Missing Microsoft Entra ID Sign-in Logs in Splunk Using the Splunk Add-on for Microsoft O365 V4.6.0 and Older

Applicability

Description

While using an older version of the Splunk Add-on for Microsoft O365 (v4.2.0), users experienced missing Sign-in logs. This issue is caused by the lack of pagination, which limits indexing to only first 1000 events per API call.
An upgrade to the latest available version at the time, v4.6.0, didn't resolve as the issue persisted. Since the issue was also present in v4.6.0, Splunk initiated an investigation to resolve the problem.

Investigation

The problem was identified when sign-on events were arriving late in the Azure portal. However, the Splunk Add-on for Microsoft O365 (TA) had already collected data for the specified time period and continued collecting data for the most recent period. This led to certain events being missed as they arrived after the time window the TA had already processed.

As a result, Splunk Add-on for Microsoft O365 was not able to ingest these late-arriving events, causing gaps in the data for the specified time period. 

Resolution

To resolve this, a new feature was added called “Delay Throttle (minutes)” parameter in the Audit Sign-in input. The end date for data collection is now calculated based on the current UTC time minus the delay throttle minutes. For example, if the current UTC time is 2024-12-15T00:00:00 and the delay throttle is set to 10 minutes, the TA will only collect data until 2024-12-14T50:00:00, allowing subsequent input executions to account for late-arriving events.

This issue has been fixed in the latest version 4.7.0.

Related Links

Splunk Add-on for Microsoft O365