Alert policies in the Microsoft Defender portal

Quoted on this wiki

Every place a page here uses this source, in the order the words come in it.

1. Informational No E1/F1/G1, E3/F3/G3, or E5/G5 Email messages containing malicious file removed after delivery Generates an alert when any messages containing a malicious file are delivered to mailboxes in your organization. If this event occurs, Microsoft removes the infected messages from Exchange Online mailboxes using Zero-hour auto purge. This policy automatically triggers automated investigation and response in Office 365. For more information on this new policy, see Alert policies. Informational Yes E1/F1/G1, E3/F3/G3, or E5/G5 Email messages containing malicious URL removed after delivery Generates an alert when any messages containing a malicious URL are delivered to mailboxes in your organization. If this event occurs, Microsoft removes the infected messages from Exchange Online mailboxes using Zero-hour auto purge. This policy automatically triggers automated investigation and response in Office 365. For more information on this new policy, see Alert policies. Informational Yes E3/G3, Microsoft 365 Business Premium, Defender for Office 365 Plan 1 add-on, E5/G5, or Defender for Office 365 Plan 2 add-on. Email messages containing malware removed after delivery Note: This alert policy was replaced by Email messages containing malicious file removed after delivery. This alert policy will eventually go away, so we recommend disabling it and using Email messages containing malicious file removed after delivery instead. For more information, see Alert policies. Informational Yes E5/G5 or Defender for Office 365 Plan 2 add-on subscription. Email messages containing phish URLs removed after delivery Note: This alert policy was replaced by Email messages containing malicious URL removed after delivery. This alert policy will eventually go away, so we recommend disabling it and using Email messages containing malicious URL removed after delivery instead. For more information, see Alert policies. “Generates an alert when users in your organization report messages as junk using the built-in Report button in Outlook or the Report Message add-in.” For Defender for Office 365 Plan 2, E5, G5 customers, this alert automatically triggers automated investigation and response in Defender for Office 365 Plan 2. Low Yes E3/G3, Microsoft 365 Business Premium, Defender for Office 365 Plan 1 add-on, E5/G5, or Defender for Office 365 Plan 2 add-on. Email reported by user as not junk Generates an alert when users in your organization report messages as not junk the built-in Report button in Outlook or the Report Message add-in. For more information about the add-ins, see Use the Report Message add-in. Low No E1/F1/G1, E3/F3/G3, or E5/G5 Email sending limit exceeded Generates an alert when someone in your organization has sent more mail than is allowed by the outbound spam policy. This is usually an indication the user is sending too much email or that the account might be compromised. If you get an alert generated by this alert policy, it's a good idea to check whether the user account is compromised. Medium No E1/F1/G1, E3/F3/G3, or E5/G5 Failed exact data match upload Generates an alert when a user receives the following error when uploading an exact data match based sensitive information type: New sensitive information failed to upload. Try again later. High No E5/G5. Form blocked due to potential phishing attempt Generates an alert when the system detects suspected phishing behavior in a form. High No E1, E3/F3, or E5 Form flagged and confirmed as phishing Generates an alert when a form created in Microsoft Forms from within your organization is identified as potential phishing through Report Abuse and confirmed as phishing by Microsoft. High No E1, E3/F3, or E5 Malware not zapped because ZAP is disabled Generates an alert when Microsoft detects delivery of a malware message to a mailbox because Zero-Hour Auto Purge for Phish messages is disabled. Informational No E5/G5 or Defender for Office 365 Plan 2 add-on subscription.

   In Spam complaint management

2. Go to the Default alert policies section in this article for a list and description of the available alert policies. “Alert policies let you categorize the alerts that are triggered by a policy, apply the policy to all users in your organization, set a threshold level for when an alert is triggered, and decide whether to receive email notifications when alerts are triggered.” Note

   In Outbound alerts and notifications

3. “You can use alert policies and the alerts dashboard in the Microsoft Defender portal to create alert policies and then view the alerts that are generated when users perform activities that match the conditions of an alert policy.” Tip

   In Outbound alerts and notifications

4. Go to the Default alert policies section in this article for a list and description of the available alert policies. “There's also a Alerts page where you can view and filter alerts, set an alert status to help you manage alerts, and then dismiss alerts after you address or resolve the underlying incident.” Note

   In Outbound alerts and notifications

Quotes are verbatim and belong to their publishers. Where a quote has been translated, the original wording is kept below it.