Remove-MgBetaSecurityAuditLogQuery Does Not Work

[exactmike]

Describe the bug

Using New-MgBetaSecurityAuditLogQuery I can successfully create a query and using Get-MgBetaSecurityAuditLogQuery I can successfully retrieve a query. However, I am unable to Remove this query (or any other query) using Remove-MgBetaSecurityAuditLogQuery.

$query = Get-MgBetaSecurityAuditLogQuery -AuditLogQueryID $Identifier
# this succeeds, and the query object is viewable

Remove-MgBetaSecurityAuditLogQuery, however, fails, when called in any of the following ways:

Remove-MgBetaSecurityAuditLogQuery -AuditLogQueryID $Identifier
Remove-MgBetaSecurityAuditLogQuery -AuditLogQueryID $query.Id

Failure:

Remove-MgBetaSecurityAuditLogQuery_DeleteViaIdentity: {"Message":"No HTTP resource was found that matches the request URI 'https://o365adtsearchapi-na003-aks.eastus.cloudapp.azure.com/security/auditLog/queries('')'.","MessageDetail":"No type was found that matches the controller named 'queries'."}

Status: 404 (NotFound)
ErrorCode: UnknownError
Date: 2025-10-16T16:54:09

Headers:
Cache-Control : no-cache
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id :
client-request-id :
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"East US","Slice":"E","Ring":"5","ScaleUnit":"008","RoleInstance":"BL02EPF0001B4C8"}}
Date : Thu, 16 Oct 2025 16:54:09 GMT

Expected behavior

Remove-MgBetaSecurityAuditLogQuery should be able to be used to remove an existing query.
This seems to be an underlying problem with the API, see microsoftgraph/msgraph-beta-sdk-java#1162

How to reproduce

$NewQuery = New-MgBetaSecurityAuditLogQuery -DisplayName 'Repro' -FilterStartDateTime $(get-date).AddDays(-1) -FilterEndDateTime $(get-date)
$RetrievedQuery = Get-MGBetaSecurityAuditLogQuery -AuditLogQueryID $NewQuery.Id
#attempt to delete the query
Remove-MgBetaSecurityAuditLogQuery -AuditLogQueryID $RetrievedQuery.Id

SDK Version

2.31.0

Latest version known to work for scenario above?

No response

Known Workarounds

No response

Debug output

Click to expand log

```

$myhash | Remove-MgBetaSecurityAuditLogQuery -Debug
DEBUG: [CmdletBeginProcessing]: - Remove-MgBetaSecurityAuditLogQuery begin processing with parameterSet 'DeleteViaIdentity'.
DEBUG: [Authentication]: - AuthType: 'AppOnly', TokenCredentialType: 'ClientSecret', ContextScope: 'Process', AppName: 'M365GraphAdmin'.
DEBUG: [Authentication]: - Scopes: [Directory.ReadWrite.All, Sites.FullControl.All, TeamSettings.ReadWrite.All, AuditLogsQuery-Exchange.Read.All, AuditLogsQuery-SharePoint.Read.All, AuditLogsQuery-Entra.Read.All, Sites.ReadWrite.All, AuditLogsQuery.Read.All, AuditActivity.Write, AuditLogsQuery-OneDrive.Read.All, Files.ReadWrite.All, AuditLog.Read.All, AuditLogsQuery-CRM.Read.All, AuditLogsQuery-Endpoint.Read.All, AuditActivity.Read].

Confirm
Are you sure you want to perform this action?
Performing the operation "Remove-MgBetaSecurityAuditLogQuery_DeleteViaIdentity" on target "Call remote 'DELETE /security/auditLog/queries/{auditLogQuery-id}' operation".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): a
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
DELETE

Absolute Uri:
https://graph.microsoft.com/beta/security/auditLog/queries/bee53e0a-2bf1-489d-bb4e-1641a31f93be

Headers:
Id : bee53e0a-2bf1-489d-bb4e-1641a31f93be
AuditLogQueryID : bee53e0a-2bf1-489d-bb4e-1641a31f93be
FeatureFlag : 00000003
Cache-Control : no-store, no-cache
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.26100; en-US),PowerShell/7.5.3
SdkVersion : graph-powershell-beta/2.31.0
client-request-id : e98fb6d1-4f94-4d7b-bbf0-2ab78d562d39
Accept-Encoding : gzip,deflate,br

Body:

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
NotFound

Headers:
Cache-Control : no-cache
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : ed53f1b5-d724-46a9-8ca8-1be2c2d47d87
client-request-id : e98fb6d1-4f94-4d7b-bbf0-2ab78d562d39
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"East US","Slice":"E","Ring":"5","ScaleUnit":"010","RoleInstance":"MN1PEPF0002828D"}}
Date : Thu, 16 Oct 2025 17:38:38 GMT

Body:
{
"error": {
"code": "UnknownError",
"message": "{"Message":"No HTTP resource was found that matches the request URI 'https://o365adtsearchapi-na004-aks.eastus.cloudapp.azure.com/security/auditLog/queries('')'.","MessageDetail":"No type was found that matches the controller named 'queries'."}",
"innerError": {
"date": "2025-10-16T17:38:38",
"request-id": ",
"client-request-id": ""
}
}
}

Remove-MgBetaSecurityAuditLogQuery_DeleteViaIdentity: {"Message":"No HTTP resource was found that matches the request URI 'https://o365adtsearchapi-na004-aks.eastus.cloudapp.azure.com/security/auditLog/queries('')'.","MessageDetail":"No type was found that matches the controller named 'queries'."}

Status: 404 (NotFound)
ErrorCode: UnknownError
Date: 2025-10-16T17:38:38

Headers:
Cache-Control : no-cache
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id :
client-request-id :
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"East US","Slice":"E","Ring":"5","ScaleUnit":"010","RoleInstance":""}}
Date : Thu, 16 Oct 2025 17:38:38 GMT

Recommendation: See service error codes: https://learn.microsoft.com/graph/errors
DEBUG: [CmdletEndProcessing]: - Remove-MgBetaSecurityAuditLogQuery end processing.

</details>


### Configuration

_No response_

### Other information

_No response_

[gavinbarron]

This looks to be a case of the PowerShell cmdlet being generated where it should not be present

The documentation does not list a delete operation for this entity https://learn.microsoft.com/en-us/graph/api/resources/security-auditlogquery?view=graph-rest-beta