Something the app documentation does not specifically mention is that in Settings > Advanced search > Search macros you have to change the App drop-down to "Microsoft 365 App for Splunk" before you'll see the m365_default_index macro. If that doesn't help, it could also be a permission issue.
