Nov 14 2023 05:42 AM - edited Nov 15 2023 07:11 AM
This happens a lot. I get these emails from Office365Alerts notifying our team that "A medium-severity alert has been triggered". At the bottom of the email is a link to "View alert details". When I click that, the site shows an error: "Can't find it. Either what you are looking for doesn't exist or you need to use a different search string."
So, then I go to the Alerts view and filter to show everything (at least I think I am) but there's nothing related to this particular alert (unusual volume of file sharing). Where did it go?
EDIT: Including a screenshot of another email I got today. The result of clicking the 'View alert details' is again the same.
Nov 14 2023 05:51 AM
Hi @Anthony-123,
are you opening this link in a browser logged-in as an Administrator or normal user?
Try to click on the "View alert details" with the right mouse button, then click on the "Copy hyperlink" and paste it in a browser where you are allready logged-in as an Administrator or paste it in a Private Mode browser and log-in with you Admin user.
Please click Mark as Best Response & Like if my post helped you to solve your issue.
This will help others to find the correct solution easily. It also closes the item.
If the post was useful in other ways, please consider giving it Like.
Kindest regards,
Leon Pavesic
(LinkedIn)
Nov 14 2023 05:55 AM
Nov 14 2023 06:05 AM
Hi @Anthony-123,
just to eliminate all, can you try to reset the filter completely and try to see if you can find this alert in the list of all alerts.
You can use "CTRL" + "F" and try to search for Unusual volume of file sharing
If you can´t find it, are you a Global Administrator, what kind of Admin is your user? Do you have a Global Admin user to test it (open this) alert?
Please click Mark as Best Response & Like if my post helped you to solve your issue.
This will help others to find the correct solution easily. It also closes the item.
If the post was useful in other ways, please consider giving it Like.
Kindest regards,
Leon Pavesic
(LinkedIn)
Nov 14 2023 06:15 AM
Azure / Entra ID confirms I'm the Global Admin.
My alerts look different than yours. How did you get to "View Alerts"?
Nov 14 2023 06:24 AM
Hi @Anthony-123,
thanks for the update, you are a Global Administrator so you should definitely see all alerts.
My alerts are something else, those are Mail-Flow alerts (https://security.microsoft.com/viewalertsv2).
Try to open this link, and reset all the filters.
Please click Mark as Best Response & Like if my post helped you to solve your issue.
This will help others to find the correct solution easily. It also closes the item.
If the post was useful in other ways, please consider giving it Like.
Kindest regards,
Leon Pavesic
(LinkedIn)
Nov 14 2023 06:30 AM
Nov 14 2023 04:51 PM
Nov 15 2023 05:24 AM
It's in my original post - "Can't find it. Either what you are looking for doesn't exist or you need to use a different search string."
Nov 15 2023 01:07 PM - edited Nov 15 2023 01:39 PM
@Anthony-123 It's found in Compliance admin center > Alerts. For some reason when you click the button in the email, it redirects you to Security admin center. I was able to reproduce this issue.
Jan 31 2024 01:57 PM
Feb 02 2024 12:37 AM - edited Feb 02 2024 12:37 AM
I have noticed the very same issue on several tenants. This is still present as of February 2024.
Same pattern here:
- alert is received with a URL "https://security.microsoft.com/alerts/unique_alert_ID_here"
- when followed opens up Security Admin Center and shows an error "Can't find it. Either what you are looking for doesn't exist or you need to use a different search string." not being able to locate the alert
- when I substitute security to compliance in the URL like this "https://compliance.microsoft.com/alerts/unique_alert_ID_here" it goes straight away to the details of the alert in question in the right - Compliance - Admin Center
I have raised a ticket with Microsoft but I'm getting nowhere.
I'm being asked to open up the alert again and records logs with Fiddler and Steps Recorder and provide sample alerts on and on, which I did once a week ago.
Now I'm being asked to do the same again. It seems that the engineer completely disregards the nature of the issue, symptoms and doesn't want to acknowledge that this is 100% a fault at the core of the internal template at the time of alert creation, not related to tenant, browser, user, whatever.
Seems like they haven't updated it after Security & Compliance ACs were separated into two.
It feels like I'm talking to a robot.
Hope we can get this resolved eventually.
Mar 12 2024 01:32 PM
Mar 24 2024 07:49 PM
Yes, as of 3/24/24 this bug still exists.
Robert
Mar 25 2024 01:48 AM
Mar 26 2024 10:57 AM
I spoke with a Microsoft support agent and did a screenshare, today. After showing them the email and broken link, they directed me to "report an issue" (which I believe is synonymous with "bug report"), providing both the broken link and the link the email should have instead.
Apr 29 2024 03:02 AM
May 07 2024 06:13 PM
May 14 2024 11:59 AM
May 23 2024 05:19 PM