SOLVED
Home

How can I delete a "test" Audit Log Search Alert Policy?

%3CLINGO-SUB%20id%3D%22lingo-sub-132206%22%20slang%3D%22en-US%22%3EHow%20can%20I%20delete%20a%20%22test%22%20Audit%20Log%20Search%20Alert%20Policy%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-132206%22%20slang%3D%22en-US%22%3EHi%20there%2C%20I've%20created%20a%20%22test%22%20Audit%20Log%20Search%20Alert%20Policy%20in%20the%20Security%20%26amp%3B%20Compliance%20portal%20for%20alerting%20me%20if%20there%20was%20any%20files%20deleted%20on%20our%20SharePoint.%20Now%20is%20there%20a%20way%20to%20delete%20this%20policy%2C%20cause%20apparently%20this%20alert%20is%20nowhere%20to%20be%20find%3F%20I've%20stopped%20the%20Audit%20Recording%2C%20but%20I%20still%20get%20those%20emails.%20In%20my%20alert%20overview%20the%20created%20alert%20isn't%20visible.%20Anyone%20got%20an%20idea%3F%20Thanks!%20Nicky%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-132206%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%20%26amp%3B%20Compliance%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESharePoint%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-132405%22%20slang%3D%22en-US%22%3ERe%3A%20How%20can%20I%20delete%20a%20%22test%22%20Audit%20Log%20Search%20Alert%20Policy%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-132405%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%2C%20worked%20like%20a%20charm!%20Thanks%2C%20you're%20a%20hero!%20%3AD%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-132401%22%20slang%3D%22en-US%22%3ERe%3A%20How%20can%20I%20delete%20a%20%22test%22%20Audit%20Log%20Search%20Alert%20Policy%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-132401%22%20slang%3D%22en-US%22%3E%3CP%3EOh%20well%2C%20try%20PowerShell%20then.%20Get-ActivityAlert%20will%20show%20you%20the%20alerts%2C%20Remove-ActivityAlert%20will%20remove%20them.%20If%20you%20need%20help%20connecting%20to%20the%20SCC%20via%20PowerShell%20read%20here%3A%20%3CA%20href%3D%22https%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fmt587092(v%3Dexchg.160).aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fmt587092(v%3Dexchg.160).aspx%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-132399%22%20slang%3D%22en-US%22%3ERe%3A%20How%20can%20I%20delete%20a%20%22test%22%20Audit%20Log%20Search%20Alert%20Policy%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-132399%22%20slang%3D%22en-US%22%3EThanks!%20Now%20I%20can%20see%20and%20disable%20the%20created%20alerts%2C%20but%20deleting%20them%20gives%20me%20the%20following%20error%3A%20%22We%20cannot%20force%20delete%20rule%20'%3CALERT%20name%3D%22%22%3E'%20since%20it%20is%20not%20in%20pending%20deletion%20state.%20Details%20of%20the%20error%20are%3A%20Request%3A%20%2Fapi%2FActivityAlert%2FDelete%20Status%20code%3A%20500%20Exception%3A%20Microsoft.Exchange.PswsClient.PswsException%20Diagnostic%20information%3A%20%7BVersion%3A16.00.2051.000%2CEnvironment%3AWEUPROD%2CDeploymentId%3A7bf1c951f4354dd78116b92e983c3a03%2CInstanceId%3AWebRole_IN_0%2CSID%3A8a068312-c483-4ac4-b5d8-9b431de6f7ae%2CCID%3A8ae983b5-4a30-40c2-9593-a245b69c04d4%7D%20Time%3A%202017-11-29T18%3A50%3A34.0947527Z%20Anyone%20got%20an%20idea%3F%20Thanks!%3C%2FALERT%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-132392%22%20slang%3D%22en-US%22%3ERe%3A%20How%20can%20I%20delete%20a%20%22test%22%20Audit%20Log%20Search%20Alert%20Policy%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-132392%22%20slang%3D%22en-US%22%3E%3CP%3EDepending%20on%20the%20licenses%20you%20have%2C%20the%20alert%20might%20end%20up%20in%20a%20%22hidden%22%20section%20of%20the%20portal.%20You%20can%20access%20it%20directly%20via%3A%20%3CA%20href%3D%22https%3A%2F%2Fprotection.office.com%2F%23%2Fmanagealerts%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fprotection.office.com%2F%23%2Fmanagealerts%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOr%20go%20to%20the%20SCC%20-%26gt%3B%20Alerts%20-%26gt%3B%20Dashboard%20-%26gt%3B%20click%20Activity%20Alerts%20under%20the%20Other%20alerts%20widget%20-%26gt%3B%20select%20and%20delete%20the%20alert.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Nicky De Westelinck
Occasional Contributor
Hi there, I've created a "test" Audit Log Search Alert Policy in the Security & Compliance portal for alerting me if there was any files deleted on our SharePoint. Now is there a way to delete this policy, cause apparently this alert is nowhere to be find? I've stopped the Audit Recording, but I still get those emails. In my alert overview the created alert isn't visible. Anyone got an idea? Thanks! Nicky
4 Replies
Solution

Depending on the licenses you have, the alert might end up in a "hidden" section of the portal. You can access it directly via: https://protection.office.com/#/managealerts

 

Or go to the SCC -> Alerts -> Dashboard -> click Activity Alerts under the Other alerts widget -> select and delete the alert.

Thanks! Now I can see and disable the created alerts, but deleting them gives me the following error: "We cannot force delete rule '' since it is not in pending deletion state. Details of the error are: Request: /api/ActivityAlert/Delete Status code: 500 Exception: Microsoft.Exchange.PswsClient.PswsException Diagnostic information: {Version:16.00.2051.000,Environment:WEUPROD,DeploymentId:7bf1c951f4354dd78116b92e983c3a03,InstanceId:WebRole_IN_0,SID:8a068312-c483-4ac4-b5d8-9b431de6f7ae,CID:8ae983b5-4a30-40c2-9593-a245b69c04d4} Time: 2017-11-29T18:50:34.0947527Z Anyone got an idea? Thanks!

Oh well, try PowerShell then. Get-ActivityAlert will show you the alerts, Remove-ActivityAlert will remove them. If you need help connecting to the SCC via PowerShell read here: https://technet.microsoft.com/en-us/library/mt587092(v=exchg.160).aspx

Hi @Vasil Michev, worked like a charm! Thanks, you're a hero! :D

Related Conversations
Teams - Chat History
David Gorman in Microsoft Teams on
8 Replies
Remove MS shifts schedule from a Channel in MS Teams
John Crook in Microsoft Teams on
17 Replies
Move Channels between Teams
HerculesConsen in Microsoft Teams on
13 Replies
Auto-Add new employees
Mathias Koprek in Microsoft Teams on
14 Replies
Configuring more than one account in MS-Teams
Biju_Radhakrishnan in Microsoft Teams on
15 Replies