Overview
The Alerts page lists the five alert types that Tenant Manager can raise for a tenant. For each type, you switch the alert on or off, set when it triggers, choose how often it is checked, and choose who is notified. You set alerts per tenant.
The five types are Disabled user with license, Inactive user with license, License seat shortage, License expiry, and Client secret expiry. For the concepts behind alerts and incidents, see Alerts and incident escalation.
Business value
Alerts tell you about license waste, capacity problems, and connection problems without anyone having to open Tenant Manager. You see unused paid licenses early, you get a warning before seats or licenses run out, and you hear about an expiring client secret before Tenant Manager loses access to a tenant.
Prerequisites
Before you set up an alert, connect a tenant and complete its first sync. An alert cannot be switched on until it has a notification channel or a recipient email address. On private hosting, alerts are sent through notification channels only (use an SMTP channel for email); there is no recipient field.
Required permissions
You need Read on Alerts to view the page. You need Manage on Alerts to switch an alert on or off and to configure it. For details, see Roles and permissions in Tenant Manager.
| Role | Access |
|---|---|
| Owner, Contributor | Read and Manage on Alerts. |
| Reader | Read on Alerts only. |
| Custom role | Whatever the role's Read and Manage switches for Alerts allow. |
Dependencies
- Escalation policy: every alert follows an escalation policy. The Default Escalation Policy is available from the start. See Managing escalation policies.
- Notification channels and email templates: to send alerts to channels, set them up under Settings > Notification channels. Custom email templates are under Settings > Email templates.
- Synced data: an alert checks the data from the last sync. See How data sync works.
How it works
Select the tenant in the tree view, expand License management, and select Alerts. Tenant groups have no Alerts page, so you set alerts on each tenant.
The grid has one row for each alert type, with these columns: the Disabled or Enabled switch, Alert type, Description, Trigger when, and Actions. The Trigger when column reads the current setting back to you, for example "Expiring within 30 days". If an alert is on but has no notification channel and no recipient, a warning names it above the grid. The alert still runs and raises incidents, but nobody is told.
Alert types, defaults, and trigger settings
Each type starts with the settings below. An alert that has never been configured is listed as switched off and uses its defaults.
| Alert type | What it watches | Default trigger | Default schedule | Severity |
|---|---|---|---|---|
| Disabled user with license | Disabled accounts that still hold a paid license | Any disabled account with a paid license | Weekly, Monday at 09:00 | Critical |
| Inactive user with license | Users who hold a license but have not used it, including users who never signed in | No activity for 30 days, skipping accounts less than 30 days old | Weekly, Monday at 09:00 | Warning |
| License seat shortage | Paid licenses with no seats left, or almost none | Warning at 10 or fewer available seats, error at 5 or fewer | Every 30 minutes | Warning, Critical at the error line |
| License expiry | Licenses close to their renewal date, and licenses that have already lapsed | 30 days before expiry | Daily at 00:00, fixed | Warning, Critical when a purchase has lapsed |
| Client secret expiry | The client secret that lets Turbo360 read the tenant, based on the expiry date recorded for the tenant. A secret that has already expired is also reported. If no expiry date is recorded, the alert has nothing to check. | 30 days before expiry | Daily at 00:00, fixed | Critical |
Disabled user with license has no number to set, because any disabled account with a paid license counts. The other types each take a number: days without activity, available seats, days before a license renews, or days before a client secret expires. License seat shortage has a Warning and an Error value. The unit is a dropdown joined to the threshold box, with the options % of seats and Seats.
For Inactive user with license, the records file shows each user's Last activity. A user who has never signed in has no sign-in of either kind, interactive or background.
Each incident has a severity of Critical or Warning. You cannot change it. It appears in the incident details and in notification emails.
Schedule
For Disabled user with license, Inactive user with license, and License seat shortage, you choose how often the alert is checked: Every 30 minutes, Hourly, Every 6 hours, Every 12 hours, Daily, Weekly, or Monthly. Weekly and monthly checks use Days of week or Days of month, and daily and longer checks use Hours. All days and All hours select every option. If a month is too short for a day you chose, the check runs on the last day of that month. License expiry and Client secret expiry cannot be scheduled. They are read-only and run once a day at 00:00 in the Background activity time zone from General settings. The times you choose use the Background activity time zone from General settings, not your browser's.
An alert checks the data from the last sync and does not read Microsoft 365 when it runs. Checking more often than the tenant syncs therefore finds nothing new.
Steps
The steps below cover switching alerts on and off and configuring them. You start on the Alerts page of the tenant.
Enable or disable an alert
This procedure starts or stops the checks for one alert type on the tenant.
- Find the alert type in the grid.
- Select the switch in the first column. If it is grayed out, configure the alert first. See Configure an alert. On private hosting, hover over the grayed-out switch to read "Configure this alert first. Choose a notification channel, then enable it."
- Read the confirmation. It reads "This action will enable the alert ... It is checked from the next run." or "This action will disable the alert ... No alerts are sent until you enable it again."
- Select Continue.
A message confirms the change. Disabling an alert stops it from being checked at all, which is different from muting it. Open incidents stay open.
Configure an alert
This procedure sets the trigger, the schedule, and the notification settings for one alert type.
- In the Actions column, open the actions menu (⋮) and select Configure. The Configure dialog opens with a one-line title, for example Configure - License seat shortage.
- Below the description, tick or clear Download records from notifications if you want a Download records button in every notification. This option is on by default, and it is not shown for Client secret expiry.
- Under Rule settings, set the trigger number or numbers, for example No activity for or Alert at. For License seat shortage, choose % of seats or Seats in the dropdown joined to each threshold box.
- For types that can be scheduled, choose the frequency and the Days of week, Days of month, or Hours that apply.
- Under Monitoring alert settings, choose an Escalation policy. Tenant Manager preselects the alert's own policy, or the Default Escalation Policy.
- Open the first escalation step, titled "1. Notify the following notification channels". Enter Recipient email address values, or tick the channels to notify. Optionally choose an Email template and enter an Email subject. Open the other steps and repeat if the policy has more.
- Select Save.
Email template and Email subject become available after you enter a Recipient email address. For SMTP channels, the channel grid also has its own Recipient email address and Email template columns. On private hosting, there is no recipient field, so Recipient email address, Email template, and Email subject are not shown. Tick the channels only. On private hosting, each step without a channel shows a warning icon with "At least one notification channel must be added", and Save stays disabled until a step has a channel.
Separate recipient addresses with commas to send each person their own email. Use semicolons to send one email to everyone. Save stays disabled until something has changed, and until at least one step has a channel or a recipient. The dialog does not switch the alert on. Use the switch in the grid for that. Saving does not start an immediate check. A changed setting applies from the next scheduled check.
Configuration
The options below are in the Configure dialog.
| Option | Applies to | Description |
|---|---|---|
| No activity for | Inactive user with license | Days without activity before an alert is raised. Accounts less than 30 days old are always skipped. |
| Warning | License seat shortage | Raises a warning when available seats drop to this value or below. Pick % of seats or Seats in the dropdown joined to the box. |
| Error | License seat shortage | The number of available seats at which the incident becomes an error instead of a warning. Pick % of seats or Seats in the dropdown joined to the box. |
| Alert at | License expiry, Client secret expiry | Raises an alert this many days before the renewal date or the expiry date. |
| Evaluation frequency | Disabled user with license, Inactive user with license, License seat shortage | How often the alert is checked, from every 30 minutes to monthly. |
| Days of week | Weekly checks | The days the alert is checked on, or All days. |
| Days of month | Monthly checks | The days of the month the alert is checked on, or All days. Includes Last day. |
| Hours | Daily, weekly, and monthly checks | The time of day to check, or All hours to check every half hour. |
| Escalation policy | All types | Who is notified, and in what order. |
| Download records from notifications | All types except Client secret expiry | Adds a Download records button to every notification. The file is still kept in Alert history when this is off. |
| Recipient email address | Each escalation step | The people to email at this step. |
| Email template | Each escalation step | The template the email is written in. The default is System template. |
| Email subject | Each escalation step | The subject line. Leave it empty to use the default subject, Turbo360 Tenant Manager alert - {alert name} · {scope}. |
| Channels | Each escalation step | The notification channels that receive the alert at this step. |
Permission behavior
What you can do on the page depends on your role.
- With Manage on Alerts, the switch and Configure are available.
- Without Manage, the switch and Configure are disabled. Hover over them to see "You are not authorized to perform this operation".
- Alert history stays available to everyone who can read alerts.
Example scenario
Wei Zhang, a module owner at VanArsdel, wants to know before the VanArsdel Singapore tenant runs out of Microsoft 365 E3 seats. He opens Alerts for the tenant and selects Configure on License seat shortage. He leaves Warning at 10 seats and Error at 5 seats, keeps the check at every 30 minutes, and ticks the Microsoft Teams channel for his licensing team in the first escalation step. He saves, turns the switch on, and confirms.
A week later the unassigned seats fall to 8. Tenant Manager raises a Warning incident and posts it to Teams. Each 30-minute check that still finds 8 seats raises another Warning incident, so Wei acknowledges the first one and his team buys seats to stop new incidents being raised. When the seats fall to 4, the next incident is raised as Critical.
Limitations
- Each tenant has one setting for each alert type.
- You cannot add or delete alert types.
- You cannot change severity.
- You cannot schedule License expiry and Client secret expiry. They run daily at 00:00.
- Alerts are set per tenant, and tenant groups have no Alerts page.
- An alert with nothing to measure never raises an incident. This happens when License seat shortage finds no paid licenses, when License expiry finds no license purchase records, and when Client secret expiry finds no recorded expiry date.
Troubleshooting
-
The switch is grayed out and says "Configure this alert first."
Cause: the alert has no notification channel and no recipient email address. On private hosting, the alert has no notification channel, and the message reads "Configure this alert first. Choose a notification channel, then enable it."
Fix: select Configure, tick a channel or enter a recipient (on private hosting, tick a notification channel), save, and then switch the alert on. -
A warning says an alert is enabled but has no notification channel or recipient email address.
Cause: the alert is on, but nothing tells anyone when it fires.
Fix: configure the alert and add a channel or a recipient (on private hosting, a channel). -
Save is disabled.
Cause: nothing has changed ("No changes to save."), or no step has a channel or a recipient ("Select a notification channel or enter a recipient email address."). On private hosting, no step has a notification channel, and each step without one shows a warning icon with "At least one notification channel must be added".
Fix: change a field, or tick a channel or enter a valid recipient address on at least one step. On private hosting, tick a notification channel on at least one step. -
Saving fails with "There is no escalation policy for Tenant Manager yet."
Cause: no Tenant Manager escalation policy exists.
Fix: create one from the gear menu under Escalation policies, and save again. See Managing escalation policies. -
The page says "No tenant is connected at this scope yet, so there is nothing to monitor."
Cause: the selected node holds no tenant.
Fix: select a tenant in the tree view, or connect one. See Connect a Microsoft 365 tenant.
FAQs
-
Does an alert read Microsoft 365 when it runs?
No. An alert checks the data from the last sync. A tenant syncs every 6 hours, so checking more often than that finds nothing new. -
Can I set an alert for a whole tenant group?
No. Alerts are set on each tenant. -
Why is a license expiry alert checked only once a day?
Expiry is counted in days, so License expiry and Client secret expiry are checked once a day at 00:00 in the Background activity time zone. The first time you switch one on, it is checked right away.