office365 alert mailbox limit exceeded

Question

Hello, I have several tenants on O365 and have alerts set up for specific functions. I get several alerts daily where the activity shows AddMailboxPermission from NTAuthority/SYSTEM but have no way to know the tenant and I have not been able to find any documentation related on figuring out how to decipher these very generic messages. For example: I get an alert that states mailboxlimitexceeded but under activity it shows addmailboxpermissions. The user is NTAuthority\System. So is it that the limit has been exceeded or that a permission has been added? Why would a limit being exceeded trigger an AddmIlaboxPermission alert or vice-versa? Also, what type of limit has been exceeded (mailbox limit, sending limit, etc.). Finally, how do I know which tenant this alert is referring to? I am attaching a sample image.

Answer 1

It looks like someone might have named this alert wrong, as the content of the message suggests it is an "Full access permissions granted" alert. The name can be anything, and it does not relate to the actual alert configuration. Perhaps someone copied an existing alert to be used as template? Anyway, check it under the Compliance center: https://compliance.microsoft.com/alertpoliciesv2

As to "NT Authority\SYSTEM", this indicates that the action was performed by a background process, and you can safely ignore it as a "system" event.