Configure an integration application in Azure AD for the Splunk Add-on for Microsoft Office 365

In order to gather data from the Office 365 Management Activity API and the Office 365 Service Communication API using this add-on, you must first create an integration application in Azure AD. This application securely authenticates the Splunk Add-on for Microsoft Office via the OAuth2 protocol, so that it can access and gather the data according to the services and permission levels that you specify.

In order to create an integration application, you need the following prerequisites:

• A Microsoft Azure account with administrator permissions to delegate roles to the application user. Your Microsoft Azure subscription must be linked with your Office 365 subscription by using the same login id.
• A security token for the Microsoft Cloud Application Security Portal. See the Managing API tokens topic in the Microsoft documentation.

Create an application in Microsoft Azure AD

1. Follow the instructions in the Create an Azure AD application topic in the Microsoft documentation to create an integration application.
2. When creating your application, make a note of the following parameters. They will be needed to Configure a Tenant in the Splunk Add-on for Microsoft Office 365.
   • Directory ID (Tenant ID)
   • Application ID (Client ID)
3. Set the Application permissions in the API Permissions > Add a permission pane of the Azure Active Directory Office 365 Management API configuration. These permissions are required for the Splunk Add-on for Microsoft Office 365.
   

   API/Permissions name	Description	API Technology Name
   ServiceHealth.Read.All	Read service health information for your organization. If upgrading to version 3.0.0 or later, disable ServiceHealth.Read.All in Office 365 Management APIs, and enable ServiceHealth.Read.All in Microsoft Graph.	Microsoft Graph
   ServiceMessage.Read.All	Read service message information for your organization.	Microsoft Graph
   ActivityFeed.Read	Read activity data for your organization	Microsoft Office 365 Management
   AuditLog.Read.All	Read all audit log data	Microsoft Graph
   Reports.Read.All	Read all usage reports	Microsoft Graph
   ReportingWebService.Read.All	Read Message Trace data	Microsoft Reporting WebService
   ActivityFeed.ReadDlp (Optional)	Read DLP policy events including detected sensitive data.	Microsoft Office 365 Management

   Accessing DLP policy events requires an additional Microsoft Azure Active Directory subscription. Refer to the Microsoft Azure Active Directory documentation for more information.

4. Click Save after you change permissions.
5. Click Grant admin consent for <tenant name>.
6. In Certificates & secrets, under Client secrets, create a new client secret.
7. In the Value column, make a note of the generated value. This is the Client Secret. If you lose this value, you have to generate a new one.