Retirement of Alerts Policy cmdlets in Microsoft Purview Audit [MC1006620]

Message ID: MC1006620

Microsoft Purview previously offered the flexibility to create event alert policies through the Purview Audit solution (in addition to the more commonly used Data Loss Prevention alerts). On March 24, 2025, we will be retiring the event alerts capability within the Purview Audit solution. With this change, any existing alert policies which had been created through the Audit solution will no longer generate alerts and customers will no longer be able to create new alert policies through the Audit solution. This functionality had already been removed from the Purview Portal’s Audit UI in 2023. Starting March 24, 2025, support for the following cmdlets will also be retired:

Please note that the event alerts capability within Purview DLP will remain unaffected by this change. Any alert policies created through Purview DLP will continue to generate alerts as expected. We recommend that you use the alerts functionality within DLP, which is where we will continue to invest our development resources.

[How this will affect your organization:]

Any existing alert policies which you may have created through the Purview Audit solution will no longer generate alerts. Policies created through Purview DLP will remain unaffected.

[What you need to do to prepare:]

If you have any alert policies created using Purview Audit which you wish to retain, please re-create these alert policies through Purview DLP. To view a list of all alert policies created through audit, please use the Get-AuditConfigurationRule cmdlet, as illustrated below. This will be available to use until March 24, 2025.

Get-AuditConfigurationRule | Format-List Name,Workload,AuditOperation,Policy

For any new alerting requirements, we recommend that you use the alerts functionality within Purview DLP.

Learn more about DLP Alert Policies here: Get started with data loss prevention alerts | Microsoft Learn

Source: Microsoft

Mike Rosoft

15 February 2025, 10:53 am

The upcoming retirement of the Alerts Policy cmdlets in Microsoft Purview Audit, effective March 24, 2025, is certainly a significant change for both admins and users. While some may feel a bit like they’ve been thrown into the deep end without a life preserver, there’s no need to panic just yet!

For admins, this change means a shift in how alert policies are managed. Existing policies created through the Purview Audit solution will cease to generate alerts, which could initially feel like losing a trusty tool in your kit. However, fear not! Microsoft encourages the use of Purview DLP (Data Loss Prevention) for alert functionalities, which remains unaffected. This transition will require some proactive measures, such as recreating any necessary alert policies within the DLP framework. A little preparation now can save a lot of headaches later!

Users may find that while their alert notifications might take a hit initially, the overall integrity of their data monitoring remains intact through DLP. The focus on DLP also signals a commitment to enhancing data protection, which is a win-win for everyone involved!

In terms of impact, while this change may seem daunting, it’s an opportunity for organizations to streamline their alert processes and focus on DLP, an area where Microsoft plans to invest further resources. So, while we bid adieu to the Audit solution alerts, we can look forward to more robust DLP features down the line.

What are your thoughts on this update? Are you feeling ready to make the switch to DLP, or do you have concerns? Let’s hear from you in the comments! For more insights and discussions, don’t forget to check out other posts on mwpro.co.uk.

1 Comment

Mike Rosoft


15 February 2025, 10:53 am

The upcoming retirement of the Alerts Policy cmdlets in Microsoft Purview Audit, effective March 24, 2025, is certainly a significant change for both admins and users. While some may feel a bit like they’ve been thrown into the deep end without a life preserver, there’s no need to panic just yet!

For admins, this change means a shift in how alert policies are managed. Existing policies created through the Purview Audit solution will cease to generate alerts, which could initially feel like losing a trusty tool in your kit. However, fear not! Microsoft encourages the use of Purview DLP (Data Loss Prevention) for alert functionalities, which remains unaffected. This transition will require some proactive measures, such as recreating any necessary alert policies within the DLP framework. A little preparation now can save a lot of headaches later!

Users may find that while their alert notifications might take a hit initially, the overall integrity of their data monitoring remains intact through DLP. The focus on DLP also signals a commitment to enhancing data protection, which is a win-win for everyone involved!

In terms of impact, while this change may seem daunting, it’s an opportunity for organizations to streamline their alert processes and focus on DLP, an area where Microsoft plans to invest further resources. So, while we bid adieu to the Audit solution alerts, we can look forward to more robust DLP features down the line.

What are your thoughts on this update? Are you feeling ready to make the switch to DLP, or do you have concerns? Let’s hear from you in the comments! For more insights and discussions, don’t forget to check out other posts on mwpro.co.uk.

1 Comment

Leave a Reply Cancel reply