Skip to main content
adem_netsys
adem_netsys
Explorer III
May 16, 2026
Question

SIEM-O365 Issue

  • May 16, 2026
  • 1 reply
  • 51 views

Hello Guys,

I am configuring Office 365 log collection on FortiSIEM. The GUI credential test for manage.office.com successfully passes, but the log collection fails shortly after with an "Office access token empty" error.

When I check the backend phoenix.log for the phAgentManager process, I see the following error. It clearly shows that the Resource URL is being truncated to just https://:

  • Checked Azure AD permissions, Admin Consents, and Secret expiration (All OK).

  • If I completely delete and recreate the O365 credential in FortiSIEM, log collection starts working perfectly. However, after a few minutes, the backend reverts to this exact same https:// truncation error and log collection stops.

I am currently running FortiSIEM version 7.4.2

Has anyone encountered this specific truncation issue before? Is this a known bug, or is there a workaround to force the backend to retain the full URL?

 

Thank you

    1 reply

    msanjaypadma
    Staff
    msanjaypadma
    Staff
    May 17, 2026

    Hi ​@adem_netsys .

    Did you refer this article ?  


    |Thanks,
    Mayur Padma​​​​​​​

      adem_netsys
      adem_netsysAuthor
      Explorer III
      May 17, 2026

      Yes, The token fields are correct, but there’s no error corresponding to the ones in the document. I’m getting a different error. As I mentioned, the logs come in for a while and then stop again.

      Terms & ConditionsAccessibility statement