Spex Add-on for Microsoft M365 Automation
Overview
Details
The Spex Add-on for Microsoft M365 Automation captures Power Platform Environments, Flows, Flow Runs and Actions, giving you full visibility across your tenant. Built with secure credential handling, robust checkpointing and modular architecture, this add-on ensures reliability and flexibility in production environments.
This add-on replaces the legacy Microsoft Power Platform Add-on for Splunk and introduces a modern, UCC-based configuration interface, as well as a custom Python library designed for Microsoft APIs.
Future updates will include support for Azure Logic Apps and Azure Automation, further expanding observability for your Microsoft 365 ecosystem.
How the Add-on Works
The Spex Add-on for Microsoft M365 Automation collects data from Microsoft Power Platform and ingests it into Splunk. It supports the following components:
- Environments
- Flows per Environment
- Flow Runs per Flow
- Actions per Flow Run
🔐 Authentication Methods
The add-on supports two modes of authentication depending on the resource being accessed:
-
Environments
Uses App Registration credentials (Client ID, Secret, and Tenant ID) with theclient_credentialsOAuth2 flow. -
Flows, Flow Runs, and Actions
Require both App Registration credentials and a Service Account using thepasswordOAuth2 flow.
⚠️ Important: You should configure Conditional Access Policies to exclude the service account from MFA (multi-factor authentication) so that ingestion remains uninterrupted.
⚙️ Actions Collection Toggle
The Flow Runs input includes an "Ingest Actions" checkbox.
When enabled, the add-on will collect and ingest each action executed during the flow run. This gives full visibility into flow logic and outcomes. You can disable it to limit data volume when actions are not needed.
🏢 Multi-Tenancy Support
The add-on is built to support multiple Microsoft 365 tenants. You can configure several App Registrations and Service Accounts within the add-on and assign them to different inputs. This makes it ideal for managed service providers (MSPs) or large organizations operating across several tenants.
📊 Summary Sourcetype for Clean Dashboards
To keep your dashboards lean and fast, the add-on creates a flow_run_summary sourcetype. This single event summarizes every ingestion run of the flow runs input.
Each summary event contains the following fields:
{
"input": "flow_runs",
"run": "<input_name>",
"timestamp": "<ISO time of execution>",
"environments_checked": <number>,
"flows_checked": <number>,
"flow_runs_ingested": <number>,
"flow_actions_ingested": <number>,
"include_actions": <true|false>,
"duration_seconds": <float>
}
Use this sourcetype to monitor ingestion health, spot gaps, measure performance, or create dashboards without relying on the full raw dataset.
Need Help?
💬 Reach out via Spex Support or visit our website: https://www.spex.lu
Release Notes
Version 1.1.0
[1.1.0] - 2024-04-03
New Features
- Proxy Support: You can now route all outbound connections through Splunk's configured proxy. Just check the "Use Proxy" option on your input configuration.
Improvements
- Added proxy handling to all HTTP requests using the
requestslibrary. - Refactored
auth,environments,flows, andfetchmodules to accept an optionalproxiesparameter. - Updated
globalConfigto support proxy setting via UI.
Compatibility & Packaging
- Updated
app.manifestwith correct versioning and `tar
Version 1.0.0
📦 Version 1.0.0 – Initial Release
Release Date: 2025-03-29
✨ Features
- 🔄 Modular Inputs for Microsoft Power Platform
- Collects Power Platform Environments
- Collects Flows per Environment
-
Future-proof structure ready to support Flow Runs and Actions
-
🔐 Credential Management
-
Securely stores App Registrations and Service Accounts using Splunk’s credential store
-
💾 Checkpointing System
- Prevents duplicate event ingestion using lastModifiedTime
-
Flexible checkpoint system supporting KV Store or fallback to local file
-
🧠 Custom Python Library (
spex_m365_automation) - Handles authentication (client credentials + service account)
- Fetches and paginates Microsoft REST API results
-
Abstracts flows, environments and future collectors
-
⚙️ Built with Splunk’s UCC Framework
- Modern UI with configuration pages, modular input forms and validation
- Fully compatible with Splunk Web