Skip to content
exonaut

protectionAlerts

Activity Alerts. Purview activity alert policies that trigger on admin events. The protectionAlerts entity set lives under /exchange/v1.0/protectionAlerts in the Threat protection category.

Fact Value
Path /exchange/v1.0/protectionAlerts
Category Threat protection
Tier Tier 5, Compliance
Read role Compliance.IPPS.Read.All (Community)
Write role Compliance.IPPS.ReadWrite.All (Enterprise)
Backing cmdlets Get-ProtectionAlert, Set-ProtectionAlert, New-ProtectionAlert, Remove-ProtectionAlert

Routes

Section titled “Routes”
Method Path Synopsis Role Plan
GET /exchange/v1.0/protectionAlerts List protectionAlerts entries. Compliance.IPPS.Read Community
POST /exchange/v1.0/protectionAlerts Create via New-ProtectionAlert (IPPS). Required: name + category + notifyUser + threatType. Compliance.IPPS.ReadWrite Enterprise
GET /exchange/v1.0/protectionAlerts/{key} Get a single protectionAlerts entry by Identity. Compliance.IPPS.Read Community
PATCH /exchange/v1.0/protectionAlerts/{key} Partial update via Set-ProtectionAlert. Compliance.IPPS.ReadWrite Enterprise
DELETE /exchange/v1.0/protectionAlerts/{key} Remove via Remove-ProtectionAlert. Injects -ForceDeletion (the cmdlet has no -Confirm) to delete non-interactively. Compliance.IPPS.ReadWrite Enterprise

GET /exchange/v1.0/protectionAlerts

Section titled “GET /exchange/v1.0/protectionAlerts”

List protectionAlerts entries.

Backing cmdlet: Get-ProtectionAlert. Role: Compliance.IPPS.Read (Community).

List protection alert rules

Section titled “List protection alert rules”

Returns the Microsoft Purview activity alert policies (protection alerts) configured in the tenant, including built-in threat-management and compliance alert rules. Each entry exposes the rule’s category, severity, trigger filter, and notification settings.

GET /exchange/v1.0/protectionAlerts HTTP/1.1
Authorization: Bearer {token}
HTTP/1.1 200 OK


{
  "@odata.context": "https://api.contoso.com/exchange/v1.0/$metadata#protectionAlerts",
  "value": [
    {
      "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/a1b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c/Configuration/A potentially malicious URL click was detected",
      "Name": "A potentially malicious URL click was detected",
      "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/a1b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c/Configuration/A potentially malicious URL click was detected",
      "Category": "ThreatManagement",
      "ThreatType": "MaliciousUrlClick",
      "Severity": "High",
      "NotifyUser": [
        "TenantAdmins"
      ],
      "Operation": [],
      "Filter": "(Click.IsLookBack -eq 1)",
      "Disabled": false,
      "NotificationEnabled": true,
      "Threshold": null,
      "TimeWindow": null,
      "AggregationType": "None",
      "Description": null,
      "Comment": "We have detected that one of your users has recently clicked on a link that was found to be malicious. -V1.0.0.5",
      "WhenCreated": "2020-02-04T04:59:35+02:00",
      "WhenChanged": "2022-05-31T17:06:56+03:00",
      "AlertBy": null,
      "AlertFor": null,
      "AlertOverrideChangedUtc": null,
      "AlertScenario": "MaliciousUrlClick",
      "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000",
      "CreatedBy": "",
      "CustomProperties": null,
      "DistinguishedName": "CN=A potentially malicious URL click was detected,CN=Configuration,CN=a1b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com",
      "ErrorMetadata": null,
      "ExchangeObjectId": "a74bb32a-541b-47fb-adfd-f8c62ce3d59b",
      "ExternalIdentity": "",
      "ExternalScenarioData": null,
      "Guid": "a74bb32a-541b-47fb-adfd-f8c62ce3d59b",
      "ImmutableId": "a74bb32a-541b-47fb-adfd-f8c62ce3d59b",
      "IsSystemRule": true,
      "LastModifiedBy": "",
      "LogicalOperationName": null,
      "MaximumBlobRuleLength": 0,
      "MergedRuleXml": null,
      "Mode": "Enforce",
      "NotificationCulture": null,
      "NotifyUserOnFilterMatch": false,
      "NotifyUserSuppressionExpiryDate": null,
      "NotifyUserThrottleThreshold": null,
      "NotifyUserThrottleWindow": null,
      "ObjectVersion": "d171a35d-913b-4176-45d8-08da430ed265",
      "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/a1b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c",
      "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/a1b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/a1b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c/Configuration",
      "Policy": "e9a4983d-9f4e-47b0-80d1-fb2097adb484",
      "Priority": 0,
      "PrivacyManagementScopedSensitiveInformationTypes": null,
      "PrivacyManagementScopedSensitiveInformationTypesForCounting": null,
      "PrivacyManagementScopedSensitiveInformationTypesThreshold": null,
      "ReadOnly": false,
      "RecipientTags": null,
      "Scenario": "MaliciousUrlClick",
      "SenderTags": null,
      "StreamType": "None",
      "TagFilter": null,
      "UseCreatedDateTime": null,
      "UserTags": null,
      "VolumeThreshold": null,
      "WhenChangedUTC": "2022-05-31T14:06:56Z",
      "WhenCreatedUTC": "2020-02-04T02:59:35Z",
      "Workload": "AuditAlerting"
    },
    {
      "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/a1b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c/Configuration/A Tenant Allow Block List entry has been found malicious",
      "Name": "A Tenant Allow Block List entry has been found malicious",
      "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/a1b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c/Configuration/A Tenant Allow Block List entry has been found malicious",
      "Category": "ThreatManagement",
      "ThreatType": "Activity",
      "Severity": "Informational",
      "NotifyUser": [
        "TenantAdmins"
      ],
      "Operation": [
        "TenantAllowBlockListItemGraderDisagree"
      ],
      "Filter": null,
      "Disabled": false,
      "NotificationEnabled": true,
      "Threshold": null,
      "TimeWindow": null,
      "AggregationType": "None",
      "Description": null,
      "Comment": "A Tenant Allow/Block List entry has been found malicious by grader. We recommend you remove the allow entry from the Tenant Allow/Block List. -V1.0.0.1",
      "WhenCreated": "2023-04-06T15:22:52+03:00",
      "WhenChanged": "2023-04-06T15:22:52+03:00",
      "AlertBy": null,
      "AlertFor": null,
      "AlertOverrideChangedUtc": null,
      "AlertScenario": "Activity",
      "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000",
      "CreatedBy": "",
      "CustomProperties": null,
      "DistinguishedName": "CN=A Tenant Allow Block List entry has been found malicious,CN=Configuration,CN=a1b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com",
      "ErrorMetadata": null,
      "ExchangeObjectId": "5ba37278-d17b-4674-bde7-d19ad231e324",
      "ExternalIdentity": "",
      "ExternalScenarioData": null,
      "Guid": "5ba37278-d17b-4674-bde7-d19ad231e324",
      "ImmutableId": "5ba37278-d17b-4674-bde7-d19ad231e324",
      "IsSystemRule": true,
      "LastModifiedBy": "",
      "LogicalOperationName": null,
      "MaximumBlobRuleLength": 0,
      "MergedRuleXml": null,
      "Mode": "Enforce",
      "NotificationCulture": null,
      "NotifyUserOnFilterMatch": false,
      "NotifyUserSuppressionExpiryDate": null,
      "NotifyUserThrottleThreshold": null,
      "NotifyUserThrottleWindow": null,
      "ObjectVersion": "3c138103-9c59-48a3-5da2-08db3699a4a8",
      "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/a1b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c",
      "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/a1b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/a1b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c/Configuration",
      "Policy": "00341b6e-c377-4f92-9fcb-57808f9bc1c2",
      "Priority": 0,
      "PrivacyManagementScopedSensitiveInformationTypes": null,
      "PrivacyManagementScopedSensitiveInformationTypesForCounting": null,
      "PrivacyManagementScopedSensitiveInformationTypesThreshold": null,
      "ReadOnly": false,
      "RecipientTags": null,
      "Scenario": "AuditProtectionAlert",
      "SenderTags": null,
      "StreamType": "Activity",
      "TagFilter": null,
      "UseCreatedDateTime": null,
      "UserTags": null,
      "VolumeThreshold": null,
      "WhenChangedUTC": "2023-04-06T12:22:52Z",
      "WhenCreatedUTC": "2023-04-06T12:22:52Z",
      "Workload": "AuditAlerting"
    },
    {
      "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/a1b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c/Configuration/A user clicked through to a potentially malicious URL​",
      "Name": "A user clicked through to a potentially malicious URL​",
      "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/a1b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c/Configuration/A user clicked through to a potentially malicious URL​",
      "Category": "ThreatManagement",
      "ThreatType": "MaliciousUrlClick",
      "Severity": "High",
      "NotifyUser": [
        "TenantAdmins"
      ],
      "Operation": [],
      "Filter": "(Click.IsSystemBlockOverriden -eq 1) -or (Click.IsTenantBlockOverriden -eq 1)",
      "Disabled": false,
      "NotificationEnabled": true,
      "Threshold": null,
      "TimeWindow": null,
      "AggregationType": "None",
      "Description": null,
      "Comment": "We have detected that one of your users has recently clicked through on a link that was found to be malicious. -V1.0.0.3",
      "WhenCreated": "2022-05-31T17:06:57+03:00",
      "WhenChanged": "2022-05-31T17:06:57+03:00",
      "AlertBy": null,
      "AlertFor": null,
      "AlertOverrideChangedUtc": null,
      "AlertScenario": "MaliciousUrlClick",
      "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000",
      "CreatedBy": "",
      "CustomProperties": null,
      "DistinguishedName": "CN=A user clicked through to a potentially malicious URL​,CN=Configuration,CN=a1b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com",
      "ErrorMetadata": null,
      "ExchangeObjectId": "5453b67e-6c81-4a46-b96c-08d97b58d4ac",
      "ExternalIdentity": "",
      "ExternalScenarioData": null,
      "Guid": "5453b67e-6c81-4a46-b96c-08d97b58d4ac",
      "ImmutableId": "5453b67e-6c81-4a46-b96c-08d97b58d4ac",
      "IsSystemRule": true,
      "LastModifiedBy": "",
      "LogicalOperationName": null,
      "MaximumBlobRuleLength": 0,
      "MergedRuleXml": null,
      "Mode": "Enforce",
      "NotificationCulture": null,
      "NotifyUserOnFilterMatch": false,
      "NotifyUserSuppressionExpiryDate": null,
      "NotifyUserThrottleThreshold": null,
      "NotifyUserThrottleWindow": null,
      "ObjectVersion": "26de2427-5060-4bec-007d-08da430ed305",
      "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/a1b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c",
      "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/a1b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/a1b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c/Configuration",
      "Policy": "e7fec753-4e4b-491c-2152-08d97b58ad34",
      "Priority": 0,
      "PrivacyManagementScopedSensitiveInformationTypes": null,
      "PrivacyManagementScopedSensitiveInformationTypesForCounting": null,
      "PrivacyManagementScopedSensitiveInformationTypesThreshold": null,
      "ReadOnly": false,
      "RecipientTags": null,
      "Scenario": "MaliciousUrlClick",
      "SenderTags": null,
      "StreamType": "None",
      "TagFilter": null,
      "UseCreatedDateTime": null,
      "UserTags": null,
      "VolumeThreshold": null,
      "WhenChangedUTC": "2022-05-31T14:06:57Z",
      "WhenCreatedUTC": "2022-05-31T14:06:57Z",
      "Workload": "AuditAlerting"
    }
  ]
}

Related: GET /exchange/v1.0/protectionAlerts/{key}

POST /exchange/v1.0/protectionAlerts

Section titled “POST /exchange/v1.0/protectionAlerts”

Create via New-ProtectionAlert (IPPS). Required: name + category + notifyUser + threatType.

IPPS-side - controller passes omitConfirm: true (IPPS write cmdlets reject -Confirm).

Backing cmdlet: New-ProtectionAlert. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter In Type Required Description
category body yes
name body yes
notifyUser body yes
threatType body yes
aggregationType body
alertBy body
alertFor body
comment body
correlationPolicyId body
customProperties body
description body
disabled body
filter body
logicalOperationName body
notificationCulture body
notificationEnabled body
notifyUserOnFilterMatch body
notifyUserSuppressionExpiryDate body
notifyUserThrottleThreshold body
notifyUserThrottleWindow body
operation body
privacyManagementScopedSensitiveInformationTypes body
privacyManagementScopedSensitiveInformationTypesForCounting body
privacyManagementScopedSensitiveInformationTypesThreshold body
severity body
threshold body
timeWindow body
useCreatedDateTime body
volumeThreshold body
dryRun query bool (switch)

Create a Purview activity alert rule

Section titled “Create a Purview activity alert rule”

Create a new Purview activity alert via New-ProtectionAlert (IPPS pool - uses Compliance.IPPS.ReadWrite.All, not ThreatPolicy.*). Required: name + category + notifyUser + threatType. The rule fires when a matching operation occurs above the threshold within timeWindow seconds and emails notifyUser. Filter is OPATH against the activity log; use volumeThreshold for high-cardinality detection.

POST /exchange/v1.0/protectionAlerts HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json


{
  "name": "Mailbox-Permission-Grant-Alert",
  "category": "ThreatManagement",
  "threatType": "Activity",
  "notifyUser": [
    "[email protected]"
  ],
  "severity": "High",
  "operation": [
    "Add-MailboxPermission"
  ],
  "threshold": 1,
  "timeWindow": 60,
  "aggregationType": "None",
  "notificationEnabled": true,
  "description": "Alert SOC when any Add-MailboxPermission operation succeeds on the tenant.",
  "comment": "Created via API per security baseline"
}
HTTP/1.1 201 Created
Location: /exchange/v1.0/protectionAlerts/Mailbox-Permission-Grant-Alert


{
  "@odata.context": "https://api.contoso.com/exchange/v1.0/$metadata#protectionAlerts/$entity",
  "Id": "alert-mailbox-permission-grant-guid",
  "Name": "Mailbox-Permission-Grant-Alert",
  "Identity": "alert-mailbox-permission-grant-guid",
  "Category": "ThreatManagement",
  "ThreatType": "Activity",
  "Severity": "High",
  "NotifyUser": [
    "[email protected]"
  ],
  "Operation": [
    "Add-MailboxPermission"
  ],
  "Threshold": 1,
  "TimeWindow": 60,
  "NotificationEnabled": true,
  "Disabled": false,
  "WhenCreated": "2026-05-26T10:00:00Z"
}

Related: GET /exchange/v1.0/protectionAlerts, PATCH /exchange/v1.0/protectionAlerts/{key}, DELETE /exchange/v1.0/protectionAlerts/{key}

GET /exchange/v1.0/protectionAlerts/{key}

Section titled “GET /exchange/v1.0/protectionAlerts/{key}”

Get a single protectionAlerts entry by Identity.

Backing cmdlet: Get-ProtectionAlert. Role: Compliance.IPPS.Read (Community).

Get a protection alert by identity

Section titled “Get a protection alert by identity”

Retrieve a single Microsoft Purview protection alert (activity alert rule) by its Identity. Returns the full alert definition including severity, threat type, filter, and notification configuration.

GET /exchange/v1.0/protectionAlerts/{key} HTTP/1.1
Authorization: Bearer {token}
HTTP/1.1 200 OK


{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#protectionAlerts/$entity",
  "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A potentially malicious URL click was detected",
  "Name": "A potentially malicious URL click was detected",
  "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A potentially malicious URL click was detected",
  "Category": "ThreatManagement",
  "ThreatType": "MaliciousUrlClick",
  "Severity": "High",
  "NotifyUser": [
    "TenantAdmins"
  ],
  "Operation": [],
  "Filter": "(Click.IsLookBack -eq 1)",
  "Disabled": false,
  "NotificationEnabled": true,
  "Threshold": null,
  "TimeWindow": null,
  "AggregationType": "None",
  "Description": null,
  "Comment": "We have detected that one of your users has recently clicked on a link that was found to be malicious. -V1.0.0.5",
  "WhenCreated": "2020-02-04T04:59:35+02:00",
  "WhenChanged": "2022-05-31T17:06:56+03:00",
  "AlertBy": null,
  "AlertFor": null,
  "AlertOverrideChangedUtc": null,
  "AlertScenario": "MaliciousUrlClick",
  "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000",
  "CreatedBy": "",
  "CustomProperties": null,
  "DistinguishedName": "CN=A potentially malicious URL click was detected,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com",
  "ErrorMetadata": null,
  "ExchangeObjectId": "a74bb32a-541b-47fb-adfd-f8c62ce3d59b",
  "ExternalIdentity": "",
  "ExternalScenarioData": null,
  "Guid": "a74bb32a-541b-47fb-adfd-f8c62ce3d59b",
  "ImmutableId": "a74bb32a-541b-47fb-adfd-f8c62ce3d59b",
  "IsSystemRule": true,
  "LastModifiedBy": "",
  "LogicalOperationName": null,
  "MaximumBlobRuleLength": 0,
  "MergedRuleXml": null,
  "Mode": "Enforce",
  "NotificationCulture": null,
  "NotifyUserOnFilterMatch": false,
  "NotifyUserSuppressionExpiryDate": null,
  "NotifyUserThrottleThreshold": null,
  "NotifyUserThrottleWindow": null,
  "ObjectVersion": "d171a35d-913b-4176-45d8-08da430ed265",
  "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e",
  "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration",
  "Policy": "e9a4983d-9f4e-47b0-80d1-fb2097adb484",
  "Priority": 0,
  "PrivacyManagementScopedSensitiveInformationTypes": null,
  "PrivacyManagementScopedSensitiveInformationTypesForCounting": null,
  "PrivacyManagementScopedSensitiveInformationTypesThreshold": null,
  "ReadOnly": false,
  "RecipientTags": null,
  "Scenario": "MaliciousUrlClick",
  "SenderTags": null,
  "StreamType": "None",
  "TagFilter": null,
  "UseCreatedDateTime": null,
  "UserTags": null,
  "VolumeThreshold": null,
  "WhenChangedUTC": "2022-05-31T14:06:56Z",
  "WhenCreatedUTC": "2020-02-04T02:59:35Z",
  "Workload": "AuditAlerting"
}

Related: GET /exchange/v1.0/protectionAlerts

PATCH /exchange/v1.0/protectionAlerts/{key}

Section titled “PATCH /exchange/v1.0/protectionAlerts/{key}”

Partial update via Set-ProtectionAlert.

Backing cmdlet: Set-ProtectionAlert. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter In Type Required Description
aggregationType body
alertBy body
alertFor body
category body
comment body
description body
disabled body
filter body
notificationCulture body
notificationEnabled body
notifyUser body
notifyUserOnFilterMatch body
notifyUserSuppressionExpiryDate body
notifyUserThrottleThreshold body
notifyUserThrottleWindow body
operation body
privacyManagementScopedSensitiveInformationTypes body
privacyManagementScopedSensitiveInformationTypesForCounting body
privacyManagementScopedSensitiveInformationTypesThreshold body
severity body
threshold body
timeWindow body
volumeThreshold body
dryRun query bool (switch)

Update a protection alert

Section titled “Update a protection alert”

Partially update a Purview activity alert rule via Set-ProtectionAlert. Only the SetWritable fields are accepted; ThreatType, CorrelationPolicyId, and other create-only fields are immutable post-creation.

PATCH /exchange/v1.0/protectionAlerts/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json


{
  "severity": "High",
  "notifyUser": [
    "[email protected]"
  ],
  "disabled": false
}
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8


{
  "Identity": "exonaut-sample-protectionAlerts",
  "Name": "exonaut-sample-protectionAlerts",
  "Severity": "High",
  "NotifyUser": [
    "[email protected]"
  ],
  "Disabled": false,
  "Category": "ThreatManagement",
  "ThreatType": "Activity"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/protectionAlerts

DELETE /exchange/v1.0/protectionAlerts/{key}

Section titled “DELETE /exchange/v1.0/protectionAlerts/{key}”

Remove via Remove-ProtectionAlert. Injects -ForceDeletion (the cmdlet has no -Confirm) to delete non-interactively.

Backing cmdlet: Remove-ProtectionAlert. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter In Type Required Description
dryRun query bool (switch)

Delete a protection alert

Section titled “Delete a protection alert”

Remove a Purview activity alert rule via Remove-ProtectionAlert. The controller passes -ForceDeletion internally (not -Force) and omits -Confirm, since IPPS write cmdlets reject -Confirm.

DELETE /exchange/v1.0/protectionAlerts/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json
HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/protectionAlerts

?dryRun=true previews of any write stay on Community.