What alert policies are and are not
An alert is a signal to IT or the director: “something happened that you want to see”. It does not automatically stop the action (unless you have separate policy that does), and it is not end-user training. The external email banner warns the recipient; alert policies warn whoever runs the tenant.
Microsoft ships default templates. Not all of them are equally useful for a small company. Turning everything on means nobody takes the inbox seriously. Turning too little on means you notice a mass download or a new forwarding rule weeks later — or never.
Which alerts an SME usually enables
A small, recognizable set usually beats “leave every default on”:
- Suspicious or bulk download / exfiltration signals — someone pulls many files from SharePoint or OneDrive in a short window.
- Malware or phish that hits your defenses — Defender for Office 365 signals you want to see, not only silently in a dashboard.
- Creation or change of forwarding rules — often an early sign of account misuse; see also automatic email forwarding.
- Unusual elevation or sensitive admin actions — someone gains or takes rights that are normally rare.
- eDiscovery or compliance searches — useful when you want to know who is searching other people’s content in the tenant.
Deliberately leave low-signal or duplicate templates off until you know who reads alerts. An alert without an owner is noise.
Recipient, escalation, and noise
Name one primary recipient or a shared admin mailbox — not “every Global Admin personally” with no agreement. Write briefly: who opens the alert within X hours, when you escalate to Floor ICT or the director, and what you never ignore (for example forwarding to a personal address or a mass download outside business hours).
Test once that mail or notifications actually arrive (spam filters, shared mailbox, mobile push). Alerts that vanish in a full inbox do not help. Tie this to who may respond to app consent and who owns Conditional Access — see Conditional Access.
What Floor ICT configures — and what you decide
In the Microsoft 365 tenant we typically: turn on or tune the agreed alert policies; set recipients and (where needed) severity; and briefly explain which alerts you should expect. We filter templates that mostly add noise for your size unless you ask for them.
You still decide: who the named owner is, what escalation applies outside business hours, and whether an alert may become a Floor ICT ticket or stays internal. Essential, Advanced, or Elite say nothing about alert policies; that is tenant configuration beside the MSP package. Alerts work best next to audit logging, forwarding controls, and clear admin roles.
More depth
Checklist for SME directors
1) Pick five or fewer high-signal alerts. 2) Name one mailbox or person as owner. 3) Write escalation (who, when, to Floor ICT). 4) Confirm notifications arrive. 5) Have Floor ICT publish the policies. 6) Review after a month if the inbox is full of noise — then tune, do not “turn everything off”.
Alert versus audit log
An alert says “look now”; the audit log says “what exactly happened”. Without the log you lack context after a notification. Without the alert you miss the moment. You need both — see audit logging.
Difference from the external email banner
The banner is user-facing and visible in Outlook for mail from outside. Alert policies are admin-facing. Use them side by side; do not confuse them — see external email warning banner.
Questions
Frequently asked questions
Should we enable every default alert template?
No. Start with a small high-signal set and a named recipient. Too many templates lead to ignored mail. Expand if you notice you are seeing a type of incident too late.
Is this the same as the external email warning banner?
No. The banner warns the user in Outlook. Alert policies warn admins or a named mailbox about suspicious activity in the tenant.
Who should receive alerts in a small company?
Ideally one accountable person or a shared admin mailbox with an agreed reading rhythm — not “everyone titled Global Admin” without an owner. Writing an escalation path to Floor ICT or the director helps.
Does Floor ICT do this by default with Microsoft 365 management?
At intake or when Microsoft 365 is in scope, we propose a small alert set and recipients. Which policies go on and who responds stays your call. The MSP package says nothing about alert policies; that is separate tenant configuration.