Stay informed with Microsoft 365 Lighthouse
Microsoft 365 Lighthouse provides insights across your SMB customers on where you will want to act with urgency to keep your SMB customers secure and productive. For example, when risky behaviors are detected for a user account, you will want to quickly triage if the risks are real and block sign-in. Or when an admin at the customer site disables MFA and you want to be informed of this configuration change to get it re-enabled. Or when Defender detects a security incident to act on it quickly. We are making it easier to stay informed of these insights through alerts and notifications. Lighthouse can now alert and notify you of all the above events and more.
Lighthouse can configure customized email alerts for delivery to your users, groups, or third-party ticketing systems. Offering alerting capabilities on several key scenarios, we've made it easier than ever for Managed Service Providers (MSPs) to integrate multi-tenant alerts into their everyday workflows with configuration directly in Lighthouse without configuring these alerts in multiple admin portals.
By default, we include several sample alert types that can be modified to alert the appropriate users within the Managed Service Provider (MSP). MSPs can also create custom rules targeting tenants by name or, using tags which allow you to organize your tenants into management groups and configure who receives notifications when an alert happens.
Lighthouse provides the following alert types:
- Risky Users
- Devices without Antivirus Protection
- Baseline Variance Detection
- Non-Compliant Devices
- Security Incidents
- Active Threats on a Device
We will continue to add new alert types, and we always welcome Partner feedback if there are new alerts you’d like to see added. To provide feedback, visit https://aka.ms/lhfeedback.
Once your alert type is configured, you can select to alert all tenants, specific tenants, or tenants grouped by tag. Finally, you can configure the alert to either users or groups within your tenant or a third-party email address like your existing Professional Service Automation (PSA) or ticketing system.
Viewing and Managing Alerts within Lighthouse
For each created alert rule, MSPs can view and action the alert directly within a single page in Lighthouse. Our Alert page provides a historical view of alert resolution rates and the ability to investigate each alert further.
When you select an alert in the grid, you can easily see information on the alert rule that triggered that entry. A link to the impacted user or device is provided so you can take the appropriate action to bring your customer back into a healthy state.
We also allow you to set the alert status and severity, assign the alert to a user, and add additional comments to the alert to use for things like notes or resolution steps. 
Additionally, each alert has an entire history viewable to track when the alert was opened, any comments added, and an audit log of updates made to the alert.
We're excited to bring this multi-tenant alert capability to Lighthouse and help empower MSPs to integrate alerts from Lighthouse into their everyday workflows. We look forward to expanding on this feature as Lighthouse continues to expand its features and .
To learn more about Microsoft 365 Lighthouse and our new alerting feature:
- Microsoft 365 Lighthouse Overview: Overview of Microsoft 365 Lighthouse (Article)
- Alerts Overview: Overview of the Alerts page in Microsoft 365 Lighthouse (Article)
- Alert Configuration: Create and manage alert rules in Microsoft 365 Lighthouse (Article)