Let’s say that we are browsing the Activity Log in Microsoft Purview and need information about a particular event, like “Added or removed user with delegate access to calendar folder“
We’d do that in the Audit log, by filtering the even and the date range
But what if we want to to subscribe for this activity and become an Alert, when it happens
If we go to the Alert Policies under “Policies” and create a new policy, we’ll see that this option is not available under the “Available Activities”
Solution:
There are two ways to achieve this:
Go to the following link:
Activity alerts – Microsoft 365 compliance
This link is not directly visible at first. It can be accessed either by going to the direct link, or by creating a new activity Alert with the PowerShell cmdlet New-ActivityAlert (ExchangePowerShell) | Microsoft Docs
Once you have created a new Activity Alert with PS, the following link will become visible under the Alert Policies
Once here, just create a New Alert Policy and here you have all options available under activities, including the one from our Demo
For a list of all Audited Events with PowerShell, you can refer to the Microsoft Documentation:
