Unable to configure Azure Auditing Template - An unexpected error occurred while executing a service call on agent (4292568)

From the Agent log:

 

2021-10-25 05:52:41.463 [12][ERROR][MicrosoftCloud.Service.AzureADHelper.CreateAzureApplication(0)] Caught exception in AddApplicationAsync: System.AggregateException: One or more errors occurred. ---> System.Data.Services.Client.DataServiceRequestException: An error occurred while processing this request. ---> System.Data.Services.Client.DataServiceClientException: {"odata.error":{"code":"Request_BadRequest","message":{"lang":"en","value":"Values of identifierUris property must use a verified domain of the organization or its subdomain

MS update regarding the update to Azure which was implemented in October:

 

https://docs.microsoft.com/en-us/azure/active-directory/develop/reference-breaking-changes#appid-uri-in-single-tenant-applications-will-require-use-of-default-scheme-or-verified-domains

 

This is impacted with the following issue:

Bug 317817: Unable to create Azure or O365 auditing template due to changes in Web App URI requirements

 

 

 

Manually create an Azure Web Application for auditing by performing these steps:

 

1. log in to the Azure Active directory with a global administrator account

2. Go to "App Registrations"

3. Click "New Registration"

4. Enter any name for the Registration. For example: ChangeAuditorApp1

5. In the "Supported account types" section, select "Accounts in this organizational directory only"

6. Click Register

7. The properties of the new web app will be displayed

8. Next to "Application ID URI", click "Add an Application ID URI"

9. Click "Set" next to "Application ID URI".

10. An Application ID URI will be automatically populated. Do not edit it.

11. Click Save and go back to the main properties page for the web app

12. Click "Certificates and secrets"

13. Click "New Client secret"

14. Select the preferred expiry time (we recommend the most allowed) and click Add. Copy the "Value" of the Client secret to be used in the CA Azure template creation later.

15. Click "API Permissions" and add the following permissions:

 

Microsoft Graph application permissions:

- AuditLog.Read.All – Application - Read all audit log data

- Directory.Read.All – Application - Read directory data

- IdentityRiskEvent.Read.All – Application - Read all identity risk information

 

Office 365 Management APIs application permissions:

- ActivityFeed.Read – Application - Read activity data for your organization

16. Once the permissions are added, click "Grant admin consent for <tenant>" and click yes to confirm

17. Create the Azure template in the CA client using the Application ID and Value of the Client secret (step 14)