Alerts in the Microsoft 365 Defender portal


The improved Microsoft 365 Defender portal is now available. This new experience brings Defender for Endpoint, Defender for Office 365, Microsoft 365 Defender, and more into the Microsoft 365 Defender portal. Learn what's new.

Applies to

Use the alerts features in the Microsoft 365 Defender portal to view and manage alerts for your organization, including managing advanced alerts as part of Microsoft Defender for Cloud Apps overview.

How to get to the alerts features

Alerts are in the Microsoft 365 Defender portal. Here's how to get to the page:

In the Microsoft 365 Defender portal, go to Alerts. Or, to go direct to the Alerts page, use

Alerts features

The following table describes the tools that are available under Alerts in the Microsoft 365 Defender portal.

Tool Description
Manage alerts Use activity alerts to send email notifications to yourself or other admins when users perform specific activities in Microsoft 365. Activity alerts are similar to searching the audit log for events, except that you'll be sent an email message when an event that you've created an alert for occurs.
Manage advanced alerts Use the Manage advanced alerts feature of Microsoft 365 Cloud App Security to set up policies that can alert you to suspicious and anomalous activity in Microsoft 365. After you're alerted, you can investigate situations that are potentially problematic and, if needed, take action to address security issues.