This cmdlet is available only in Security & Compliance PowerShell. For more information, see Security & Compliance PowerShell.

Note: Activity alerts have been effectively replaced by alert policies and the corresponding *-ProtectionAlert cmdlets. For more information about alert policies, see Alert policies in Microsoft 365.

Use the Get-ActivityAlert cmdlet to view activity alerts. Activity alerts send email notifications when users perform specific activities in Microsoft 365.

For information about the parameter sets in the Syntax section below, see Exchange cmdlet syntax.


   [[-Identity] <ComplianceRuleIdParameter>]


To use this cmdlet in Security & Compliance PowerShell, you need to be assigned permissions. For more information, see Permissions in the Microsoft Defender portal or Permissions in the Microsoft Purview compliance portal.


Example 1

Get-ActivityAlert | Format-List Disabled,Name,Description,Operation,UserId,NotifyUser

This example returns a summary list of all activity alerts.

Example 2

Get-ActivityAlert -Identity "All Mailbox Activities"

This example returns detailed information about the activity alert named All Mailbox Activities.



The Identity parameter specifies the activity alert that you want to view. You can use any value that uniquely identifies the activity alert. For example:

  • Name
  • Distinguished name (DN)
  • GUID
Default value:None
Accept pipeline input:True
Accept wildcard characters:False
Applies to:Security & Compliance