuration. When I go to the Inputs page I get the message: "Failed to load Inputs Page This is normal on Splunk search heads as they do not require an Input page. Check your installation or return to the configuration page. Error: Request failed with status code 500". I am not sure how I can fix this as I have no other place to put the endpoints as Inputs.
... View more
