# Microsoft Filebeat Module
**URL:** https://discuss.elastic.co/t/microsoft-filebeat-module/300115
**Category:** Beats
**Tags:** beats-module
**Created:** [March 20, 2022, 5:09am UTC](https://discuss.elastic.co/t/microsoft-filebeat-module/300115 "2022-03-20T05:09:00Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@John\_Doe4](https://discuss.elastic.co/u/John_Doe4)
#### Post date: [March 20, 2022, 5:09am UTC](https://discuss.elastic.co/t/microsoft-filebeat-module/300115/1 "2022-03-20T05:09:01Z")
Hi,
I am using the Filebeat O365 module across a bunch of Azure AD tenants with great success.
I am looking to onboard Microsoft Defender for Business and as such I'd like to ingest the Windows Defender events and I can see that the Microsoft Filebeat module will do just that!
However, there seems to be a problem here. With the O365 module I can specify a list of tenants and I am using a certificate to connect to the app instead of an OAuth2 token.
It looks like the Microsoft module is forcing the use of an OAuth2 token which means that I need to create an individual App per tenant and generate an OAuth2 token per app. OK I can do that, however, the Microsoft module does not seem to have any way for me to connect to multiple Azure AD tenants?
I thought well maybe I am supposed to define a config for the Microsoft module multiple times, once for each tenant but upon investigation I can see people saying that only the final module configuration is used!!!!
So does that mean it is not even possible to ingest the Windows defender events from multiple tenants?
---
### Author:  [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [March 20, 2022, 4:56pm UTC](https://discuss.elastic.co/t/microsoft-filebeat-module/300115/2 "2022-03-20T16:56:21Z")
Hi @John_Doe4
You could run multiple Filebeat instances and query one tenant per instance.
Willem
---
### Author:  [@John\_Doe4](https://discuss.elastic.co/u/John_Doe4)
#### Post date: [March 20, 2022, 11:08pm UTC](https://discuss.elastic.co/t/microsoft-filebeat-module/300115/3 "2022-03-20T23:08:45Z")
Thanks, although if possible I’d like to avoid having to configure and maintain 35 different instances of filebeat.
I am guessing I may have to change to Splunk for my needs?
---
### Author:  [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [March 21, 2022, 9:52am UTC](https://discuss.elastic.co/t/microsoft-filebeat-module/300115/4 "2022-03-21T09:52:34Z")
Well that is your choice of course. If you got the money... Is there already a GitHub issue for this problem by the way? Without GH isssue it ain't going to be solved.
---
### Author:  [@John\_Doe4](https://discuss.elastic.co/u/John_Doe4)
#### Post date: [March 21, 2022, 10:16am UTC](https://discuss.elastic.co/t/microsoft-filebeat-module/300115/5 "2022-03-21T10:16:30Z")
I couldn't even find the microsoft module in the beats on github. A thought I had was to clone the microsoft module and rename it 35 times, so essentially creating 35 unique modules.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 18, 2022, 12:16pm UTC](https://discuss.elastic.co/t/microsoft-filebeat-module/300115/6 "2022-04-18T12:16:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.