CIPP AdvancedInstall

Summary

Updates a specific Microsoft Defender for Office 365 (MDO) alert with new properties.

Inputs

• tenantFilter (required) — The tenant to perform the operation on. Select from a list or enter the domain name (e.g., contoso.onmicrosoft.com).
• mdoAlertGuid (required) — The GUID of the MDO alert to update.
• mdoAlertFields — A collection of fields to update on the alert. Supports 'Assigned' (user@domain.com), 'Classification', 'Determination', and 'Status'.
• normalizeNumbers — Whether to convert string values that contain numbers (e.g., '4') to actual numbers. Useful when the API returns inconsistent types.

Output shape

A single item containing the updated alert record.

If the alert GUID is invalid or the tenant is unauthorized, the operation will fail.

Examples

Example 1: Change the status of a specific alert to 'Resolved' and assign it to a security analyst.

Set tenantFilter via list, provide the alert GUID, and set 'Status' to 'Resolved' in the Fields collection.

Example 2: Update the classification and determination of a phishing alert.

Set tenantFilter via domain, provide the alert GUID, and set 'Classification' and 'Determination' in the Fields collection.

Links

• n8n community nodes installation guide