Forum Discussion
Old "activity alerts" broken?
A couple of years ago, we created notification alerts to be notified if a user creates a rule in their mailbox. We did this because this is a common action taken by malicious/unauthorized actors and ...
I've purchased my E3/P1 licenses directly from Microsoft. The support took 3 days to answer and then took screenshots and since then just more circular requests for screenshots of the admin portal and e-mail headers from the alert e-mails (which had already been gathered via screensharing.) My pleas to escalate because nothing has changed with our configuration or the alerts for several years, so far seem to be pleas to a process built to prevent/discourage escalation.
jcrowland I also can no longer edit the Activity Alerts in our tenant. Please let me know if you ever find out an answer to this issue as we have old activity alerts that the recipient needs to be adjusted. Even as a Global Admin I cannot make edits to those specific policies in the old Activity Alerts area.
- Working with support for a month through numerous "escalations" (not sure if that is real, but is called that) I have no resolution at all. For two weeks, I heard that they have new functionality in Alert policy - Microsoft Defender for this, but upon checking (again, as I had before opening a ticket) the only functionality is for a rule that is "created mail forward/redirect rule." I explained from the get-go and repeatedly that this isn't the functionality and is redundant because we don't permit forwarding out of our tenant, what we're replacing is an alert when any general rule is created, not a specific forwarding rule.
My guess, again, is that Microsoft sees this as an upsell opportunity to move this feature somewhere else and then sell it as another package or something, they just haven't got around to explaining that to anyone or documenting it. - Microsoft has definitely broken something here. It isn't permissions. My issue has be 'escalated' by support which means 7+ days without any further activity, did get confirmation that it seems to be a Microsoft issue. Hopefully someone reads Satya Nadella's memo on putting security first on the team that hobbled these features as they shift them around (to facilitate an upsell in licensing.)