Forum Discussion
Configuring 'Quarantine release request' alert via powershell?
You cannot modify built-in policies, as mentioned in the documentation:
Note: You can't use this cmdlet to edit default alert policies. You can only modify alerts that you created using the New-ProtectionAlert cmdlet.
The UI uses a different API to update policies ("policy overrides"), which is not exposed via any PowerShell cmdlet, afaik.
As for creating the alert, try specifying "-AggregationType None", as "advanced" aggregations are one of the conditions that require premium licensing.
You cannot modify built-in policies, as mentioned in the documentation:
Note: You can't use this cmdlet to edit default alert policies. You can only modify alerts that you created using the New-ProtectionAlert cmdlet.
The UI uses a different API to update policies ("policy overrides"), which is not exposed via any PowerShell cmdlet, afaik.
As for creating the alert, try specifying "-AggregationType None", as "advanced" aggregations are one of the conditions that require premium licensing.
You cannot modify built-in policies
"Allow the user to edit built-in policies? No, no no. Too absurd. Provide an error message clearly stating this action is not allowed? Hah, ridiculous! Create an interface that's split brain and require the user to clone all built-in policies to change notify user? Yes, that sounds about right."
It would be fascinating to study the minds of MSFT engineers. Such talented individuals.