---
title: "Setting up your first alert"
slug: "setting-up-your-first-alert-in-tenant-manager"
updated: 2026-11-02T06:53:54Z
published: 2026-11-02T06:53:54Z
canonical: "docs.turbo360.com/setting-up-your-first-alert-in-tenant-manager"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.turbo360.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up your first alert

## Overview

This tutorial walks you through setting up your first alert in Tenant Manager. By the end, you will have one alert switched on for a tenant, a place for its notifications to go, and an incident that you have acknowledged.

### Business value

Alerts tell you about license waste, capacity problems, and connection problems without anyone opening Tenant Manager. Setting up one alert end to end shows you the full path from a check to a notification to a response, and you can repeat it for the other four alert types.

## Prerequisites

Connect a tenant as described in [Connect a Microsoft 365 tenant](https://docs.turbo360.com/docs/connect-a-microsoft-365-tenant), wait for its first sync to finish, and have a recipient email address or a notification channel ready (on private hosting, a notification channel). The Default Escalation Policy is normally available, so you don't need to create a policy for this tutorial.

### Required permissions

You need **Manage** on Alerts to configure an alert, switch it on, and acknowledge an incident. You need **Read** on Alerts to view the page. If your access is limited to some tenant groups or tenants, your role must cover the tenant you choose. For details, see [Roles and permissions in Tenant Manager](https://docs.turbo360.com/docs/tenant-manager-roles-and-permissions).

| Role | Access |
| --- | --- |
| **Owner**, **Contributor** | **Read** and **Manage** on Alerts. |
| **Reader** | **Read** on Alerts only. |
| **Custom role** | Whatever the role's **Read** and **Manage** switches for Alerts allow. |

## How it works

An alert is a check that Tenant Manager runs on a schedule against the data from the last sync. When the check finds its condition, Tenant Manager raises an incident and notifies the people in the first step of the escalation policy. If nobody acknowledges or closes the incident, it notifies the next step after the delay set on the policy.

This tutorial uses Disabled user with license. It has no number to set, and removing licenses from a disabled account affects no one, because the user cannot sign in. By default it runs weekly on Monday at 09:00 in the Background activity time zone from General settings.

Every alert is off until it has a notification channel or a recipient email address. You set the destination first, and then you switch the alert on.

## Steps

You configure the alert, switch it on, and then work with its incident. You start on the **Alerts** page of one tenant: select the tenant in the tree view, expand **License management**, and select **Alerts**. The grid has one row for each of the five alert types.

### Configure the alert

This procedure sets where the alert sends its notifications and which escalation policy it follows.

1. In the **Disabled user with license** row, open the actions menu (⋮) and select **Configure**. The **Configure** dialog opens with a one-line title, **Configure - Disabled user with license**.
2. Under **Rule settings**, leave the schedule as it is. This alert has no number to set.
3. Under **Monitoring alert settings**, check **Escalation policy**. Tenant Manager preselects the alert's own policy, or the Default Escalation Policy.
4. Leave **Download records from notifications** ticked. Each notification then includes a **Download records** button for the affected accounts.
5. Open the first escalation step, titled "1. Notify the following notification channels". Enter your address in **Recipient email address**, or tick a notification channel. If a default recipient is already filled in, check that it is the address you want. On private hosting, tick a notification channel (an SMTP channel for email); there is no recipient field.
6. If the policy has more escalation steps, open each one and add a recipient or a channel, or leave it empty. Only one step needs a destination. On SaaS, an empty step shows a warning icon, and you can still save. On private hosting, each step without a channel shows a warning icon with "At least one notification channel must be added", and **Save** stays disabled until a step has a notification channel.
7. Select **Save**. A message confirms the save and says the alert is still disabled and will not be checked.

**Save** stays disabled until something has changed and at least one step has a channel or a recipient. The dialog does not switch the alert on. You switch it on in the next procedure.

### Switch the alert on

This procedure starts the checks for the alert on this tenant.

1. In the first column of the **Disabled user with license** row, select the switch.
2. Read the confirmation. It reads "This action will enable the alert ... It is checked from the next run."
3. Select **Continue**. A message confirms that the alert is enabled, and the switch turns on.

The confirmation mentions the next run, but Tenant Manager also checks the alert right away when you switch it on.

### Find and acknowledge an incident

This procedure opens the incident that the alert raised and marks it as in hand, which stops further escalation.

1. In the actions menu (⋮) of the row, select **Alert history**. The dialog opens with the alert's name in its title.
2. Find an incident with the status **Open**. If at least one disabled account holds a paid license, the list shows the incident with a one-line summary in the **Issues** column.
3. Select the status chip to open the incident details. Read the summary, and select **View notification details** beside the escalation level to see who was told.
4. In the incident's row, open the actions menu and select **Acknowledge**.
5. Read the confirmation. It says that the incident is not sent again until it is reopened.
6. Enter a **Comment (optional)**, such as a ticket reference, and select **Continue**. A message confirms the change, and the status now reads **Acknowledged**.
7. Open the incident's actions menu again and select **View user actions**. The entry reads "Status changed from ... to ..." with your name, the time, and your comment.

An acknowledged incident is not escalated. It stays acknowledged until someone closes it, even after the disabled accounts have been dealt with.

## Troubleshooting

This section covers the errors you are most likely to meet while setting up your first alert.

1. **The switch is grayed out and says "Configure this alert first."** Cause: the alert has no notification channel and no recipient email address. On private hosting, the alert has no notification channel, and the message reads "Configure this alert first. Choose a notification channel, then enable it." Fix: select **Configure**, tick a channel or enter a recipient (on private hosting, tick a notification channel), select **Save**, and then switch the alert on.
2. **Save is disabled.** Cause: nothing has changed ("No changes to save."), or no step has a channel or a recipient ("Select a notification channel or enter a recipient email address."). On private hosting, no step has a notification channel, and each step without one shows a warning icon with "At least one notification channel must be added". Fix: change a field, or tick a channel or enter a valid recipient address on at least one step. On private hosting, tick a notification channel on at least one step.
3. **Saving fails with "There is no escalation policy for Tenant Manager yet."** Cause: no Tenant Manager escalation policy exists. Fix: select the gear icon in the sidebar header, select **Escalation policies**, create a policy, and save the alert again. See [Managing escalation policies](https://docs.turbo360.com/docs/managing-escalation-policies-in-tenant-manager).
4. **Alert history lists no incident.** Cause: the alert is on, but its trigger has not been reached. No disabled account holds a paid license in the data from the last sync, so the alert has nothing to report. Fix: no action is needed. The list shows the trigger. To try the steps with another alert type, see [Alert types and thresholds](https://docs.turbo360.com/docs/alert-types-and-thresholds-in-tenant-manager).
5. **An incident exists but you received no notification.** Cause: the alert has no channel or recipient, outbound email is not configured, or a channel was deleted. Fix: open **View notification details** and **Failure reason**, and then correct the recipients or channels in **Configure**. See [Alert and notification issues](https://docs.turbo360.com/docs/alert-and-notification-issues-in-tenant-manager).

## Related articles

- [Alert types and thresholds](https://docs.turbo360.com/docs/alert-types-and-thresholds-in-tenant-manager)
- [Managing escalation policies](https://docs.turbo360.com/docs/managing-escalation-policies-in-tenant-manager)
- [Managing alert incidents](https://docs.turbo360.com/docs/managing-alert-incidents-in-tenant-manager)
- [Alerts and incident escalation](https://docs.turbo360.com/docs/alerts-and-incident-escalation)
- [Alert configuration](https://docs.turbo360.com/docs/alert-configuration-in-tenant-manager)
- [Alert and notification issues](https://docs.turbo360.com/docs/alert-and-notification-issues-in-tenant-manager)