microsoft-graph-apimicrosoft-graph-security

Creating a Microsoft Graph webhook subscription to security/alerts fails

When I attempt to create a Microsoft Graph webhook subscription to the security/alerts endpoint, the subscription creation fails with a generic message as shown below. Modifying the resource to 'me/messages' results in a successful webhook subscription created, so this appears to be specific to the security/alerts endpoint. How do I move past this?

enter image description here

The body of the request is as such:

{
  "changeType": "created",
  "notificationUrl": "https://xxxxxxxxx.azurewebsites.net/api/graphnotifications",
  "resource": "security/alerts?$filter=vendorInformation/provider+eq+'ASC'",
  "expirationDateTime": "2018-11-15T11:00:00.0000000Z",
  "clientState": "secretClientValue"
}
Solution

  • Please use 'updated' for 'changeType'. Security/Alerts uses 'updated' for all new or updated alerts.