Configuring an audit alert policy
As we demonstrated in the previous section, searching the audit log is a quick and effective way to view user and administrator activities within your Microsoft 365 environment. However, should you find yourself repeatedly carrying out the same types of audit log searches, then you may wish to consider minimizing your administrative effort on this activity by instead configuring an alert policy that automatically alerts you whenever the activity you wish to search for occurs.
Alert policies can be categorized and applied to your users and a threshold is set to trigger an alert. Alerts can be sent to administrators via an email notification or can be viewed in the Security & Compliance Center under Alerts | View alerts.
Alert policies are triggered by user or administrator actions that match conditions within an alert policy. In order to create alert policies, you must be a member of the Manage Alerts or Organization Configuration roles, which...
