microsoftgraph / microsoftgraph/msgraph-sdk-powershell

Remove-MgBetaSecurityAuditLogQuery Does Not Work

Open
#3,421 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

type:bug
Dominant language
C#
Stars
898
Forks
230
Avg merge
2d 5h
Merged PRs (30d)
31

Description

Describe the bug

Using New-MgBetaSecurityAuditLogQuery I can successfully create a query and using Get-MgBetaSecurityAuditLogQuery I can successfully retrieve a query. However, I am unable to Remove this query (or any other query) using Remove-MgBetaSecurityAuditLogQuery.

$query = Get-MgBetaSecurityAuditLogQuery -AuditLogQueryID $Identifier
# this succeeds, and the query object is viewable

Remove-MgBetaSecurityAuditLogQuery, however, fails, when called in any of the following ways:

Remove-MgBetaSecurityAuditLogQuery -AuditLogQueryID $Identifier
Remove-MgBetaSecurityAuditLogQuery -AuditLogQueryID $query.Id

Failure:

Remove-MgBetaSecurityAuditLogQuery_DeleteViaIdentity: {"Message":"No HTTP resource was found that matches the request URI 'https://o365adtsearchapi-na003-aks.eastus.cloudapp.azure.com/security/auditLog/queries('')'.","MessageDetail":"No type was found that matches the controller named 'queries'."}

Status: 404 (NotFound)
ErrorCode: UnknownError
Date: 2025-10-16T16:54:09

Headers:
Cache-Control : no-cache
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id :
client-request-id :
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"East US","Slice":"E","Ring":"5","ScaleUnit":"008","RoleInstance":"BL02EPF0001B4C8"}}
Date : Thu, 16 Oct 2025 16:54:09 GMT

Expected behavior

Remove-MgBetaSecurityAuditLogQuery should be able to be used to remove an existing query.
This seems to be an underlying problem with the API, see https://github.com/microsoftgraph/msgraph-beta-sdk-java/issues/1162

How to reproduce

$NewQuery = New-MgBetaSecurityAuditLogQuery -DisplayName 'Repro' -FilterStartDateTime $(get-date).AddDays(-1) -FilterEndDateTime $(get-date)
$RetrievedQuery = Get-MGBetaSecurityAuditLogQuery -AuditLogQueryID $NewQuery.Id
#attempt to delete the query
Remove-MgBetaSecurityAuditLogQuery -AuditLogQueryID $RetrievedQuery.Id

SDK Version

2.31.0

Latest version known to work for scenario above?

No response

Known Workarounds

No response

Debug output
Click to expand log ```

$myhash | Remove-MgBetaSecurityAuditLogQuery -Debug
DEBUG: [CmdletBeginProcessing]: - Remove-MgBetaSecurityAuditLogQuery begin processing with parameterSet 'DeleteViaIdentity'.
DEBUG: [Authentication]: - AuthType: 'AppOnly', TokenCredentialType: 'ClientSecret', ContextScope: 'Process', AppName: 'M365GraphAdmin'.
DEBUG: [Authentication]: - Scopes: [Directory.ReadWrite.All, Sites.FullControl.All, TeamSettings.ReadWrite.All, AuditLogsQuery-Exchange.Read.All, AuditLogsQuery-SharePoint.Read.All, AuditLogsQuery-Entra.Read.All, Sites.ReadWrite.All, AuditLogsQuery.Read.All, AuditActivity.Write, AuditLogsQuery-OneDrive.Read.All, Files.ReadWrite.All, AuditLog.Read.All, AuditLogsQuery-CRM.Read.All, AuditLogsQuery-Endpoint.Read.All, AuditActivity.Read].

Confirm
Are you sure you want to perform this action?
Performing the operation "Remove-MgBetaSecurityAuditLogQuery_DeleteViaIdentity" on target "Call remote 'DELETE /security/auditLog/queries/{auditLogQuery-id}' operation".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): a
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
DELETE

Absolute Uri:
https://graph.microsoft.com/beta/security/auditLog/queries/bee53e0a-2bf1-489d-bb4e-1641a31f93be

Headers:
Id : bee53e0a-2bf1-489d-bb4e-1641a31f93be
AuditLogQueryID : bee53e0a-2bf1-489d-bb4e-1641a31f93be
FeatureFlag : 00000003
Cache-Control : no-store, no-cache
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.26100; en-US),PowerShell/7.5.3
SdkVersion : graph-powershell-beta/2.31.0
client-request-id : e98fb6d1-4f94-4d7b-bbf0-2ab78d562d39
Accept-Encoding : gzip,deflate,br

Body:

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
NotFound

Headers:
Cache-Control : no-cache
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : ed53f1b5-d724-46a9-8ca8-1be2c2d47d87
client-request-id : e98fb6d1-4f94-4d7b-bbf0-2ab78d562d39
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"East US","Slice":"E","Ring":"5","ScaleUnit":"010","RoleInstance":"MN1PEPF0002828D"}}
Date : Thu, 16 Oct 2025 17:38:38 GMT

Body:
{
"error": {
"code": "UnknownError",
"message": "{"Message":"No HTTP resource was found that matches the request URI 'https://o365adtsearchapi-na004-aks.eastus.cloudapp.azure.com/security/auditLog/queries('')'.","MessageDetail":"No type was found that matches the controller named 'queries'."}",
"innerError": {
"date": "2025-10-16T17:38:38",
"request-id": ",
"client-request-id": ""
}
}
}

Remove-MgBetaSecurityAuditLogQuery_DeleteViaIdentity: {"Message":"No HTTP resource was found that matches the request URI 'https://o365adtsearchapi-na004-aks.eastus.cloudapp.azure.com/security/auditLog/queries('')'.","MessageDetail":"No type was found that matches the controller named 'queries'."}

Status: 404 (NotFound)
ErrorCode: UnknownError
Date: 2025-10-16T17:38:38

Headers:
Cache-Control : no-cache
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id :
client-request-id :
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"East US","Slice":"E","Ring":"5","ScaleUnit":"010","RoleInstance":""}}
Date : Thu, 16 Oct 2025 17:38:38 GMT

Recommendation: See service error codes: https://learn.microsoft.com/graph/errors
DEBUG: [CmdletEndProcessing]: - Remove-MgBetaSecurityAuditLogQuery end processing.

</details>


### Configuration

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the failure with New-MgBetaSecurityAuditLogQuery, Get-MgBetaSecurityAuditLogQuery, and Remove-MgBetaSecurityAuditLogQuery, then inspect the recorded DELETE /beta/security/auditLog/queries/{auditLogQuery-id} request. Determine whether the SDK or the Microsoft Graph API owns the 404; done means an existing audit log query can be removed successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
powershell
Domain
api, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.