Activity Alerts (set up via https://security.microsoft.com/managealerts) are not being received

Question

To test activity alerts, I modified 10 different files in my SharePoint tenant and, though I set the alerts to detect those specific modifications and email me for each one, I only received 2 out of 10 emails. The first two email notifications were received within 10 minutes but, after 5 hours, the other 8 alerts have not been received.

I do not see the activity for any of the 10 modifications in the activity log either. If fact, the activity log shows no activity yet for today. The most recent activity is from yesterday.

The metadata in SharePoint confirms that I made the changes, but the alerts are not being triggered. What can be done to ensure that these activity alerts are triggered with consistency?

Answer 1

Dear Tgraham,

Thanks for your updates and letting us know the current situation in your environment here.

Yes, your understanding is right. I'm afraid that there is no setting disabling the feature at the tenant level currently. As some workarounds, what I can consider may be to turn off the alerts and create some custom flows for you to receive alerts each time by the trigger.

As our product developers are willing to hear customers' feedback when using the products, I kindly suggest you submit your feedback on the Feedback platform (the detailed information is in the article) to let them know your requirements and suggestions for product improvements. If they have some updates on the feedback you have submitted, they will update there as soon as possible.

Thanks for your understanding and very sorry that there may be no such a setting in Microsoft Purview.

Sincerely,

Cliff | Microsoft Community Moderator

Answer 2

Ok, so to confirm, Activity Alerts are automatically aggregated if more than one of the same alert type is triggered within one minute. I understand the goal is to reduce alert fatigue, but my team is working on a specific scenario where we need to use these activity alerts to trigger a power automate flow. When alerts are aggregated, the flow won't be able to trigger for each instance of an activity.

And to clarify, the activity we've set up for alerts is not "when a file is modified"; it's more narrow than that. We ran a search on our tenant and only about 100 or so instances of the activity in question occur per month, so receiving 100 or so alerts per month wouldn't be too much trouble. The only problem is this aggregation issue. If we only receive 90/100 alerts in a given month because 10 of them happened within one minute of another alert, then the work our power automate flow does will be incomplete.

Is there anything Microsoft can do to help us here? Can we "undo" or adjust this aggregation feature for our tenant?

Answer 3

Dear Tgraham,

Thanks for confirming the situation in your environment.

Yes, I can reproduce the situation in my environment as well. Based on the article , it is an expected behavior related to Alert aggregation for multiple events within one minute.

When multiple events that match the conditions of an alert policy occur with one minute, they are added to an existing alert by a process called alert aggregation.

For example, when one event occurs which matches a policy, an alert is generated and displayed on the Alerts page and a notification is sent. If another event matching the same policy occurs within one minute of the first event, then Compliance Manager adds details about the additional event on the Events log tab of the existing alert instead of triggering a new alert.

If you want to receive each alert email when the modification on a file is triggered, you may use Power Automate to trigger the email action when a file is modified each time as a workaround.

Sincerely,

Cliff | Microsoft Community Moderator

***Note: In the event that you're unable to reply to this thread, please ensure that your Email address is verified in the Community Website by clicking on Your Account Name > "My Profile" > "Edit Profile" > Add your Email Address > tick "Receive email notifications" checkbox > click on "Save".***

Answer 4

Can you try testing again where you modify multiple files at once or modify them in quick succession and then see if all alerts are received? That's the the problem I'm having and I apologize for not being more specific.

Thank you!

Answer 5

Dear Tgraham,

Good day! Thank you for posting your query in our community. We are happy to help you.

I did a test at our side and it seems that I can't reproduce the issue in our environment.

Please check whether only the specific alert you created doesn't work and whether there are some improvements if you set Severity to High in your policy.

Meanwhile, I'd like you to check whether there are some emails in the Junk folder.

If it is convenient, I suggest you create a flow to trigger an alert email when the file or a folder is modified, created or deleted in SharePoint Online.

As the alert is triggered by SharePoint Online in your environment, the issue may involve the related team to be further investigated if no alerts come in any folder in Outlook.

To reach the related team directly, I suggest you contact the administrator in your company if you aren't the administrator and let him open a support ticket as soon as possible.

Sincerely,

Cliff | Microsoft Community Moderator

***Note: In the event that you're unable to reply to this thread, please ensure that your Email address is verified in the Community Website by clicking on Your Account Name > "My Profile" > "Edit Profile" > Add your Email Address > tick "Receive email notifications" checkbox > click on "Save".***