HTTP Status code 401
Symptoms
Error: "Status Code: 401 | Status Reason: Unauthorized"
Error indicating that authentication to Microsoft Graph API failed
Error response returned from the Message Trace API request
Causes
IBM QRadar successfully connects to the API endpoint, but authentication fails because the application cannot obtain a valid OAuth access token from Microsoft Entra ID
Resolving the problem
To resolve your HTTP Status code 401 error, verify that the following conditions are met.
- Verify that the Client ID, Client Secret, and Tenant ID configured in the log source match the values from the application registered in Microsoft Entra ID.
- Verify that the Client Secret has not expired.
- Ensure that the application has the required Microsoft Graph application permissions to access Message Trace data.
- Ensure that administrator consent is granted for the required permissions.
- Ensure that a service principal is provisioned for Exchange Online for the registered application.