Symptom
The Office 365 Activity source in Cribl Stream fails to collect data. All content type collector jobs (Exchange, SharePoint, General, Active Directory, DLP) are failing. The following error appears in the task logs or Job Inspector under Task Errors:
AADSTS7000229: The client application <app_id> is missing service principal in the tenant <tenant_id>. Http Error, statusCode: 401 error: invalid_client
The error occurs on the discover task, meaning Cribl cannot obtain an OAuth token from Azure AD and no data collection occurs. Rotating the client secret does not resolve the issue.
Environment
- Cribl Stream
- Office 365 Activity source
Resolution
Part 1 - Restore the service principal
- Log in to the Azure Portal for the correct tenant.
- Under App Registrations, find and search for the Application (client) ID in the error.
- If the App Registration is found, click into it and check the “Managed application in the local directory” link on the Overview page.
- If the link is present, the service principal exists. Check if it is disabled under the Properties, or if the API permissions and Admin consent were revoked.
- If the link is missing, click “Create Service Principal” from the App Registration to create it.
- If the app registration is not found at all, a new one must be created and Cribl must be reconfigured with the new client ID and secret
- After recreating the service principal, re-add the required API permissions under Office 365 Management APIs → Application permissions:
ActivityFeed.Read- required for Exchange, SharePoint, General, and Active Directory content typesActivityFeed.ReadDlp- required for the DLP content type- Click Grant admin consent
- Update the Cribl Activity source configuration with the new client ID and secret if credentials changed, then commit and deploy.
Note: Service principal creation is near-instant, but allow for the next scheduled collector job to run and confirm success (will vary based on the configured poll interval).
Part 2 - Restore the DLP.All subscription (if applicable)
-
Once the jobs successfully run, if Exchange, SharePoint, General, and Active Directory jobs go green but the DLP job continues to fail with:
Office365 management activity subscription for content type: DLP.All does not exist
This is a separate issue. The Office 365 Activity API requires an active subscription per content type. Cribl does not automatically create theDLP.Allsubscription. It must be created manually. Run the following from the Cribl worker CLI: -
Obtain the access token:
curl -X POST "https://login.windows.net/<tenant_id>/oauth2/token" \ -d "client_secret=<client secret>&resource=https://manage.office.com&client_id=<app id>&grant_type=client_credentials" -
Use the access token to start the
DLP.Allsubscription:curl -X POST "https://manage.office.com/api/v1.0/<tenant_id>/activity/feed/subscriptions/start?contentType=DLP.All" \ -H "Authorization: Bearer <paste access_token here>" \ -d ""
A successful response returns the subscription details with "status": "enabled". After running, manually trigger the DLP collector job in Cribl to confirm it goes green.
Note: These commands apply to any Content Type as the second curl command parameter is interchangeable, contentType=<content_types>
Cause
The AADSTS7000229 error is thrown by Azure when the service principal for the app registration used by Cribl does not exist in the tenant. An app registration alone is not sufficient. Without it, OAuth token requests are rejected immediately, regardless of whether the credentials (client ID and secret) are valid.
This commonly occurs when:
- The Azure App Registration was shared with another tool (e.g., QRadar, Splunk) and was deleted during decommissioning of that tool without awareness that Cribl was also using it
- An Azure admin performed a cleanup of unused Enterprise Applications
Rotating the client secret does not resolve this error because the issue is not with the credential value, it is the absence of the service principal object itself.
The secondary content-type subscription error occurs because the Office 365 Activity API manages subscriptions independently of Azure AD permissions. When a service principal is deleted, its associated O365 subscriptions are also lost. Cribl automatically recreates subscriptions for most content types on the first successful run after auth is restored. However, not all content type subscriptions may be auto-created. Any content type that does not auto-recover must have its subscription started manually via the API.
Last Validated
4.16.1