Skip to content

Migration matrix for legacy Microsoft add-ons

Use this guide for migrating inputs from Splunk Add-on for Microsoft Azure to the following add-ons:

  • Splunk Add-on for Microsoft Cloud Services
  • Splunk Add-on for Microsoft Office 365
  • Splunk Add-on for Microsoft Security

If you are specifically migrating Microsoft Entra ID logs to the Splunk Add-on for Microsoft Cloud Services through Azure Event Hub, see Migrate from the Splunk Add-on for Microsoft Azure for the MSCS-specific steps.

Use the following recommended migration path when moving away from the legacy add-ons:

  • Migrate Microsoft Entra ID metadata inputs such as Users, Groups, Applications, and Devices to the Splunk Add-on for Microsoft Office 365.
  • Migrate high-volume Microsoft Entra ID and Microsoft Defender for Cloud logs to Azure Event Hub ingestion with the Splunk Add-on for Microsoft Cloud Services, or Splunk Data Manager for Splunk Cloud Platform deployments.
  • Migrate the legacy Microsoft Graph Security API input to the Splunk Add-on for Microsoft Security by using the Microsoft Defender for Endpoint Alerts input.

Inputs and destinations

Feature/input Migration destination Reference link
Microsoft Entra ID Interactive Sign-ins Event Hub + Splunk Add-on for Microsoft Cloud Services/Data Manager Details
Microsoft Entra ID Users Splunk Add-on for Microsoft Office 365 Details
Microsoft Entra ID Groups Splunk Add-on for Microsoft Office 365 Details
Microsoft Entra ID Applications Splunk Add-on for Microsoft Office 365 Details
Microsoft Entra ID Devices Splunk Add-on for Microsoft Office 365 Details
Microsoft Entra ID Audit Event Hub + Splunk Add-on for Microsoft Cloud Services/Data Manager Details
Microsoft Entra ID Risk Detection Event Hub + Splunk Add-on for Microsoft Cloud Services/Data Manager Details
Microsoft Graph Security API Splunk Add-on for Microsoft Security (Defender for Endpoint Alerts) Details
Metrics Splunk Add-on for Microsoft Cloud Services Details
Security Center (Defender for Cloud) Event Hub + Splunk Add-on for Microsoft Cloud Services/Data Manager Details
Subscriptions Splunk Add-on for Microsoft Cloud Services Details
Resource Groups Splunk Add-on for Microsoft Cloud Services Details
Virtual Networks Splunk Add-on for Microsoft Cloud Services Details
Compute Splunk Add-on for Microsoft Cloud Services Details
Azure KQL Log Analytics Splunk Add-on for Microsoft Cloud Services Details
Azure Billing and Consumption Splunk Add-on for Microsoft Cloud Services Details
Azure Reservation Recommendation Splunk Add-on for Microsoft Cloud Services Details
Azure Resource Graph Splunk Add-on for Microsoft Cloud Services Details
Azure Topology (automatic/manual) Splunk Add-on for Microsoft Cloud Services Details
Add member to Microsoft 365 Group (alert action) Splunk Add-on for Microsoft Office 365 Details
Stop Azure VM (alert action) Splunk Add-on for Microsoft Cloud Services Details
Dismiss Azure Alert (alert action) Splunk Add-on for Microsoft Security Details

Migration details

Microsoft Entra ID Interactive Sign-ins

The recommended migration path is to send Microsoft Entra ID sign-in data to an Azure Event Hub and collect it with the Splunk Add-on for Microsoft Cloud Services, or with Splunk Data Manager for Splunk Cloud Platform deployments. This avoids the throttling limits of the legacy direct collection path.

Microsoft Entra ID Users

This input is migrated to the supported Splunk Add-on for Microsoft Office 365. This is the recommended destination for Microsoft Entra ID metadata collection.

  1. Deactivate the existing input in the Splunk Add-on for Microsoft Azure.
  2. In the Splunk Add-on for Microsoft Office 365, select Create New Input and then select Microsoft Entra ID Metadata to create a new input.
  3. Select the Users option in the “Microsoft Entra ID Type” parameter.
  4. Save the input.

For more information, see Splunk Add-on for Microsoft Office 365 – Microsoft Entra ID Metadata input reference document: Configure Microsoft Entra ID Metadata Inputs.

Microsoft Entra ID Groups

This input is migrated to the supported Splunk Add-on for Microsoft Office 365. This is the recommended destination for Microsoft Entra ID metadata collection.

  1. Deactivate the existing input in the Splunk Add-on for Microsoft Azure.
  2. In the Splunk Add-on for Microsoft Office 365, select Create New Input and select Microsoft Entra ID Metadata to create a new input.
  3. Select the Groups option in the “Microsoft Entra ID Type” parameter.
  4. Save the input.

For more information, see Splunk Add-on for Microsoft Office 365 – Microsoft Entra ID Metadata input reference document: Configure Microsoft Entra ID Metadata Inputs.

Microsoft Entra ID Applications

This input is migrated to the supported Splunk Add-on for Microsoft Office 365. This is the recommended destination for Microsoft Entra ID metadata collection.

  1. Deactivate the existing input in the Splunk Add-on for Microsoft Azure.
  2. In the Splunk Add-on for Microsoft Office 365, select Create New Input and select Microsoft Entra ID Metadata to create a new input.
  3. Select the Applications option in the “Microsoft Entra ID Type” parameter.
  4. Save the input.

For more information, see Splunk Add-on for Microsoft Office 365 – Microsoft Entra ID Metadata input reference document: Configure Microsoft Entra ID Metadata Inputs.

Microsoft Entra ID Devices

This input is migrated to the supported Splunk Add-on for Microsoft Office 365. This is the recommended destination for Microsoft Entra ID metadata collection.

  1. Deactivate the existing input in the Splunk Add-on for Microsoft Azure.
  2. In the Splunk Add-on for Microsoft Office 365, select Create New Input and select Microsoft Entra ID Metadata to create a new input.
  3. Select the Devices option in the “Microsoft Entra ID Type” parameter.
  4. Save the input.

For more information, see Splunk Add-on for Microsoft Office 365 – Microsoft Entra ID Metadata input reference document: Configure Microsoft Entra ID Metadata Inputs.

Microsoft Entra ID Audit

The recommended migration path is to send Microsoft Entra ID audit data to an Azure Event Hub and collect it with the Splunk Add-on for Microsoft Cloud Services, or with Splunk Data Manager for Splunk Cloud Platform deployments. This avoids the throttling limits of the legacy direct collection path.

Microsoft Entra ID Risk Detection

The recommended migration path is to send Risk Detection logs to an Azure Event Hub and collect them with the Splunk Add-on for Microsoft Cloud Services Event Hub input, or with Splunk Data Manager for Splunk Cloud Platform deployments.

Microsoft Graph Security API

This input uses legacy Microsoft Graph Security API endpoints. The recommended migration path is to replace it with the Splunk Add-on for Microsoft Security Microsoft Defender for Endpoint Alerts input, which aligns with Microsoft’s recommended API usage.

  1. Deactivate the existing input Microsoft Graph Security API in the Splunk Add-on for Microsoft Azure.
  2. In the Splunk Add-on for Microsoft Security, select Create New Input and select Microsoft Defender for Endpoint Alerts to create a new input.
  3. Save the input.

For more information, see Splunk Add-on for Microsoft Security – input reference document: Configure.

Metrics

This input is migrated to the supported Splunk Add-on for Microsoft Cloud Services.

  1. Deactivate the existing input in the Splunk Add-on for Microsoft Azure.
  2. In the Splunk Add-on for Microsoft Cloud Services, select Create New Input and select Azure Metrics to create a new input.
  3. Save the input.

For more information, see Splunk Add-on for Microsoft Cloud Services – Azure Metrics input reference document: Azure Metrics.

Security Center (now called Microsoft Defender for Cloud)

Security Center has been renamed to Microsoft Defender for Cloud. The recommended migration path is to export these logs to an Azure Event Hub and collect them with the Splunk Add-on for Microsoft Cloud Services Event Hub input, or with Splunk Data Manager for Splunk Cloud Platform deployments.

Subscriptions

This input is migrated to the supported Splunk Add-on for Microsoft Cloud Services.

  1. Deactivate the existing input in the Splunk Add-on for Microsoft Azure.
  2. In the Splunk Add-on for Microsoft Cloud Services, select Create New Input and select **Azure Resource” to create a new input.
  3. Select the Subscriptions option in the “Resource Type” parameter.
  4. Save the input.

For more information, see Splunk Add-on for Microsoft Cloud Services – Azure Resource input reference document: Azure Resource.

Resource Groups

This input is migrated to the supported Splunk Add-on for Microsoft Cloud Services.

  1. Deactivate the existing input in the Splunk Add-on for Microsoft Azure.
  2. In the Splunk Add-on for Microsoft Cloud Services, select Create New Input and select Azure Resource to create a new input.
  3. Select the Resource Groups option in the “Resource Type” parameter.
  4. Save the input.

For more information, see Splunk Add-on for Microsoft Cloud Services – Azure Resource input reference document: Azure Resource.

Virtual Networks

This input is migrated to the supported Splunk Add-on for Microsoft Cloud Services.

  1. Deactivate the existing input in the Splunk Add-on for Microsoft Azure.
  2. In the Splunk Add-on for Microsoft Cloud Services, select Create New Input and select Azure Resource to create a new input.
  3. Select the Virtual Network option in the “Resource Type” parameter.
  4. Save the input.

For more information, see Splunk Add-on for Microsoft Cloud Services – Azure Resource input reference document: Azure Resource.

Compute

This input is migrated to the supported Splunk Add-on for Microsoft Cloud Services.

  1. Deactivate the existing input in the Splunk Add-on for Microsoft Azure.
  2. In the Splunk Add-on for Microsoft Cloud Services, select Create New Input and select Azure Resource to create a new input.
  3. From the “Resource Type” parameter, select Virtual Machine, Disk Data, Image Data, or Snapshot Data. If required, then create multiple inputs for each resource type.
  4. Save the input.

For more information, see Splunk Add-on for Microsoft Cloud Services – Azure Resource input reference document: Azure Resource.

Azure KQL Log Analytics

This input is migrated to the supported Splunk Add-on for Microsoft Cloud Services.

  1. Deactivate the existing input in the Splunk Add-on for Microsoft Azure.
  2. In the Splunk Add-on for Microsoft Cloud Services, select Create New Input and select Azure KQL Log Analytics to create a new input.
  3. Save the input.

For more information, see Splunk Add-on for Microsoft Cloud Services – Azure KQL Log Analytics input reference document: Azure KQL Log Analytics.

Azure Billing and Consumption

This input is migrated to the supported Splunk Add-on for Microsoft Cloud Services.

  1. Deactivate the existing input in the Splunk Add-on for Microsoft Azure.
  2. In the Splunk Add-on for Microsoft Cloud Services, select Create New Input and select Azure Consumption (Billing) to create a new input.
  3. Select the Usage Details option in the “Data Type” parameter.
  4. Save the input.

For more information, see Splunk Add-on for Microsoft Cloud Services – Azure Consumption (Billing) input reference document: Billing.

Azure Reservation Recommendation

This input is migrated to the supported Splunk Add-on for Microsoft Cloud Services.

  1. Deactivate the existing input in the Splunk Add-on for Microsoft Azure.
  2. In the Splunk Add-on for Microsoft Cloud Services, select Create New Input and select Azure Consumption (Billing) to create a new input.
  3. Select the Reservation Recommendation option in the “Data Type” parameter.
  4. Save the input.

For more information, see Splunk Add-on for Microsoft Cloud Services – Azure Consumption (Billing) input reference document: Billing.

Azure Resource Graph

This input is migrated to the supported Splunk Add-on for Microsoft Cloud Services.

  1. Deactivate the existing input in the Splunk Add-on for Microsoft Azure.
  2. In the Splunk Add-on for Microsoft Cloud Services, select Create New Input and select Azure Resource to create a new input.
  3. Select the Subscriptions option in the “Resource Type” parameter.
  4. Save the input.

For more information, see Splunk Add-on for Microsoft Cloud Services – Azure Resource input reference document: Azure Resource.

Azure Topology (automatic) and Azure Topology (manual)

These inputs have been migrated to the supported Splunk Add-on for Microsoft Cloud Services.

  1. Deactivate the existing input in the Splunk Add-on for Microsoft Azure.
  2. In the Splunk Add-on for Microsoft Cloud Services, select Create New Input and select Azure Resource to create a new input.
  3. Select the Topology option in the “Resource Type” parameter.
  4. Save the input.

For more information, see Splunk Add-on for Microsoft Cloud Services – Azure Resource input reference document: Azure Resource.

Add member to Microsoft 365 Group (alert action)

This alert action has been migrated to Splunk Add-on for Microsoft Office 365.

  1. Deactivate the existing alert action in the Splunk Add-on for Microsoft Azure.
  2. Create an alert in Search & Reporting app, select Add Member to Microsoft 365 Group Alert as the trigger action

For more information, see Splunk Add-on for Microsoft Office 365 – Add member to group alert reference document: Add Member to Microsoft 365 Group alert

Stop Azure VM (alert action)

This alert action has been migrated to Splunk Add-on for Microsoft Cloud Services.

  1. Deactivate the existing alert action in the Splunk Add-on for Microsoft Azure.
  2. Create an alert in Search & Reporting app, select Stop Azure VM Alert as the trigger action

For more information, see Splunk Add-on for Microsoft Cloud Services – Stop Azure VM alert reference document: Stop Azure VM alert

Dismiss Azure Alert (alert action)

This alert action has been migrated to Splunk Add-on for Microsoft Security.

  1. Deactivate the existing alert action in the Splunk Add-on for Microsoft Azure.
  2. Create an alert in Search & Reporting app, select Dismiss Azure Alert as the trigger action

For more information, see Splunk Add-on for Microsoft Security – Configure Alert Actions reference document: Alert actions