Microsoft Azure Add on - ERROR403 Client Error: Forbidden

[klowk]

Hi all,

we configured the Input Microsoft Azure Active Directory Sign-ins in Microsoft Azure Add on and get always following error message.

10-27-2020 11:05:23.938 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_signins.py" ERROR403 Client Error: Forbidden for url: https://graph.microsoft.com/beta/auditLogs/signIns*

We configured it as described in the App itself app/TA-MS-AAD/aad_app_registration.

Can someone explain what is still missing to get the data in?

kind regards

Kathrin

[mattcosa]

Hey did you ever resolve? There's a stack of threads for other users with the same error.

Client Error: Forbidden for url: https://graph.microsoft.com/beta/auditLogs/signIns?$

I've setup the permissions per http://bit.ly/Splunk_Azure_Permissions.Specifically:

Microsoft Azure Active Directory Sign-ins

Microsoft Graph

(Application) AuditLog.Read.All - Read all audit log data

I have tried with two tenancies both resulting the same 403.

 
Other reference threads:
https://community.splunk.com/t5/All-Apps-and-Add-ons/Microsoft-Azure-Add-on-for-Splunk-version-confi...

[LCelley]

We solved this problem in our environment by adding Directory.Read.All as an app permission.

Microsoft lists both Directory.Read.All and AuditLog.Read.All as a requirement to be able to use graph to grab sign in logs.
https://docs.microsoft.com/en-us/graph/api/signin-list?view=graph-rest-1.0&tabs=http

[mattcosa]

🙏 @LCelley 

This config change worked with Directory.Read.All, however I can't seem to get this working on a second AAD.

I'm investigating if the cause is related to the AAD P1 or P2 entitlement (i.e. doesn't have it). 

There's some confusion buried in the Github issue list on that article:
https://github.com/microsoftgraph/microsoft-graph-docs/issues/10987

[mattcosa]

For completeness - Azure Active Directory P1 or P2 licensing is required for the signIns sourcetype.

I've also raised a Github issue with Microsoft to address consistency errors between documentation that discusses the prerequisite license requirement. 

https://docs.microsoft.com/en-us/graph/api/signin-list?view=graph-rest-1.0&tabs=http

https://docs.microsoft.com/en-us/graph/api/resources/azure-ad-auditlog-overview?view=graph-rest-1.0#...

[klowk]

We had still no resolution for this error. Our workaround is to send these events over the Eventhub.