O365 Event Source Creation

garrett_neatherlin · May 20, 2020, 5:04pm

Hi All,

I am having trouble setting up an O365 Event source. I have set these up numerous times and have never come across the below error:

AADSTS650051: Application ‘4fff4860-38e3-403e-ac9d-31acaea16ad5’ is requesting permissions that are either invalid or out of date. Trace ID: 0b4b420e-6511-4ace-ae86-3504b277be00 Correlation ID: 5eb4a92e-fe29-4207-a266-05efbda02555 Timestamp: 2020-05-20 15:34:07Z

It looks like a trust issue between R7 and O365. Has anyone come across this before? Or have a solution?

Thank you,

joey_mcadams · May 20, 2020, 5:34pm

Did your secret key expire? That might cause errors like that.

garrett_neatherlin · May 20, 2020, 7:59pm

thanks for your response. I dont believe so, we just stood up the collector this morning and now trying to add to the event source today as well.

Aniket-Menon · May 21, 2020, 11:03am

@garrett_neatherlin this might be resolved faster with our Support team. Looks like you might have hit a configuration issue that might need some log analysis. You can open up a case here: Rapid7 Support

garrett_neatherlin · May 21, 2020, 3:54pm

Thanks @Aniket-Menon, already have one in.

Aniket-Menon · May 24, 2020, 2:56am

@garrett_neatherlin Just checking in. Did this get resolved?

robert_carlson · May 28, 2020, 10:50pm

Hello.
I had the exact same problem from May 24-may 28. Several attempts. It resolved itself today. I opened a ticket with support, but it didn’t get a response yet. O365 events can be added now.

david_smith1 · June 15, 2020, 6:55pm

For context this was a known issue with Rapid7 and Microsoft due to permissions of the IDR Connector, it has since been fixed.