SecurityAlert.Read.All | Graph Permissions

Permission Details

Application Permission

Read all security alerts

Allows the app to read all security alerts, without a signed-in user.

Permission ID: 472e4a4d-bb4a-4026-98d1-0b0d74cb74a5

Delegated Permission

Read all security alerts

Allows the app to read all security alerts, on behalf of the signed-in user.

Permission ID: bc257fb8-46b4-4b15-8713-01e91bfbe4ea

Properties

Microsoft Graph v1.0 exact-category-docs

Properties is shown from stable Microsoft Graph v1.0 metadata.

Property	Type	Description
`actorDisplayName`	`String`Nullable	The adversary or activity group that is associated with this alert.
`additionalData`	`security.dictionary`	A collection of other alert properties, including user-defined properties. Any custom details defined in the alert, and any dynamic content in the alert details, are stored here.
`alertPolicyId`	`String`Nullable	The ID of the policy that generated the alert, and populated when there is a specific policy that generated the alert, whether configured by a customer or a built-in policy.
`alertWebUrl`	`String`Nullable	URL for the Microsoft 365 Defender portal alert page.
`assignedTo`	`String`Nullable	Owner of the alert, or null if no owner is assigned.
`categories`	`String collection`	The attack kill-chain categories that the alert belongs to. Aligned with the MITRE ATT&CK framework.
`classification`	`security.alertClassification`	Specifies whether the alert represents a true threat. The possible values are: unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue.
`comments`	`security.alertComment collection`	Array of comments created by the Security Operations (SecOps) team during the alert management process.
`createdDateTime`	`DateTimeOffset`Nullable	Time when Microsoft 365 Defender created the alert.
`customDetails`	`security.dictionary`	User defined custom fields with string values.
`description`	`String`Nullable	String value describing each alert.
`detectionSource`	`security.detectionSource`	Detection technology or sensor that identified the notable component or activity.
`detectorId`	`String`Nullable	The ID of the detector that triggered the alert.
`determination`	`security.alertDetermination`	Specifies the result of the investigation, whether the alert represents a true attack and if so, the nature of the attack. The possible values are: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedAccount, phishing, maliciousUserActivity, notMalicious, notEnoughDataToValidate, confirmedActivity, lineOfBusinessApplication, unknownFutureValue.
`evidence`	`security.alertEvidence collection`	Collection of evidence related to the alert.

Showing 15 of 37 properties.

JSON Representation

Microsoft Graph v1.0 exact-category-docs

JSON representation is shown from stable Microsoft Graph v1.0 metadata.

JSON representation

{
  "@odata.type": "#microsoft.graph.security.alert",
  "actorDisplayName": "String",
  "additionalData": {
    "@odata.type": "microsoft.graph.security.dictionary"
  },
  "alertWebUrl": "String",
  "assignedTo": "String",
  "category": "String",
  "categories": [
    "String"
  ],
  "classification": "String",
  "comments": [
    {
      "@odata.type": "microsoft.graph.security.alertComment"
    }
  ],
  "createdDateTime": "String (timestamp)",
  "customDetails": {
    "@odata.type": "microsoft.graph.security.dictionary"
  },
  "description": "String",
  "detectionSource": "String",
  "detectorId": "String",
  "determination": "String",
  "evidence": [
    {
      "@odata.type": "microsoft.graph.security.alertEvidence"
    }
  ],
  "firstActivityDateTime": "String (timestamp)",
  "id": "String (identifier)",
  "incidentId": "String",
  "incidentWebUrl": "String",
  "investigationState": "String",
  "lastActivityDateTime": "String (timestamp)",
  "lastUpdateDateTime": "String (timestamp)",
  "mitreTechniques": [
    "String"
  ],
  "productName": "String",
  "providerAlertId": "String",
  "recommendedActions": "String",
  "resolvedDateTime": "String (timestamp)",
  "serviceSource": "String",
  "severity": "String",
  "status": "String",
  "systemTags": [
    "String"
  ],
  "tenantId": "String",
  "threatDisplayName": "String",
  "threatFamilyName": "String",
  "title": "String"
}

Relationships

Microsoft Graph v1.0 schema-derived

Relationships is shown from stable Microsoft Graph v1.0 metadata.

Relationship	Type	Description
`categories`	`string collection`	The attack kill-chain categories that the alert belongs to. Aligned with the MITRE ATT&CK framework.
`comments`	`security.alertComment collection`	Array of comments created by the Security Operations (SecOps) team during the alert management process.
`evidence`	`security.alertEvidence collection`	Collection of evidence related to the alert.
`mitreTechniques`	`string collection`	The attack techniques, as aligned with the MITRE ATT&CK framework.
`serviceSource`	`security.serviceSource`	Related serviceSource data exposed by this resource.
`severity`	`security.alertSeverity`	Related severity data exposed by this resource.
`status`	`security.alertStatus`	Related status data exposed by this resource.
`systemTags`	`string collection`	The system tags associated with the alert.

Graph Methods

Delegated access App-only access

Exact Microsoft Learn match

Microsoft Graph v1.0 endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET `/security/alertsv2`
GET `/security/alertsv2/{alertId}`

Exact Microsoft Learn match

Microsoft Graph beta endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET `/security/alertsv2`
GET `/security/alertsv2/{alertId}`

Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell v1.0 commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
`Get-MgSecurityAlertV2` /security/alertsv2 List alertsv2
`Get-MgSecurityAlertV2` /security/alertsv2/{alertId} Get alert

Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell beta commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
`Get-MgBetaSecurityAlertV2` /security/alertsv2 List alertsv2
`Get-MgBetaSecurityAlertV2` /security/alertsv2/{alertId} Get alert

Code Examples

C# / .NET SDK

Get alert

View official example on Microsoft Learn

// Code snippets are only available for the latest version. Current version is 5.x

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Security.Alerts_v2["{alert-id}"].GetAsync();

JavaScript

Get alert

View official example on Microsoft Learn

const options = {
	authProvider,
};

const client = Client.init(options);

let alert = await client.api('/security/alerts_v2/da637578995287051192_756343937')
	.get();

PowerShell

Get alert

View official example on Microsoft Learn

Import-Module Microsoft.Graph.Security

Get-MgSecurityAlertV2 -AlertId $alertId

Python

Get alert

View official example on Microsoft Learn

# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python

result = await graph_client.security.alerts_v2.by_alert_id('alert-id').get()

App Registration

1

Navigate to Azure Portal

Go to App registrations in Microsoft Entra admin center

2

Add API Permission

Select your app → API permissions → Add a permission → Microsoft Graph

3

Select Permission Type

Choose Application permissions or delegated permissions and search for SecurityAlert.Read.All

4

Grant Admin Consent

Application permissions always require admin consent.

Frequently asked questions

What is the SecurityAlert.Read.All Microsoft Graph permission?

SecurityAlert.Read.All is available as both an application permission and a delegated permission in the Microsoft Graph API, grouped under the SecurityAlert category. Allows the app to read all security alerts, without a signed-in user. It grants read-only access to resources. Application permissions always require admin consent. It is mapped to the Microsoft Graph security-alert resource type. 4 documented Microsoft Graph REST methods require it. 4 Microsoft Graph PowerShell commands are documented for it.

Is SecurityAlert.Read.All an application or a delegated permission?

SecurityAlert.Read.All is available as both an application permission (app-only access, no signed-in user) and a delegated permission (access on behalf of a signed-in user).

Does SecurityAlert.Read.All require admin consent?

Application permissions always require admin consent.

What is the permission ID (GUID) for SecurityAlert.Read.All?

For SecurityAlert.Read.All, the application (app role) ID is 472e4a4d-bb4a-4026-98d1-0b0d74cb74a5, and the delegated (OAuth2 scope) ID is bc257fb8-46b4-4b15-8713-01e91bfbe4ea. These are the real Microsoft Graph identifiers and can be used directly in an app registration manifest.