Retirement of Alerts Policy cmdlets in Microsoft Purview Audit

Microsoft Purview previously offered the flexibility to create event alert policies through the Purview Audit solution (in addition to the more commonly used Data Loss Prevention alerts). On March 24, 2025, we will be retiring the event alerts capability within the Purview Audit solution. With this change, any existing alert policies which had been created through the Audit solution will no longer generate alerts and customers will no longer be able to create new alert policies through the Audit solution. This functionality had already been removed from the Purview Portal’s Audit UI in 2023. Starting March 24, 2025, support for the following cmdlets will also be retired:

Please note that the event alerts capability within Purview DLP will remain unaffected by this change. Any alert policies created through Purview DLP will continue to generate alerts as expected. We recommend that you use the alerts functionality within DLP, which is where we will continue to invest our development resources.

How this will affect your organization

Any existing alert policies which you may have created through the Purview Audit solution will no longer generate alerts. Policies created through Purview DLP will remain unaffected.

What you need to do to prepare

If you have any alert policies created using Purview Audit which you wish to retain, please re-create these alert policies through Purview DLP. To view a list of all alert policies created through audit, please use the Get-AuditConfigurationRule cmdlet, as illustrated below. This will be available to use until March 24, 2025.

Get-AuditConfigurationRule | Format-List Name,Workload,AuditOperation,Policy

For any new alerting requirements, we recommend that you use the alerts functionality within Purview DLP.

Learn more about DLP Alert Policies here: Get started with data loss prevention alerts | Microsoft Learn