Log source fails with

[WindowsDefenderATP-eu-....] WARN org.apache.commons.httpclient.HttpMethodDirector - Unable to respond to any of these challenges: {bearer=Bearer}

Credentials work with MS supplied scripts when events are retrieved from:

api.securitycenter.microsoft.com

and NOT

wdatp-alertexporter-us.windows.com or wdatp-alertexporter-eu.windows.com

This suggests API endpoints changes are not implemented in the DSM?

What needs to be done in QRadar to retrieve logs correctly, anyone?

API endpoints in this:

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/pull-alerts-using-rest-api?view=o365-worldwide

are different from this:

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/exposed-apis-list?view=o365-worldwide

What gives?

Did you ever manage to resolve this. I am having the same issue