o365: Expand README troubleshooting section

[kcreddy]

Proposed commit message

o365: Expand README troubleshooting section

Document the common failure scenarios operators and users can act on:
authentication failures, missing permissions, no data collected,
outage recovery and the 7-day data-loss boundary, rate limiting, and
unhealthy transforms. Cross-link the existing Data latency and
Validation sections instead of duplicating them.

Add a security note that request trace files are not redacted and
contain the Authorization header and client secret in clear text.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[vera-review-bot]

No issues across the latest commits ea86c50.

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[efd6]

nit only

[efd6]

Suggested change

	On restart, the integration resumes from its saved position and backfills the missed window. Overlapping events are de-duplicated, so a resume does not create duplicates. The API retains data for a maximum of 7 days: outages shorter than that backfill automatically, but any window older than 7 days is purged by Microsoft and cannot be recovered.
	On restart, the integration resumes from its saved position and backfills the missed window. Overlapping events are de-duplicated during ingest, so a resume does not create duplicates. The API retains data for a maximum of 7 days: outages shorter than that backfill automatically, but any window older than 7 days is purged by Microsoft and cannot be recovered.

?

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 1 warning, 2 suggestions found

⚠️ Warnings (1): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/o365/_dev/build/docs/README.md	130	Elastic.PluralAbbreviations	Don't use apostrophes when making abbreviations plural. Use 'API' instead of ''s'.

💡 Suggestions (2): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
packages/o365/_dev/build/docs/README.md	130	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/o365/_dev/build/docs/README.md	130	Elastic.Semicolons	Use semicolons judiciously.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 688ba49

History

• 💚 Build #45942 succeeded ea86c50

cc @kcreddy

[elastic-vault-github-plugin-prod]

Package o365 - 3.10.5 containing this change is available at https://epr.elastic.co/package/o365/3.10.5/