Forum Discussion

Jan Duchač's avatar
Jan Duchač
Copper Contributor
Jul 12, 2017

Can't disable S&C alerts.

Hello,   I was learning about O365 alerts and just to test it a bit, I have created an alert that would notify me whenever I accessed a document in our company's tenant. Well it worked as expected ...
microsoft 365
security
Cian Allner's avatar
Cian Allner
Silver Contributor
Jul 12, 2017

Could be a bug and worth raising a service request but first I'd try PowerShell and see if that reveals anything that isn't shown in the portal.  Use https://technet.microsoft.com/en-us/library/mt771877(v=exchg.160).aspxto display any alerts that are set.  Further details are http://blog.enowsoftware.com/solutions-engine/activity-alerts-in-office-365 and https://support.office.com/en-gb/article/Create-activity-alerts-in-the-Office-365-Security-Compliance-Center-72bbad69-035b-4d33-b8f4-549a2743e97d.

  • Jan Duchač's avatar
    Jan Duchač
    Copper Contributor
    Jul 13, 2017

    Hi,

     

    thanks for fast reply. I actually never used powershell so this was a new thing for me. Once I installed PS for O365 I tried to run the Get-ActivityAlert but I have got an error that the command is not recognized. So i tried "Get-Command *Alert" if there are some commands with alert in name and it didnt find anything. Do I have to install some extension or what am I doing wrong?

     

    Thanks

    Jan Duchač

    • Cian Allner's avatar
      Cian Allner
      Silver Contributor
      Jul 13, 2017

      If you follow the instructions here it should work:

       

      https://technet.microsoft.com/en-us/library/mt587092(v=exchg.160).aspx

       

      Set-ExecutionPolicy RemoteSigned
$UserCredential = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.compliance.protection.outlook.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
Import-PSSession $Session

      I tried the above code in a PowerShell (admin) console and the Get-ActivityAlert command worked ok. You may find the command doesn't return anything if it can't find any active alerts but it's worth a try.

       

       

      Per that article, if not a global admin, there are additional steps here, that an admin can grant - https://support.office.com/en-us/article/Give-users-access-to-the-Office-365-Security-Compliance-Center-2cfce2c8-20c5-47f9-afc4-24b059c1bd76.

      • Jan Duchač's avatar
        Jan Duchač
        Copper Contributor
        Jul 13, 2017

        Thanks a lot, exactly what I needed :-) I can now run the Get-ActivityAlert command. Problem is, that it only lists one alert (which is active alert in S&C) and it doesnt list the alerts I have a problem with. Guess I have to contact Microsoft support directly, since the alert emails are getting annoying and there seems to be no way to disable them.

         

        Thanks a lot once again.

         

        Have a nice day

        Jan Duchač

         

         

Resources