Set activity alerts using PowerShell issues

[Robert Crane]

I have used the following command:

new-activityalert -name "Elevation of Privilege" -NotifyUser "user@domain.com" -type elevationofprivilege

and it completed successfully. I do not however see this new alert listed in the browser interface in the Manage Alerts area.

Also if I execute the following, I see no listing of this new alert:

get-activityalert

but if I execute:

get-activityalert -identity "Elevation of Privilege"

I do see the alert.

Any ideas what I missing and why the initial alert creation in PwoerShell works but then doesn't appear anywhere unless I ask for it by name??

[#2]

I can confirm that behavior, and here's my theory as to why. They seem to be moving away from the old "activity alerts" (*-ActivityAlert) and focusing on the newer "alert policies" (*-ProtectionAlert). In the SCC, getting to the "activity alerts" page is a challenge nowadays, and I get the same behavior when I try to create an activity alert from the UI. So I don't think it's anything specific to PowerShell, but more of a deliberate decision on their end to "de-emphasize" this feature.

Not sure who the PM on this feature is though, so if you want an official answer best open a support case.

[#3]

Here's the rub. From - https://support.office.com/en-us/article/alert-policies-in-the-office-365-security-compliance-center...

Note: Alert policies are available for organizations with an Office 365 Enterprise E1, E3, or E5 subscription. However, some advanced functionality is only available for organizations with an E5 subscription, or for organizations that have an E1 or E3 subscription and an Office 365 Threat Intelligence or Office 365 Advanced Compliance add-on subscription. The functionality that requires an E5 or add-on subscription is highlighted in this topic.

So the new-protectionalert module won't function with Business Plans? Including M 365 Business??

[#4]

Actually, I believe even E1 tenants don't have access to alert policies (at least cannot create new ones). So yeah, far from ideal replacement...

[#5]

I can confirm that alert policies created with the PS Cmdlet "New-ActivityAlert" are not shown in the Office 365 SCC Alert Policy section. However, if I check for the presence of the alert policy by "Get-AlertPolicy", it shows up. It seems that Microsoft want to enforce having a E5 plan or the Office 365 Threat Intelligence or Office 365 Advanced Compliance add-on subscription for E1 and E3 plans in order to make use of the policies... (source: https://support.office.com/en-us/article/alert-policies-in-the-office-365-security-compliance-center...)
Furthermore, they introduced a new Cmdlet "New-ProtectionAlert" (source: https://docs.microsoft.com/en-us/powershell/module/exchange/policy-and-compliance/new-protectionaler...).