O365 Alerts issue

%3CLINGO-SUB%20id%3D%22lingo-sub-794905%22%20slang%3D%22en-US%22%3EO365%20Alerts%20issue%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-794905%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20all%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20a%20strange%20issue%20regarding%20O365%20notification%20alerts.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERecently%20we%20have%20had%20a%20member%20of%20staff%20leave%20and%20are%20in%20the%20process%20of%20removing%20access%20and%20modifying%20alerts%20that%20he%20previously%20had%20setup%20to%20stop%20emails%20being%20sent%20to%20just%20him%20(adding%20different%20users%20in).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20been%20changing%20these%20fine%20however%20one%20alert%20for%20the%20activity%20of%20'Add%20member%20to%20role'%20is%20still%20being%20sent%20to%20the%20users%20that%20has%20left.%20Its%20been%20called%20'Elevation%20of%20privlieges'%20but%20upon%20searching%20for%20this%20alert%20we%20cant%20see%20it%20listed%20of%20defined%20in%20the%20security%20and%20compliance%20centre%20alert%20policies.%20All%20the%20alerts%20previously%20setup%20have%20been%20changed%20but%20this%20one%20still%20alerts%20and%20doesn't%20appear%20to%20exist%20in%20the%20list.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20also%20doesn't%20appear%20in%20the%20triggered%20alerts%20section.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMy%20question%20is...%20is%20there%20a%20way%20of%20hiding%20alerts%20from%20being%20seen%20in%20alerts%20section%20in%20S%26amp%3BC%20that%20we%20are%20not%20aware%20of%20(through%20PS%20for%20example)%20or%20is%20this%20alert%20setup%20somewhere%20else%20like%20in%20Azure%20AD%20for%20example%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EEverything%20when%20researching%20this%20problem%20points%20back%20to%20the%20S%26amp%3BC%20centre%20being%20the%20place%20to%20be%20but%20like%20i%20said%2C%20it%20doesn't%20seem%20to%20exist.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20suggestions%20would%20be%20greatly%20appreciated.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%2C%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-794905%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECompliance%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-795007%22%20slang%3D%22en-US%22%3ERe%3A%20O365%20Alerts%20issue%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-795007%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F389125%22%20target%3D%22_blank%22%3E%40Howling_Mad%3C%2FA%3E%26nbsp%3BHave%20You%20checked%20both%20the%20Activity%20Alerts%20and%20the%20Alert%20Policies%3F%20You%20will%20probably%20find%20it%20in%20one%20of%20those%20two%20locations.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBest%20regards%2C%20Magnus%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-795011%22%20slang%3D%22en-US%22%3ERe%3A%20O365%20Alerts%20issue%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-795011%22%20slang%3D%22en-US%22%3E%3CP%3EHey%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F389125%22%20target%3D%22_blank%22%3E%40Howling_Mad%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20seen%20this%20where%20the%20alert%20was%20created%20in%20the%20'Audit%20Log%20Search'%20part%20of%20S%26amp%3BC%20and%20doesn't%20show%20in%20the%20main%20alerts%20list.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EGo%20to%20S%26amp%3BC%20centre%2C%20then%20alerts%2C%20then%20dashboard%20then%20find%20Other%20alerts%20and%20click%20on%20'Activity%20Alert'%20and%20you%20should%20be%20able%20to%20delete%20it%20from%20there%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20655px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F126183i8103CEA380DB1E18%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22SCC.png%22%20title%3D%22SCC.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECan%20also%20use%20Powershell%20with%20Get-ActivityAlert%20to%20find%20all%20of%20your%20alerts%20and%20pipe%20over%20to%20delete.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHope%20this%20helps.%20Pretty%20sure%20I%20got%20this%20info%20from%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3Eoriginally%20so%20thanks%20to%20him.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECheers%2C%3C%2FP%3E%3CP%3EMark%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-799922%22%20slang%3D%22en-US%22%3ERe%3A%20O365%20Alerts%20issue%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-799922%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F383653%22%20target%3D%22_blank%22%3E%40HidMov%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20the%20response%2C%20just%20had%20a%20quick%20look%20in%20that%20section%20and%20no%20alerts%20are%20listed%2C%20which%20is%20a%20bit%20of%20pain.%20Ill%20have%20a%20check%20on%20powershell%20and%20see%20if%20the%20alert%20is%20listed%20then.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%2C%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Hi all,

 

We have a strange issue regarding O365 notification alerts.

 

Recently we have had a member of staff leave and are in the process of removing access and modifying alerts that he previously had setup to stop emails being sent to just him (adding different users in).

 

We have been changing these fine however one alert for the activity of 'Add member to role' is still being sent to the users that has left. Its been called 'Elevation of privlieges' but upon searching for this alert we cant see it listed of defined in the security and compliance centre alert policies. All the alerts previously setup have been changed but this one still alerts and doesn't appear to exist in the list.

 

It also doesn't appear in the triggered alerts section.

 

My question is... is there a way of hiding alerts from being seen in alerts section in S&C that we are not aware of (through PS for example) or is this alert setup somewhere else like in Azure AD for example?

 

Everything when researching this problem points back to the S&C centre being the place to be but like i said, it doesn't seem to exist.

 

Any suggestions would be greatly appreciated.

 

Regards,

3 Replies
Highlighted

@Howling_Mad Have You checked both the Activity Alerts and the Alert Policies? You will probably find it in one of those two locations.

 

Best regards, Magnus

Highlighted

Hey @Howling_Mad 

 

I've seen this where the alert was created in the 'Audit Log Search' part of S&C and doesn't show in the main alerts list.

 

Go to S&C centre, then alerts, then dashboard then find Other alerts and click on 'Activity Alert' and you should be able to delete it from there

 

SCC.png

 

Can also use Powershell with Get-ActivityAlert to find all of your alerts and pipe over to delete.

 

Hope this helps. Pretty sure I got this info from @Vasil Michev originally so thanks to him.

 

Cheers,

Mark

Highlighted

@HidMov 

 

Thanks for the response, just had a quick look in that section and no alerts are listed, which is a bit of pain. Ill have a check on powershell and see if the alert is listed then.

 

Regards,