Microsoft 365 alerts tool
Download spike, user 4471. Is that an incident or a Tuesday?
A typical alert is a severity string and a username. 1Security sends the rest: which policy fired, how far today sits from that account's own normal, which device and city it came from, and one click to the exact events. 50+ detections show their live match count in your tenant before you switch them on, one incident is one email, and the alert line is yours to move at any time.
- 50+prebuilt detections, each showing how many resources match in your tenant right now
- 5 mintypical time from an audit event to the affected policies re-evaluated and the email sent
- 1 emailper incident - episodes and cooldowns collapse a 40-event burst into one message
The problem
An alert names a username. Judging it usually takes an hour.
A fixed-threshold alert fires on a number you guessed months ago and hands you a row. Everything you need to judge it lives somewhere else.
An alert names an account. Judging it means answering what that account can reach - in a typical tenant hundreds of thousands of files through groups, links and inheritance - whether 300 downloads is unusual for it, and which files were involved. Permissions, sign-ins, mailbox access and activity history each live in a different place. Stitching them together is the hour.
Threshold rules carry a second cost: every number is a bet made blind. Set "more than 100 downloads" high and you sleep through the leaver pulling 95 files a day for a week; set it low and the mailbox trains everyone to ignore it. Most teams learn which bet they made a quarter later, and most teams never move the number again.
1Security starts from the other end. Detections show their live count in your tenant before you enable them, baselines are learned per policy and per account, and every alert carries its evidence with it - so the verdict takes minutes, not an hour.
Capabilities
One alerting model for trends, activities, anomalies and automations.
Everything that can wake you up in 1Security is evaluated by the same real-time engine and mailed through the same two channels.
One engine underneath
Audit-log activity re-evaluates only the slice of the policies it touched, within minutes, with per-tenant coalescing so no event is dropped and a reconciliation pass every 30 minutes as the floor. Counts and baselines update while you watch.
- 50+
Detections counted before you enable them
The prebuilt library shows how many sites, users, files or links in your tenant match each detection right now - "anyone links on sensitive files: 1,240", "guests idle for a year: 86". You enable a rule knowing exactly what it will say.
Instant and digest channels
Instant alerts ride the real-time path and are mailed the moment a line is crossed, with a cooldown so a burst is one message, not forty. Digests collect the rest on the interval and recipients you choose - hourly, daily or weekly.
- 3.5σ
The anomaly line
Every policy, user, app and AI agent learns its own baseline: today against the median of its trailing 30 days. The alert line defaults to 3.5 sigma and is yours to move - history reclassifies at read time, so tuning takes seconds, not a quarter.
Episodes, not events
A spike opens one episode that tracks its peak and closes when behaviour returns to normal. One notification, one triage decision - open, acknowledge or dismiss - instead of an email per event.
Overrides per tenant, type, resource
Set the alert line and channels once for the tenant, then override per resource type or per single site, user or app - the finance site tighter, the marketing team looser - without touching the policies themselves.
No numbers to guess
The default rule needs no threshold from you.
Deviation from the policy's own baseline is the default alert rule: a spike of 50% over normal fires, and that is the whole configuration.
Deviation is three independent switches. Spikes are on by default. Drops are off, because holidays depress every policy at once. Silence is off, because a count hitting zero usually means something broke, not that risk disappeared. Each switch is a deliberate default you can flip per policy - and a plain threshold ("more than 500 downloads in an hour") is still there for the cases where you know the number.
Below the alert line, nothing is thrown away. Everything down to 2 sigma is kept as Info: stored, filterable, never mailed. When you suspect you missed something last week, you lower the line, filter to that week, and read what was already recorded below your old threshold.
In practice
A mass download, minute by minute.
What the alert path looks like on the day it matters.
- 01
14:02 - the spike begins
A contractor account starts pulling files from a finance site. The events land in the audit stream and the engine re-evaluates the affected policies within minutes - not on tonight's schedule.
- 02
14:06 - an episode opens
Today's download count for that account crosses its own 30-day baseline: 340 files against a usual 12. One anomaly episode opens and starts tracking the peak; the account's reach, device and origin are already attached.
- 03
14:07 - one email, with the why
The instant channel mails the moment the line is crossed: which policy, which account, how far from normal, on which device, from which city and network. The cooldown holds back the follow-up noise - the next 200 downloads do not send 200 emails.
- 04
14:15 - from alert to action
One click lands on the exact events behind the number in Activity logs. From the same screen: revoke the access, expire the links, disable the account - staged behind the review window and written to Actions with who approved it and when.
The difference
What every alert carries with it.
These are properties of the model, not features bolted onto a notification.
- The default rule is deviation from the account's own 30-day baseline - you add a fixed number only when you know it
- The email names the user plus what it can reach, its device, its city and network, and how far today sits from its normal
- Moving the alert line reclassifies history at read time - tuning takes seconds, not a quarter
- Findings down to 2 sigma are kept as Info - stored and filterable, never mailed
- AI agents get their own baselines, so "the finance agent read four times its usual files today" is a first-line signal
- Defender and Sentinel alerts land in the same list, already joined to the users, groups, mailboxes and apps they concern
- One cooldown-controlled email per episode instead of one per event - a 40-event burst is one message
- A 14-day warm-up before anomaly detection says anything, and a liveness strip on the engine ("last evaluation 3 minutes ago") so silence is verifiable
Deployment
Live the same day, honest from day one.
Connect with read-only consent and the engine starts learning immediately: first findings the same day, anomaly detection after a deliberate 14-day warm-up. No agents, no appliance, no SIEM contract. It runs on standard Microsoft 365 licenses, Business Basic upward, and stays fast on tenants with more than 40 million files because it re-evaluates only the slice each event touched.
- 1 dayfrom read-only consent to the first findings and live counts
- 14 daysof history before anomaly detection sends its first alert
- 500M+files in the largest tenants the engine already runs on - no E5 needed
Use cases
Three alerts teams set up in week one.
The exfiltration tripwire: an hourly instant alert on a one-hour download window, typically "more than 500 downloads by one user in an hour". A mass download is flagged while it is unfolding, with the device and the origin attached - the difference between an incident report and an interrupted incident.
The drift watch: new anyone links on files with sensitive data, permission changes on finance sites, sign-ins from a first-seen country. Each is a prebuilt trend with a live count, one click from becoming an alert.
The retro check: "we think we missed something last week" stops being a forensics project. Lower the anomaly line, filter to that week, and read what was recorded below your old threshold - same tenant, same data, same detector.
Real time monitoring
A mass download takes 20 minutes; the nightly report finds it tomorrow. The engine the alerts ride on.
See real time monitoring →High severity alert triage
The alert lands at 02:14. What you know by 02:20 - the account, its reach, its baseline, the device.
See alert triage →Anomaly detection
Every account, app and AI agent scored against its own 30-day baseline - the detector behind the deviation rule.
See anomaly detection →
FAQ
Questions teams ask before switching alerting on.
Do I have to tune thresholds before the alerts are useful?
No. The default rule is deviation from each policy's own baseline - a 50% spike over normal fires without any number from you. The anomaly line defaults to 3.5 sigma, and moving it reclassifies existing history at read time, so tuning is immediate and reversible rather than a quarter-long experiment. Where you know the number, a plain threshold is one field away.
How fast do alerts arrive after something happens?
Audit-log activity re-evaluates the affected policies within minutes of the event - typically around five from the moment the audit event arrives. Instant alerts are mailed the moment a line is crossed, with a cooldown against bursts; digest alerts collect everything else on the interval you set.
Does this replace Microsoft Defender alerts?
It joins them. Defender and Sentinel alerts appear in the same list, linked to the users, groups, mailboxes and apps they concern - and alongside them you get 1Security's own policy detections, which exist nowhere else because they are computed from your permission graph and baselines.
What licenses do we need?
Standard Microsoft 365 licenses from Business Basic upward. No E5, no Entra P2, no SIEM contract, nothing to install. A Microsoft Defender plan is only needed if you want Defender's own alerts ingested alongside 1Security's detections.
Will this flood our inboxes?
The model is built against that: episodes collapse a spike into one notification, instant alerts carry cooldowns, findings below the alert line are stored as Info instead of mailed, and everything else arrives as a digest on your schedule. In practice a mid-size tenant sees a handful of instant emails a week, not a hundred.
The 1Security platform
Microsoft 365 Alerts Tool is just the beginning
Microsoft 365 Alerts Tool is one screen of the 1Security platform for Microsoft 365. Locations, devices, apps, AI agents, logs, permissions, sensitive data, compliance, reports and actions run on the same read-only connection, on the licence you already have.
- ReportsSix report types in PDF, PowerPoint, HTML, CSV and JSON, under your brand with the client’s name, one report per client across the whole book.
- Trends and the daily briefWhat moved this month, what needs a decision today, ranked, for the client meeting and for your own morning.
- LocationsWhere every sign-in and every action really comes from, on a map, per tenant. Breaches by location, impossible travel, allow lists per person. Works without premium sign-in logs.
- DevicesRegistered, unregistered and shadow devices, attributed from activity rather than from an agent. The device nobody enrolled still shows up.
- Apps and consentEvery app with access to the tenant, what it can reach, who consented, and whether it still needs to.
- AI agents and CopilotThe agent registry: owners, reach, who each agent acts as, what Copilot will see. The EU AI Act checks per agent, accountable owner, instruction transparency and impact assessment, measured from the tenant. Readiness before the licences, governance after.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- All featuresExplore everything
See what your tenant would alert on, before you enable a single rule.
Connect read-only and the 50+ detections show their live counts in your tenant the same day. Turn on the three that matter, and the next incident arrives as one email with the account, the device and the events attached.
Or keep guessing thresholds and stitching the evidence together by hand.