• Support
  • Forums
  • Blogs
A New Community Experience is Coming! For more information, please see our announcement.

O365 Azure AD Login Event

cschoenwettercschoenwetter

New Life Form
I recently noticed that the Office 365 integration is no longer syncing Azure AD Login Events for a few different USM Anywhere deployments. Looking at the job scheduler, I'm seeing the below entry whenever the scan is run:

ScanOffice365AuditAzureActiveDirectory    This job (ScanOffice365AuditAzureActiveDirectory) was already running.

As opposed to the successful entries for other Office 365 scans:

ScanOffice365AuditExchange    This job (ScanOffice365AuditExchange) has finished: Audit Exchange Events collected successfully: 0 events processed

The Azure Active Directory audit seems to have started failing on 9/24/2018. I'm inclined to think a change to the Azure API is the culprit, so I have a ticket open with Microsoft. Has anyone else experienced this?

Share post:

Answers

  • Did you ever get anywhere with Microsoft support on this?  We're a relatively new AlienVault customer and during our trial run experienced no issues with O365 Azure AD data syncing into AlienVault.  Now that we've put AlienVault into production we're experiencing the exact same issue as yourself and so far AlienVault support hasn't been of any help at all.

    The only method I've been able to sync data with O365 is to manually enter credentials again into the O365 integration app which seems to force a sync but other than that, data is no longer automatically syncing.

    Pretty frustrating as the Azure AD integration was one of the main reasons we purchased the product.
  • We are a new customer and our O365 logs just stopped and is no longer in the Data Source Plugin. Support has been very very slow to respond, we have had a case open for more than 3 weeks for this.
Sign In or Register to comment.