Hi - We have the Splunk Add-on for Microsoft Cloud Services installed and are currently collecting Azure "Activity Logs" into Splunk. However, we'd also like to capture the Azure (portal.azure.com) -> Azure Active Directory -> "Sign-Ins" data into Splunk. Can anyone advise as how to achieve this? Many thanks, Tom ... View more

We are trying to configure the Microsoft Cloud Services addon and are behind an NTLM proxy. From what I can see, the MS account and input are configured fine, however we are getting errors in the splunk_ta_microsoft-cloudservices_azure_audit.log along the following lines and no data is being ingested. ConnectionError: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: On checking the connections I cannot see this even making connections with our proxy, even though we have configured it via the proxy tab in the addon and is configured normally via the splunk-launch.conf file system wide. For fun I did remove the entries in the addon proxy tab but that made no difference. Has anyone else seen issues such as this? Thanks! ... View more