List alerts

Retrieve a list of alert objects.


One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Permissions.

Permission type Permissions (from least to most privileged)
Delegated (work or school account) SecurityEvents.Read.All, SecurityEvents.ReadWrite.All
Delegated (personal Microsoft account) Not supported.
Application SecurityEvents.Read.All, SecurityEvents.ReadWrite.All

HTTP request

GET /security/alerts
GET /security/alerts?$top=1
GET /security/alerts?$filter={property} eq '{property-value}'
GET /security/alerts?$filter={property} eq '{property-value}'&$top=5
GET /security/alerts?$filter={property} eq '{property-value}' and {property} eq '{property-value}'

Optional query parameters

This method supports the following OData query parameters to help customize the response:

  • $count
  • $filter
  • $orderby
  • $select
  • $skip
  • $top will return the aggregated top results from each security API provider.

To return an alternative property set, use the OData $select query parameter to specify the set of alert properties that you want. For example, to return the assignedTo, category, and severity properties, add the following to your query: $select=assignedTo,category,severity.

Note: $top has a limit of 1000 alerts, and a combination of $top + $skip cannot exceed 6000 alerts. For example, /security/alerts?$top=10&$skip=5990 will return a 200 OK response code, but /security/alerts?$top=10&$skip=5991 will return a 400 Bad Request response code. For more information, see Microsoft Graph Security API error responses.

Request headers

Name Description
Authorization Bearer {code}. Required.

Request body

Do not supply a request body for this method. The request body will be ignored.


If successful, this method returns a 200 OK response code and collection of alert objects in the response body. If a status code other than 2xx or 404 is returned from a provider or if a provider times out, the response will be a 206 Partial Content status code with the provider's response in a warning header. For more information, see Microsoft Graph Security API error responses.



The following is an example of the request.



The following is an example of the response.

Note: The response object shown here might be shortened for readability. All the properties will be returned from an actual call.

HTTP/1.1 200 OK
Content-type: application/json

  "value": [
      "activityGroupName": "activityGroupName-value",
      "assignedTo": "assignedTo-value",
      "azureSubscriptionId": "azureSubscriptionId-value",
      "azureTenantId": "azureTenantId-value",
      "category": "category-value",
      "closedDateTime": "datetime-value"