The official documentation has been updated with the known issue Reference: https://docs.splunk.com/Documentation/AddOns/released/MSO365/Releasenotes Known issues Version 4.2.1 of the Splunk Add-on for Microsoft Office 365 contains the following, if any, known issues: Customers will experience a delay in event ingestion after v4.2.0 due to KVstore performance on cloud architecture. Date filed Issue number Description 2023-04-13 ADDON-61818 Repeated 401 Client errors when attempting to pull message trace data. Workaround: None Known ... View more

Same, raising a support ticket with Splunk atm. Funny thing is the continuous message trace is still running even though it's constantly throwing 401 errors, but only 2000 events at a time and intermittent using all default settings in the input. Using Azure Enterprise App with ID & Secrets ... View more