Home Not returning any data: value: []'ve%20tested%20the%20%2Fsecurity%2Falerts%20api%20from%202%20different%20tenants.%26nbsp%3BIn%26nbsp%3Bboth%20tenants%20we%20have%20Azure%20A're%20properly%20authenticated%20with%20proper%20permisions.%20We've%20tried%20it%20from%20the%20graph%20explorer%20and%20from%20both%20c%23%20samples%20('m%20facing%20the%20same%20issue%2C%20but%20I%20have%20Advanced%20Threat%20Protection%20as%20security%20provider%20.%26nbsp%3B%3CBR%20%2F%3EI%20have%20already%20defined%20'll%20be%20happy%20to%20assist.%20I%20suggest%20sending%20me%20the%20Azure%20tenant%20ID%2Fs%20over%20a%20private%20message%20so%20we%20can%20investigate%20your%20not%20getting%20any%20results%20to%20your%20queries.%20Michael%3C%2FLINGO-BODY%3E
Christian Rodríguez Giménez
Occasional Contributor

We've tested the /security/alerts api from 2 different tenants. In both tenants we have Azure AD Identity Protection and Azure Security Center Alerts. We can see those alerts from their respective blades in Azure Portal.


But returns 


"@odata.context": "$metadata#Security/alerts",
"value": []


We're properly authenticated with proper permisions. We've tried it from the graph explorer and from both c# samples (desktop and


Can you give us a hand?

5 Replies
Certainly, we'll be happy to assist. I suggest sending me the Azure tenant ID/s over a private message so we can investigate your not getting any results to your queries. Michael
Issue was successfully resolved

Hi , 
Can you please elaborate the steps taken to solve the issue. 

since I'm facing the same issue, but I have Advanced Threat Protection as security provider . 
I have already defined a security alerts policy and a threat management policy. 


@Michael Shalev wrote:
Issue was successfully resolved


Alerts from Windows Defender ATP are currently in Private Preview - will update when you can test this.

If you enabled WDATP in Azure Security Center, you should see these alerts included in the ASC alerts.


I have the same issue but with We always get empty alerts since 2019/01/08 for one tenant, before that it was working. Would you please help on that?