Forum Discussion

SB V's avatar
SB V
Brass Contributor
Jun 28, 2023

Alert policy - Add mailbox permission - No detailed alert.

Hi Community,    I've created Alert policy that whenever someone get mailbox permissions added it should be notified to the Global administrator and it works. However, the alert doesn't have the de...
Alerts
Christos_Ventouris's avatar
Christos_Ventouris
Icon for Microsoft rankMicrosoft
Jul 01, 2023
Which product was that alert policy created in ? Was it an advanced hunting Custom Detection or was it a policy in Defender for Cloud Apps ?
  • SB V's avatar
    SB V
    Brass Contributor
    Jul 03, 2023

    Thank you for the response. 

    I've created the alert policy as detailed in this post and getting the alert as per the screenshot I attached in my initial ask,  https://learn.microsoft.com/en-us/answers/questions/242472/alert-when-someone-is-granted-full-access-to-mailb

     

    However, the challenge is the alert doesn't help to understand whose  mailbox was given full access permission and who takes full access permissions and all.

     

    Getting just the alert notification but it doesn't say the above details. Please help which alert policy helps us giving the detailed report.

     

    Thanks!

    • plainlazy87's avatar
      plainlazy87
      Copper Contributor
      Sep 28, 2023

      SB V 

      When you click on the alert to view the details you should have a hyperlink named "View Activity List".

      When you click that, under the "Item" column is the name of the user whose mailbox was changed. Sometimes it won't show the name but the ID number instead. If this happens you have to copy the ID number and paste it into the user search of AAD (Entra) to see which user's mailbox it was.

      Hope that helps. It stumped me for a while as well. 

       

Resources