SSO Authentication Issues with Azure Entra ID

Update timeline

1. investigating Jan 21, 2026, 12:23 PM UTC

   Starting at 03:12 AM Pacific Time, customers using Azure Entra ID for Single Sign-On (SSO) may be unable to log in to Splunk Observability. We are actively investigating now.

2. investigating Jan 21, 2026, 01:50 PM UTC

   We are continuing to investigate this issue.

3. investigating Jan 21, 2026, 02:26 PM UTC

   We are continuing to investigate this issue.

4. identified Jan 21, 2026, 03:50 PM UTC

   We have identified a workaround that can help restore access while we continue investigating the root cause. Workaround Organizations with SSO enabled have a local administrator account that can sign in without SSO. Administrators can use this account to: 1. Sign in to Splunk Observability using email and password (local login) 2. Invite affected users to the organization 3. Enable invited users to sign in using email and password (local login) as a temporary alternative We have validated this process internally and confirmed it is working as expected. Next step * If you need assistance applying this workaround, please contact Splunk Customer Support. We will continue to monitor the situation and provide updates as additional information becomes available.

5. identified Jan 21, 2026, 06:18 PM UTC

   Our engineering teams continue investigating this service disruption in search of a permanent solution for the SSO Authentication issues. The workaround mentioned in our previous update remains as the best course of action to mitigate immediate impact.

6. identified Jan 21, 2026, 07:16 PM UTC

   We are continuing to investigate this issue.

7. identified Jan 21, 2026, 10:38 PM UTC

   We are continuing to investigate this issue.

8. identified Jan 21, 2026, 11:41 PM UTC

   We are continuing to investigate this issue. Please refer to the Workaround posted in our update from 15:50 UTC.

9. resolved Jan 22, 2026, 02:02 PM UTC

   The issue has been identified and resolved.