I can run legacy alert API (/v1.0/security/alerts) successfully and can get result. But when I run new alert API(/v1.0/security/alerts_v2), it returns null.

Question

Firstly, I have configured required permissions for the application.

Secondly, I try both legacy alert API(/v1.0/security/alerts) and new alert API(/v1.0/security/alerts_v2), and I can get result from legacy alert API, but new alert API returns NULL.

Thirdly, my license is E3. When I use a tenant with E5 license, both APIs can returned data.

My question is why new alert API(/v1.0/security/alerts_v2) cannot return data with E5 license?

Answer 1

I can confirm, that the v2 API only works if a defender license is assigned. Furthermore you have to at least once login into the security center and open the alerts menu (https://security.microsoft.com/alerts). You may see the following:

After a couple of minutes you can view the alerts in the security admin center and the v2 graph endpoint will work as well.

I do not understand why we have to use different endpoint depending on the license. If you have to monitor alerts for a lot of customer tenants with different licenses things like these are very frustrating to deal with, because its not clearly documented anywhere.