HTTPError: 400 Client Error for signIns

Anthony Dehn 1

I have recently starting receiving a 400 error on my Splunk Add-on for Microsoft Azure signIns input for https://graph.microsoft.us/v1.0/auditLogs/signIns. Are there any new known issues with reaching the signIns endpoint for graph.microsoft.us? I am not having any issues with the commercial endpoint for signIns.

There's no issues with pulling the directoryAudit input for https://graph.microsoft.us/v1.0/auditLogs/directoryAudits. All basic troubleshooting steps have been taken.

Akshay-MSFT 16,026 Reputation points Microsoft Employee

2022-08-18T06:38:35.933+00:00

Hello @Anthony Dehn ,

I am researching on this.
Akshay-MSFT 16,026 Reputation points Microsoft Employee

2022-08-19T14:43:34.827+00:00
Hello @Anthony Dehn ,

From the description I could understand that you are getting no response (400) while querying the sign-in logs with .US endpoint.
I tried to test this in my lab with (Splunk cloud) commercial endpoints and found no issues. I would like to check the behavior in your environment. I could see two different endpoints being called for audit and signins.

I would like to understand the following:

What index, source or source type are you using to query the signin. (Screenshot like above)

What are the API permissions you gave to the registered App in AAD. (Screenshot of API permissions from AAD)

What input attributes have you defined for Input (Screenshot like below)

Where were you able to see the error (a screenshot of same would help).
Akshay-MSFT 16,026 Reputation points Microsoft Employee

2022-08-22T14:54:45.933+00:00

Hello @Anthony Dehn ,

Hope you got a chance to see my response above. Would appreciate your response on queries above to drill down the issue.