Phantom - EWS for Office 365 app error when using Azure AD authentication (interactive) with Proxy

Applicability

Splunk SOAR

Description

Phantom version 4.10.3
EWS Office 365 App version 2.4.3

1. Install "EWS for office 365" in phantom
2. Configure Azure app as per instructions for the "EWS for office 365" app
3. Configure the phantom app as per instructions (Azure interactive) authentication
4. Click "Test Connectivity"
5. Copy the redirect URL to a new tab

Error Message:

Error retrieving OAuth Token: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): 
Max retries exceeded with url: /common/oauth2/token (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f46150410f0>: 
Failed to establish a new connection: [Errno -2] Name or service not known',))

 

Investigation

1. The failure is seen as soon as the admin consent is granted. 

2. The correct API/Permission has been configured. 
Office 365 Exchange Online

• EWS.AccessAsUser.All
• Mail.Read
• Mail.Read.All
• User.ReadBasic.All

3. The admin consent has been granted to the API/Permission. 

4. The token configuration for an access token and refresh token are enabled in Azure EWS for office 365.  

5. Confirmed that the secret value is configured instead of the secret id. 

6. Looking at the code, the issue seems to be in the following line:
 

request_handler.pyLine 41: def _get_oauth_token(self, code)

7. Applying the proxy configuration directly inside the code has resolved the issue. 
 

In request_handler.pyFrom:class Office365RequestHandler():…
   def _get_oauth_token(self, code):
       …
       body = {
          ‘grant_type’: ‘authorization_code’,
          ‘resource’: ‘https://outlook.office365.com/’,
          ‘redirect_uri’: redirect_uri, 
          ‘client_id’: client_id,
          ‘code’: code
          ‘client_secret’: client_secret
       }
       try:
           r = request.post(
                 request_url + ‘/token’,
                 data=body
           )To:class Office365RequestHandler():…
   def _get_oauth_token(self, code):
       …
       body = {
          ‘grant_type’: ‘authorization_code’,
          ‘resource’: ‘https://outlook.office365.com/’,
          ‘redirect_uri’: redirect_uri, 
          ‘client_id’: client_id,
          ‘code’: code
          ‘client_secret’: client_secret
       }
       try:
           r = request.post(
                 request_url + ‘/token’,
                 data=body,
                 proxies = {‘http’:’http://<proxy>’,’https’:’https://<proxy>’}
           )

Resolution

Applying the proxy configuration directly inside the code has resolved the issue. 

From:
 

class Office365RequestHandler():…
   def _get_oauth_token(self, code):
       …
       body = {
          ‘grant_type’: ‘authorization_code’,
          ‘resource’: ‘https://outlook.office365.com/’,
          ‘redirect_uri’: redirect_uri, 
          ‘client_id’: client_id,
          ‘code’: code
          ‘client_secret’: client_secret
       }
       try:
           r = request.post(
                 request_url + ‘/token’,
                 data=body
           )

To:
 

class Office365RequestHandler():…
   def _get_oauth_token(self, code):
       …
       body = {
          ‘grant_type’: ‘authorization_code’,
          ‘resource’: ‘https://outlook.office365.com/’,
          ‘redirect_uri’: redirect_uri, 
          ‘client_id’: client_id,
          ‘code’: code
          ‘client_secret’: client_secret
       }
       try:
           r = request.post(
                 request_url + ‘/token’,
                 data=body,
                 proxies = {‘http’:’http://<proxy>’,’https’:’https://<proxy>’}
           )

Jira PAPP-18459 has been raised to fix this in future EWS Office 365

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release