Press CTRL+K to open search

Setting up your first alert

  • 6 minute(s) read
Prev Next

Overview

This tutorial walks you through setting up your first alert in Tenant Manager. By the end, you will have one alert switched on for a tenant, a place for its notifications to go, and an incident that you have acknowledged.

Business value

Alerts tell you about license waste, capacity problems, and connection problems without anyone opening Tenant Manager. Setting up one alert end to end shows you the full path from a check to a notification to a response, and you can repeat it for the other four alert types.

Prerequisites

Connect a tenant as described in Connect a Microsoft 365 tenant, wait for its first sync to finish, and have a recipient email address or a notification channel ready (on private hosting, a notification channel). The Default Escalation Policy is normally available, so you don't need to create a policy for this tutorial.

Required permissions

You need Manage on Alerts to configure an alert, switch it on, and acknowledge an incident. You need Read on Alerts to view the page. If your access is limited to some tenant groups or tenants, your role must cover the tenant you choose. For details, see Roles and permissions in Tenant Manager.

Role Access
Owner, Contributor Read and Manage on Alerts.
Reader Read on Alerts only.
Custom role Whatever the role's Read and Manage switches for Alerts allow.

How it works

An alert is a check that Tenant Manager runs on a schedule against the data from the last sync. When the check finds its condition, Tenant Manager raises an incident and notifies the people in the first step of the escalation policy. If nobody acknowledges or closes the incident, it notifies the next step after the delay set on the policy.

This tutorial uses Disabled user with license. It has no number to set, and removing licenses from a disabled account affects no one, because the user cannot sign in. By default it runs weekly on Monday at 09:00 in the Background activity time zone from General settings.

Every alert is off until it has a notification channel or a recipient email address. You set the destination first, and then you switch the alert on.

Steps

You configure the alert, switch it on, and then work with its incident. You start on the Alerts page of one tenant: select the tenant in the tree view, expand License management, and select Alerts. The grid has one row for each of the five alert types.

Configure the alert

This procedure sets where the alert sends its notifications and which escalation policy it follows.

  1. In the Disabled user with license row, open the actions menu (⋮) and select Configure. The Configure dialog opens with a one-line title, Configure - Disabled user with license.
  2. Under Rule settings, leave the schedule as it is. This alert has no number to set.
  3. Under Monitoring alert settings, check Escalation policy. Tenant Manager preselects the alert's own policy, or the Default Escalation Policy.
  4. Leave Download records from notifications ticked. Each notification then includes a Download records button for the affected accounts.
  5. Open the first escalation step, titled "1. Notify the following notification channels". Enter your address in Recipient email address, or tick a notification channel. If a default recipient is already filled in, check that it is the address you want. On private hosting, tick a notification channel (an SMTP channel for email); there is no recipient field.
  6. If the policy has more escalation steps, open each one and add a recipient or a channel, or leave it empty. Only one step needs a destination. On SaaS, an empty step shows a warning icon, and you can still save. On private hosting, each step without a channel shows a warning icon with "At least one notification channel must be added", and Save stays disabled until a step has a notification channel.
  7. Select Save. A message confirms the save and says the alert is still disabled and will not be checked.

Save stays disabled until something has changed and at least one step has a channel or a recipient. The dialog does not switch the alert on. You switch it on in the next procedure.

Switch the alert on

This procedure starts the checks for the alert on this tenant.

  1. In the first column of the Disabled user with license row, select the switch.
  2. Read the confirmation. It reads "This action will enable the alert ... It is checked from the next run."
  3. Select Continue. A message confirms that the alert is enabled, and the switch turns on.

The confirmation mentions the next run, but Tenant Manager also checks the alert right away when you switch it on.

Find and acknowledge an incident

This procedure opens the incident that the alert raised and marks it as in hand, which stops further escalation.

  1. In the actions menu (⋮) of the row, select Alert history. The dialog opens with the alert's name in its title.
  2. Find an incident with the status Open. If at least one disabled account holds a paid license, the list shows the incident with a one-line summary in the Issues column.
  3. Select the status chip to open the incident details. Read the summary, and select View notification details beside the escalation level to see who was told.
  4. In the incident's row, open the actions menu and select Acknowledge.
  5. Read the confirmation. It says that the incident is not sent again until it is reopened.
  6. Enter a Comment (optional), such as a ticket reference, and select Continue. A message confirms the change, and the status now reads Acknowledged.
  7. Open the incident's actions menu again and select View user actions. The entry reads "Status changed from ... to ..." with your name, the time, and your comment.

An acknowledged incident is not escalated. It stays acknowledged until someone closes it, even after the disabled accounts have been dealt with.

Troubleshooting

This section covers the errors you are most likely to meet while setting up your first alert.

  1. The switch is grayed out and says "Configure this alert first."
    Cause: the alert has no notification channel and no recipient email address. On private hosting, the alert has no notification channel, and the message reads "Configure this alert first. Choose a notification channel, then enable it."
    Fix: select Configure, tick a channel or enter a recipient (on private hosting, tick a notification channel), select Save, and then switch the alert on.

  2. Save is disabled.
    Cause: nothing has changed ("No changes to save."), or no step has a channel or a recipient ("Select a notification channel or enter a recipient email address."). On private hosting, no step has a notification channel, and each step without one shows a warning icon with "At least one notification channel must be added".
    Fix: change a field, or tick a channel or enter a valid recipient address on at least one step. On private hosting, tick a notification channel on at least one step.

  3. Saving fails with "There is no escalation policy for Tenant Manager yet."
    Cause: no Tenant Manager escalation policy exists.
    Fix: select the gear icon in the sidebar header, select Escalation policies, create a policy, and save the alert again. See Managing escalation policies.

  4. Alert history lists no incident.
    Cause: the alert is on, but its trigger has not been reached. No disabled account holds a paid license in the data from the last sync, so the alert has nothing to report.
    Fix: no action is needed. The list shows the trigger. To try the steps with another alert type, see Alert types and thresholds.

  5. An incident exists but you received no notification.
    Cause: the alert has no channel or recipient, outbound email is not configured, or a channel was deleted.
    Fix: open View notification details and Failure reason, and then correct the recipients or channels in Configure. See Alert and notification issues.

Related articles