Security GraphAPI "/alerts_v2" returns InternalServerError when selecting "evidence" property

Question

When using the security graph API, if the parameter "select=" contains the property "evidence" the server returns an "InternalServerError":

https://graph.microsoft.com/v1.0/security/alerts_v2?$top=2&select=id,evidence

{
    "error": {
        "code": "InternalServerError",
        "message": "Internal Server Error",
        "innerError": {
            "date": "2026-02-02T11:33:29",
            "request-id": "<redacted>",
            "client-request-id": "<redacted>"
        }
    }
}

The same request without the "evidence" property succeeds:

https://graph.microsoft.com/v1.0/security/alerts_v2?$top=2&select=id

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#security/alerts_v2",
    "value": [
        {
            "id": "<redacted>"
        },
        {
            "id": "<redacted>"
        }
    ]

Anyone facing the same issue?

Answer 1

When using the Microsoft Graph Security API, receiving an InternalServerError when selecting the evidence property could be due to a few reasons. This error might indicate that the server is unable to process the request correctly when this specific property is included. It is not uncommon for certain properties to cause issues if they are not fully supported or if there are underlying problems with the data associated with them.

In your case, since the request without the evidence property succeeds, it suggests that the issue is specifically related to that property. You may want to check the following:

1. API Version: Ensure you are using the correct version of the API and that the evidence property is supported in that version.
2. Data Availability: There may be instances where the evidence data is not available for the alerts you are querying, leading to an internal error.
3. Permissions: Ensure that the permissions associated with your access token are adequate to access the evidence property.
4. Microsoft Support: If the issue persists, consider reaching out to Microsoft support for further assistance, especially if this seems to be a recurring problem.

If you are still facing issues, you can also check the Microsoft documentation for any updates or known issues related to the evidence property in the Security API.

---

References:

• HTTP 403 authorization error when calling the Microsoft Graph Security API
• alertEvidence resource type