Alert Policies
Configure alert rules that notify administrators when specific security events or thresholds are detected.
Default Alert Policies
Microsoft 365 includes built-in alert policies for common security events. These can be customized but not deleted.
Custom Alert Policies
Create custom policies based on:
- Activity type — Admin actions, user actions, mailbox events
- Conditions — Severity, user, IP address, location
- Threshold — Trigger after N occurrences in time window
- Recipients — Email, Teams, or webhook notification
Severity Levels
| Severity | Examples |
|---|---|
| Critical | Admin consent to risky app, mass file deletion |
| High | Malware detected, suspicious forwarding rule |
| Medium | Unusual sign-in pattern, DLP policy match |
| Low | User reported phishing, password change |
API Reference
GET /api/security/alert-policies— List alert policiesPOST /api/security/alert-policies— Create policyPUT /api/security/alert-policies/:id— Update policy
Last updated on