Which API permission is required to access Email & Collaboration Alerts from Microsoft Defender for Office 365?

Question

Hello,

I am currently trying to collect Email & Collaboration Alerts via API, those seen in Microsoft Defender Portal → Email & Collaboration → Alerts view or in Microsoft Purview Portal → Compliance Alerts.

I have already registered an app in Azure AD and granted the following API permissions:

Microsoft Graph

• SecurityAlert.Read.All (Application permission)

WindowsDefenderATP

• Alert.Read.All (Application permission)

Admin consent has been granted successfully.

However, when I call: GET https://api.security.microsoft.com/api/alerts

I receive this error:

{ "error": { "code": "Forbidden", "message": "Missing application roles. API required roles: Alert.Read.All,Alert.ReadWrite.All, application roles: ." } }

Even though I already see Alert.Read.All assigned and consented.

Questions:

Are Email & Collaboration Alerts exposed through /api/alerts in the Microsoft 365 Defender API?

If not, is there a separate API or specific permission required to access alerts from:

Microsoft Defender for Office 365?

Microsoft Purview Compliance Portal?

What is the correct combination of:

API resource (e.g., Microsoft Graph, Security, or Purview)?

Permission (Delegated or Application)?

When I tried GET https://graph.microsoft.com/v1.0/security/alerts_v2 I only got alerts from Microsoft Defender for Endpoint, but not from Microsoft Defender For Office36, like in MS Defender or MS Purview portal.

Thank you in advance for your help.

Answer 1

The alerts_v2 in particular, as you've noted above, will return the Defender for Office 365 alerts. Make sure you have consented to the SecurityAlert.Read.All scope, and are using the correct authentication method (application permissions only work when you authenticate via client secret or certificate, you cannot use them when the app acts on behalf of a user, for example Graph explorer).

For example this query should return the top Defender for O365 alerts:

GET https://graph.microsoft.com/v1.0/security/alerts_v2?$filter=serviceSource eq 'microsoftDefenderForOffice365'&$select=id,title,createdDateTime