In my case I had same problem with some tenants "Domains" of Azure I fix it with these value in all management_activity. [splunk_ta_o365_management_activity://AzureActiveDirectory_DOMAIN] content_type = Audit.AzureActiveDirectory index = mso365 interval = 300 tenant_name = DOMAIN disabled = 0 number_of_threads = 8 --> I passed for the default 4 to 8, you have to put multiples of 4. request_timeout = 600 token_refresh_window = 3600 Regards. ... View more