I am trying to use the beta endpoint in the AAD user input to get the user list from Azure. This input only pulls 500k user entries and Splunk internal logs shows 401 error after several 200 response for the exact same URL.
I am not using the v1.0 endpoint in input configuration as it only pulls specific attributes form AAD whereas beta one pulls all the attributes.
I am trying to use the beta endpoint in the AAD user input to get the user list from Azure. This input only pulls 500k user entries and Splunk internal logs shows 401 error after several 200 response for the exact same URL. I am not using the v1.0 endpoint in input configuration as it only pulls specific attributes form AAD whereas beta one pulls all the attributes.
Error from Splunk below.
2023-10-29 04:28:02,017 DEBUG pid=2549891 tid=MainThread file=connectionpool.py:_make_request:465 | https://graph.microsoft.com:443 "GET /beta/users?$skiptoken= HTTP/1.1" 401 None
2023-10-29 04:28:00,685 DEBUG pid=2549891 tid=MainThread file=connectionpool.py:_make_request:465 | https://graph.microsoft.com:443 "GET /beta/users?$skiptoken= HTTP/1.1" 200 None
note: There are many 200 response code logs followed by one 401 and then no more logs. and this is same in all the logs.