Can't disable S&C alerts.

[Jan Duchač]

Hello,

I was learning about O365 alerts and just to test it a bit, I have created an alert that would notify me whenever I accessed a document in our company's tenant. Well it worked as expected so once tested, I wanted to disable it, but after I did so, I was still getting the email alerts. So I went even further and I deleted the alert in the security and compliance center, but nothing changed. It is already few weeks since I did so and I am still getting the emails whenever I access a document. 

I told one of my colleagues about my issue and he actually said that he has the same issue (made an alert few weeks back and tried to disable it / delete it but nothing helped, he is also getting the notifications). In his case it is even more annoying, since he set it to alert him if any of multiple colleagues access any file.

Are we doing something wrong? Or is it a bug?

Thanks for any help.

Jan Duchač

[#2]

Could be a bug and worth raising a service request but first I'd try PowerShell and see if that reveals anything that isn't shown in the portal.  Use Get-ActivityAlert to display any alerts that are set.  Further details are here and here.

[#3]

Hi,

thanks for fast reply. I actually never used powershell so this was a new thing for me. Once I installed PS for O365 I tried to run the Get-ActivityAlert but I have got an error that the command is not recognized. So i tried "Get-Command *Alert" if there are some commands with alert in name and it didnt find anything. Do I have to install some extension or what am I doing wrong?

Thanks

Jan Duchač

[#4]

If you follow the instructions here it should work:

Connect to Office 365 Security & Compliance Center PowerShell

Set-ExecutionPolicy RemoteSigned
$UserCredential = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.compliance.protection.outlook.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
Import-PSSession $Session

I tried the above code in a PowerShell (admin) console and the Get-ActivityAlert command worked ok. You may find the command doesn't return anything if it can't find any active alerts but it's worth a try.

Per that article, if not a global admin, there are additional steps here, that an admin can grant - Give users access to the Office 365 Security & Compliance Center.

[#5]

Thanks a lot, exactly what I needed :) I can now run the Get-ActivityAlert command. Problem is, that it only lists one alert (which is active alert in S&C) and it doesnt list the alerts I have a problem with. Guess I have to contact Microsoft support directly, since the alert emails are getting annoying and there seems to be no way to disable them.

Thanks a lot once again.

Have a nice day

Jan Duchač

[#6]

It was probably a long shot but worth doing, good luck with Office 365 support, hope they can resolve this for you.

Edit - @Jan Duchač If you get an answer to this from the service request and you have the time, please come back with what the resolution was, as it may help others who have the same issue, thanks!

[#7]

I sure will let let you know once I get it solved. I have submitted a support ticket, so hopefuly I will know the answer soon :)