O365 Event Source Creation

Hi All,

I am having trouble setting up an O365 Event source. I have set these up numerous times and have never come across the below error:

AADSTS650051: Application ‘4fff4860-38e3-403e-ac9d-31acaea16ad5’ is requesting permissions that are either invalid or out of date. Trace ID: 0b4b420e-6511-4ace-ae86-3504b277be00 Correlation ID: 5eb4a92e-fe29-4207-a266-05efbda02555 Timestamp: 2020-05-20 15:34:07Z

It looks like a trust issue between R7 and O365. Has anyone come across this before? Or have a solution?

Thank you,

Did your secret key expire? That might cause errors like that.

thanks for your response. I dont believe so, we just stood up the collector this morning and now trying to add to the event source today as well.

@garrett_neatherlin this might be resolved faster with our Support team. Looks like you might have hit a configuration issue that might need some log analysis. You can open up a case here: Rapid7 Support

Thanks @aniket_menon, already have one in.

@garrett_neatherlin Just checking in. Did this get resolved?

Hello.
I had the exact same problem from May 24-may 28. Several attempts. It resolved itself today. I opened a ticket with support, but it didn’t get a response yet. O365 events can be added now.

For context this was a known issue with Rapid7 and Microsoft due to permissions of the IDR Connector, it has since been fixed.