Forum Discussion

Brass Contributor

Nov 29, 2017

Solved

How can I delete a "test" Audit Log Search Alert Policy?

Hi there, I've created a "test" Audit Log Search Alert Policy in the Security & Compliance portal for alerting me if there was any files deleted on our SharePoint. Now is there a way to delete this p...

microsoft 365

security

VasilMichev
Nov 29, 2017
Depending on the licenses you have, the alert might end up in a "hidden" section of the portal. You can access it directly via: https://protection.office.com/#/managealerts

Or go to the SCC -> Alerts -> Dashboard -> click Activity Alerts under the Other alerts widget -> select and delete the alert.

VasilMichev

MVP

Nov 29, 2017

Depending on the licenses you have, the alert might end up in a "hidden" section of the portal. You can access it directly via: https://protection.office.com/#/managealerts

Or go to the SCC -> Alerts -> Dashboard -> click Activity Alerts under the Other alerts widget -> select and delete the alert.

Nicky De Westelinck

Brass Contributor

Nov 29, 2017

Thanks! Now I can see and disable the created alerts, but deleting them gives me the following error: "We cannot force delete rule '' since it is not in pending deletion state. Details of the error are: Request: /api/ActivityAlert/Delete Status code: 500 Exception: Microsoft.Exchange.PswsClient.PswsException Diagnostic information: {Version:16.00.2051.000,Environment:WEUPROD,DeploymentId:7bf1c951f4354dd78116b92e983c3a03,InstanceId:WebRole_IN_0,SID:8a068312-c483-4ac4-b5d8-9b431de6f7ae,CID:8ae983b5-4a30-40c2-9593-a245b69c04d4} Time: 2017-11-29T18:50:34.0947527Z Anyone got an idea? Thanks!

VasilMichev
MVP
Nov 29, 2017
Oh well, try PowerShell then. Get-ActivityAlert will show you the alerts, Remove-ActivityAlert will remove them. If you need help connecting to the SCC via PowerShell read here: https://technet.microsoft.com/en-us/library/mt587092(v=exchg.160).aspx
- Nicky De Westelinck
  Brass Contributor
  Nov 29, 2017
  Hi VasilMichev, worked like a charm! Thanks, you're a hero! :D