microsoftgraph
Remove-MgBetaSecurityAuditLogQuery Does Not Work
Describe the bug
Using New-MgBetaSecurityAuditLogQuery I can successfully create a query and using Get-MgBetaSecurityAuditLogQuery I can successfully retrieve a query. However, I am unable to Remove this query (or any other query) using Remove-MgBetaSecurityAuditLogQuery.
$query = Get-MgBetaSecurityAuditLogQuery -AuditLogQueryID $Identifier
# this succeeds, and the query object is viewable
Remove-MgBetaSecurityAuditLogQuery, however, fails, when called in any of the following ways:
Remove-MgBetaSecurityAuditLogQuery -AuditLogQueryID $Identifier
Remove-MgBetaSecurityAuditLogQuery -AuditLogQueryID $query.Id
Failure:
Remove-MgBetaSecurityAuditLogQuery_DeleteViaIdentity: {"Message":"No HTTP resource was found that matches the request URI 'https://o365adtsearchapi-na003-aks.eastus.cloudapp.azure.com/security/auditLog/queries('<REDACTED>')'.","MessageDetail":"No type was found that matches the controller named 'queries'."}
Status: 404 (NotFound) ErrorCode: UnknownError Date: 2025-10-16T16:54:09
Headers: Cache-Control : no-cache Vary : Accept-Encoding Strict-Transport-Security : max-age=31536000 request-id : <REDACTED> client-request-id : <REDACTED> x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"East US","Slice":"E","Ring":"5","ScaleUnit":"008","RoleInstance":"BL02EPF0001B4C8"}} Date : Thu, 16 Oct 2025 16:54:09 GMT
Expected behavior
Remove-MgBetaSecurityAuditLogQuery should be able to be used to remove an existing query. This seems to be an underlying problem with the API, see https://github.com/microsoftgraph/msgraph-beta-sdk-java/issues/1162
How to reproduce
$NewQuery = New-MgBetaSecurityAuditLogQuery -DisplayName 'Repro' -FilterStartDateTime $(get-date).AddDays(-1) -FilterEndDateTime $(get-date)
$RetrievedQuery = Get-MGBetaSecurityAuditLogQuery -AuditLogQueryID $NewQuery.Id
#attempt to delete the query
Remove-MgBetaSecurityAuditLogQuery -AuditLogQueryID $RetrievedQuery.Id
SDK Version
2.31.0
Latest version known to work for scenario above?
No response
Known Workarounds
No response
Debug output
Click to expand log
```$myhash | Remove-MgBetaSecurityAuditLogQuery -Debug DEBUG: [CmdletBeginProcessing]: - Remove-MgBetaSecurityAuditLogQuery begin processing with parameterSet 'DeleteViaIdentity'. DEBUG: [Authentication]: - AuthType: 'AppOnly', TokenCredentialType: 'ClientSecret', ContextScope: 'Process', AppName: 'M365GraphAdmin'. DEBUG: [Authentication]: - Scopes: [Directory.ReadWrite.All, Sites.FullControl.All, TeamSettings.ReadWrite.All, AuditLogsQuery-Exchange.Read.All, AuditLogsQuery-SharePoint.Read.All, AuditLogsQuery-Entra.Read.All, Sites.ReadWrite.All, AuditLogsQuery.Read.All, AuditActivity.Write, AuditLogsQuery-OneDrive.Read.All, Files.ReadWrite.All, AuditLog.Read.All, AuditLogsQuery-CRM.Read.All, AuditLogsQuery-Endpoint.Read.All, AuditActivity.Read].
Confirm Are you sure you want to perform this action? Performing the operation "Remove-MgBetaSecurityAuditLogQuery_DeleteViaIdentity" on target "Call remote 'DELETE /security/auditLog/queries/{auditLogQuery-id}' operation". [Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): a DEBUG: ============================ HTTP REQUEST ============================
HTTP Method: DELETE
Absolute Uri: https://graph.microsoft.com/beta/security/auditLog/queries/bee53e0a-2bf1-489d-bb4e-1641a31f93be
Headers: Id : bee53e0a-2bf1-489d-bb4e-1641a31f93be AuditLogQueryID : bee53e0a-2bf1-489d-bb4e-1641a31f93be FeatureFlag : 00000003 Cache-Control : no-store, no-cache User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.26100; en-US),PowerShell/7.5.3 SdkVersion : graph-powershell-beta/2.31.0 client-request-id : e98fb6d1-4f94-4d7b-bbf0-2ab78d562d39 Accept-Encoding : gzip,deflate,br
Body:
DEBUG: ============================ HTTP RESPONSE ============================
Status Code: NotFound
Headers: Cache-Control : no-cache Vary : Accept-Encoding Strict-Transport-Security : max-age=31536000 request-id : ed53f1b5-d724-46a9-8ca8-1be2c2d47d87 client-request-id : e98fb6d1-4f94-4d7b-bbf0-2ab78d562d39 x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"East US","Slice":"E","Ring":"5","ScaleUnit":"010","RoleInstance":"MN1PEPF0002828D"}} Date : Thu, 16 Oct 2025 17:38:38 GMT
Body: { "error": { "code": "UnknownError", "message": "{"Message":"No HTTP resource was found that matches the request URI 'https://o365adtsearchapi-na004-aks.eastus.cloudapp.azure.com/security/auditLog/queries('<REDACTED>')'.","MessageDetail":"No type was found that matches the controller named 'queries'."}", "innerError": { "date": "2025-10-16T17:38:38", "request-id": "<REDACTED>, "client-request-id": "<REDACTED>" } } }
Remove-MgBetaSecurityAuditLogQuery_DeleteViaIdentity: {"Message":"No HTTP resource was found that matches the request URI 'https://o365adtsearchapi-na004-aks.eastus.cloudapp.azure.com/security/auditLog/queries('<REDACTED>')'.","MessageDetail":"No type was found that matches the controller named 'queries'."}
Status: 404 (NotFound) ErrorCode: UnknownError Date: 2025-10-16T17:38:38
Headers: Cache-Control : no-cache Vary : Accept-Encoding Strict-Transport-Security : max-age=31536000 request-id : <REDACTED> client-request-id : <REDACTED> x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"East US","Slice":"E","Ring":"5","ScaleUnit":"010","RoleInstance":"<REDACTED>"}} Date : Thu, 16 Oct 2025 17:38:38 GMT
Recommendation: See service error codes: https://learn.microsoft.com/graph/errors DEBUG: [CmdletEndProcessing]: - Remove-MgBetaSecurityAuditLogQuery end processing.
</details>
### Configuration
_No response_
### Other information
_No response_
This looks to be a case of the PowerShell cmdlet being generated where it should not be present
The documentation does not list a delete operation for this entity https://learn.microsoft.com/en-us/graph/api/resources/security-auditlogquery?view=graph-rest-beta
