[O365] Add support for Microsoft Authentication Library (MSAL)

[jamiehynds]

Our Office365 integration currently utilizes Azure Active Directory Authentication Library (ADAL) for authentication and authorization. Microsoft has announced that ADAL will become deprecated on June 30 2023. As such, it is recommended to migrate ADAL authentication to the Microsoft Authentication Library (MSAL). Additional details regarding this announcement can be found below.

https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-migration

The above announcement also contains the following warning:

If you choose not to migrate to MSAL before ADAL support ends on June 30, 2023, you put your app's security at risk. Existing apps that use ADAL will continue to work after the end-of-support date, but Microsoft will no longer release security fixes on ADAL.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[botelastic]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[andrewkroh]

Am I correct in thinking that we should begin the deprecation process for the Filebeat o365audit input for the same reason? It's using https://github.com/Azure/go-autorest/ which says "NOTE: The modules in this repo will go out of support by March 31, 2023."

[jamiehynds]

While the module should be deprecated, I'm wary of an immediate deprecation of a GA'd module, especially for something like O365. Could we add a notice to the docs to (1) advise users to move to the O365 integration, (2) make them aware of the go-autorest end of support and (3) set a date or stack release where the module will be deprecated.

[jamiehynds]

Closing as we have migrated the O365 integration to use the CEL input and no longer rely on the MSAL for authentication.