# Which Microsoft 365 alert policies matter for email, and how do you set them up?

URL: https://iblockspam.com/blog/microsoft-365-alert-policies-email
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Running email day to day
Author: iBlockSpam Team

> Which default Microsoft 365 alert policies cover email, who gets notified, how to route alerts to the right people, build custom alerts, and what licenses add.

## Short answer

Microsoft 365 ships default alert policies for email, such as User restricted from sending email, Suspicious email sending patterns detected, Creation of forwarding/redirect rule and Email messages containing malicious file removed after delivery. User restricted from sending email notifies the TenantAdmins group by default. Review them in Defender under Email & collaboration > Policies & rules > Alert policy.

Microsoft 365 already watches for many of the email events that matter most: a mailbox blocked for sending spam, a new forwarding rule, malware pulled out of inboxes after delivery. The catch is that most of these alerts go to Global Administrators by default, and in a small business that is often an account nobody reads. This guide lists the default alert policies that matter for email, explains who gets notified, and shows how to route and extend them. It reflects Microsoft's documentation at the time of writing (October 2026).

## What is a Microsoft 365 alert policy?

An alert policy is a rule that watches for user or admin activity and raises an alert when it matches. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-xdr/alert-policies) describes a policy as "a set of rules and conditions that define the user or admin activity that generates an alert", plus a list of users it applies to and a threshold for how often the activity must occur.

Each policy has:

- **An activity** to track, with optional conditions such as IP address, user or file.
- **A trigger**: every time the activity occurs, when a threshold is exceeded, or when the activity becomes unusual for your organization.
- **A category**: Data loss prevention, Information governance, Mail flow, Permissions, Threat management or Others.
- **A severity**: Low, Medium, High or Informational.
- **Email notifications**: a recipient list and an optional daily notification limit.

Alerts appear in the Microsoft Defender portal under **Incidents & alerts** > **Alerts**. Policies live under **Email & collaboration** > **Policies & rules** > **Alert policy** ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/alert-policies-defender-portal)).

## Which default alert policies cover email?

Microsoft's built-in policies are marked as type **System** and are turned on by default. You can switch them off, change who is notified and set a daily limit, but "the other settings for these policies can't be edited." These are the ones most relevant to email, with the severity and plan Microsoft lists at the time of writing:

| Default policy | What triggers it | Severity | Plans listed |
|---|---|---|---|
| User restricted from sending email | A user is blocked from sending outbound mail, typically after a compromise | High | Business Basic, Standard, Premium, E1/E3/E5 |
| Suspicious email sending patterns detected | A user sent suspicious email and is at risk of being restricted | Medium | E1/E3/E5 |
| Email sending limit exceeded | A user sent more than the outbound spam policy allows | Medium | E1/E3/E5 |
| Suspicious email forwarding activity | A user auto-forwarded email to a suspicious external account | High | E1/E3/E5 |
| Creation of forwarding/redirect rule | A user creates an inbox rule that forwards or redirects mail | Informational | E1/E3/E5 |
| Tenant restricted from sending email | Most outbound traffic looks suspicious and Microsoft blocks the whole organization | High | E1/E3/E5 |
| Suspicious connector activity | Suspicious activity on an inbound connector; mail through it is blocked | High | E1/E3/E5 |
| Email messages containing malicious file removed after delivery | Zero-hour auto purge removed delivered messages with a malicious file | Informational | E1/E3/E5 |
| Email messages containing malicious URL removed after delivery | ZAP removed delivered messages with a malicious URL | Informational | E3, Business Premium, Defender for Office 365 Plan 1 or 2 |
| Messages containing malicious entity not removed after delivery | ZAP tried and failed to remove a malicious message | Medium | E3, Business Premium, Defender for Office 365 Plan 1 or 2 |
| Email reported by user as malware or phish | A user reports a message as phishing | Low | E3, Business Premium, Defender for Office 365 Plan 1 or 2 |
| Messages have been delayed | 2,000 or more messages queued for more than an hour on a connector | High | E1/E3/E5 |

Two names have changed. Microsoft says **Email messages containing malware removed after delivery** "was replaced by" **Email messages containing malicious file removed after delivery**, and **Email messages containing phish URLs removed after delivery** was replaced by the malicious URL version. It recommends disabling the old ones. If you search for the old names in older guides, that's why they look different.

### What the important ones tell you

- **User restricted from sending email** is the one alert every tenant should route to a real person. Microsoft says it "typically indicates a compromised account". The user then appears on the **Restricted entities** page, and their outbound mail bounces with [550 5.1.8](https://iblockspam.com/smtp-errors/550-5-1-8). Our guide on [a Microsoft 365 user blocked from sending](https://iblockspam.com/blog/microsoft-365-user-blocked-from-sending) covers the recovery.
- **Suspicious email sending patterns detected** is the early warning. Microsoft calls it behavior "not severe enough to restrict the user", so it gives you a chance to act before the block.
- **Creation of forwarding/redirect rule** catches a classic attacker move, but read the small print: it "only tracks inbox rules that are created using Outlook on the web" or Exchange Online PowerShell. A rule created another way won't trigger it. See [malicious inbox rules and auto-forwarding](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding) for how to look for the rest.
- **Removed after delivery** alerts tell you [zero-hour auto purge](https://iblockspam.com/blog/microsoft-365-zero-hour-auto-purge-zap) pulled something out of mailboxes. They are informational, but a user may have opened the message first. Several of these alerts also start [automated investigation and response](https://iblockspam.com/blog/microsoft-365-automated-investigation-response).

## Who gets notified by default?

For **User restricted from sending email**, Microsoft documents the default directly: "**Email recipients**: The default value is **TenantAdmins** group (**Global Administrator** members)", and the **Daily notification limit** default is **No limit** ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-restore-restricted-users)).

That default causes three common problems:

1. **Nobody reads the Global Administrator mailbox.** Many small businesses use a dedicated admin account with no one checking its mail.
2. **Your IT provider isn't a Global Administrator.** An MSP working through delegated access may never see the email.
3. **Too many alerts go to the same people.** Informational alerts arrive alongside the urgent ones and get ignored.

Microsoft also notes that "for alerts to work, audit logging must be turned on (it's on by default)." Check it hasn't been switched off.

## How do you change who receives an alert?

To route a default policy to the people who respond:

1. Sign in to the Microsoft Defender portal at `security.microsoft.com`.
2. Go to **Email & collaboration** > **Policies & rules** > **Alert policy**.
3. Find the policy, for example **User restricted from sending email**, and select its row.
4. In the flyout, check that **Status** is on.
5. Select **Edit recipient settings** (or **Edit policy**).
6. On **Decide if you want to notify people when this alert is triggered**, make sure **Opt-in for email notifications** is selected.
7. Add recipients in **Email recipients**. Use a monitored group or shared address rather than one person.
8. Set a **Daily notification limit** if the policy is noisy, then select **Next** and **Submit**.

You need permissions to do this. In Defender's own role groups, Microsoft lists **Organization Management** or **Security Administrator** for creating and managing alert policies in the Threat management category; the Entra roles **Global Administrator** and **Security Administrator** also work.

### A practical routing plan

| Alert | Send to | Why |
|---|---|---|
| User restricted from sending email, Tenant restricted from sending email | IT on-call group and the business owner | Outbound mail is already stopped |
| Suspicious email sending patterns, Suspicious email forwarding activity | IT on-call group | Possible compromise in progress |
| Creation of forwarding/redirect rule | IT group, with a daily limit | Often legitimate, worth a same-day look |
| Suspicious connector activity, Messages have been delayed | Whoever manages mail flow | Inbound or hybrid mail is affected |
| Removed after delivery, user-reported phish | Security mailbox or ticket queue | Review, not wake-up calls |

## How do you create a custom alert policy?

Default policies can't be edited beyond recipients and limits, so for anything else you create your own. On the **Alert policy** page, create a new policy and work through these settings, which come from Microsoft's description of a policy:

1. **Name, severity and category.** Give it a clear name and pick a severity you'll filter on later.
2. **Activity.** Choose what to watch, for example an Exchange mailbox activity from the audit log. Microsoft notes that "activities related to malware campaigns and phishing attacks require" E5 or Defender for Office 365 Plan 2.
3. **Conditions.** Limit it to specific users, IP ranges or other properties. You can also use user tags, such as a tag for your finance team.
4. **Trigger.** Choose every occurrence, a threshold, or unusual activity.
5. **Recipients and daily limit.** Same as above.

You can also script it with the [New-ProtectionAlert](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-protectionalert) cmdlet in Security & Compliance PowerShell, and inspect any default policy, including filters the portal doesn't show, with `Get-ProtectionAlert -Identity "<PolicyName>" | Format-List`.

Plan for the delay. Microsoft says "it takes up to 24 hours after creating or updating an alert policy before alerts can be triggered by the policy." For unusual-activity triggers, it takes "up to seven days" to build a baseline, "during which alerts aren't generated."

### Custom alert ideas for email

- Mailbox permissions added (for example Full Access) to an executive's or finance mailbox.
- Inbox rules created by a small group of high-risk users, as a supplement to the default forwarding alert.
- Changes to mail flow rules or connectors by anyone outside your IT group.

Test each one by doing the activity yourself after 24 hours and confirming the alert and email arrive.

## How does licensing change what you get?

Microsoft lists alert policies as available in Microsoft 365 Enterprise, Office 365 Enterprise and US Government plans, and the default policy table names individual Business plans where they apply. Advanced functionality needs Microsoft 365 E5/G5, or E1/E3 plus an add-on such as Defender for Office 365 Plan 2.

| Capability | E1/E3 (and policies listed for Business plans) | E5, or E1/E3 + Defender for Office 365 Plan 2 |
|---|---|---|
| Default email alerts listed above | Most of them | All of them |
| Custom alert, every occurrence | Yes | Yes |
| Custom alert on threshold or unusual activity | No | Yes |
| Malware and phishing campaign activities in custom alerts | No | Yes |
| Alert aggregation interval | 15 minutes | 1 minute |

Aggregation means repeated events inside the interval are added to the first alert rather than creating new ones. Microsoft also lists **Defender for Office 365 Plan 1** and "the built-in security features for all cloud mailboxes" at the 15-minute interval. For the plan differences beyond alerting, see [Defender for Office 365 Plan 1 vs Plan 2](https://iblockspam.com/blog/defender-for-office-365-plan-1-vs-plan-2).

## What should you do when an email alert fires?

An alert is a starting point. [NIST SP 800-61 Rev. 3](https://csrc.nist.gov/pubs/sp/800/61/r3/final), published in April 2025, frames incident response as part of overall risk management, so treat alert handling as a written process, not an improvised one. Our [email security incident response plan](https://iblockspam.com/blog/email-security-incident-response-plan) gives you a template. For a compromised-mailbox alert:

1. Assign the alert in the **Alerts** page and set it to **In progress**.
2. Reset the password, revoke sessions and check MFA methods for the user.
3. Look for inbox rules, forwarding and delegates you didn't expect. Our checklist on the [signs an email account is compromised](https://iblockspam.com/blog/signs-email-account-compromised) walks through each place.
4. Check the [audit log](https://iblockspam.com/blog/microsoft-365-audit-log-email-investigation) for what the account did, trace what was sent with [message trace](https://iblockspam.com/blog/microsoft-365-message-trace) and decode any sample headers with the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer).
5. Only then remove the user from **Restricted entities**.
6. Resolve the alert and note what you found.

## Next steps

- Open **Alert policy** today and add a monitored group to **User restricted from sending email**, **Suspicious email sending patterns detected** and **Suspicious email forwarding activity**.
- Disable the replaced "malware removed after delivery" and "phish URLs removed after delivery" policies if they are still on, and make sure the new versions are.
- Confirm audit logging is on, then trigger a test alert.
- Reduce what reaches mailboxes in the first place. A filtering layer such as iBlockSpam checks inbound mail before Microsoft 365 sees it; see [how it fits with Microsoft 365](https://iblockspam.com/platforms/microsoft-365).

Browse more guides on [running email day to day](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### Who receives Microsoft 365 alert policy emails by default?

For default policies such as User restricted from sending email, Microsoft sets the email recipients to the TenantAdmins group, which means Global Administrator members, with no daily notification limit. You can add other users or groups to each default policy. You can't change a default policy's conditions, only its status, recipients and daily limit.

### Why didn't I get an alert when a user's mailbox was compromised?

Common reasons are that the alert only goes to Global Administrators who don't read that mailbox, audit logging was turned off, the policy was disabled, or the activity didn't match. The forwarding-rule alert, for example, only tracks rules created in Outlook on the web or Exchange Online PowerShell, not every client.

### Do I need Microsoft 365 E5 for email alert policies?

No. Many email alerts, including User restricted from sending email, Suspicious email sending patterns detected and Creation of forwarding/redirect rule, are listed for E1 and E3 plans, and some for Business plans. E5 or a Defender for Office 365 Plan 2 add-on adds threshold-based and anomaly-based custom alerts and some extra default policies.

### How long does a new Microsoft 365 alert policy take to start working?

Microsoft says it can take up to 24 hours after you create or update an alert policy before it can trigger alerts, because the policy has to sync to the alert detection engine. Threshold policies based on unusual activity need up to seven more days to build a baseline before they generate anything.

### Can I send Microsoft 365 alerts to a shared mailbox or ticketing system?

Yes. The recipient box on each policy accepts users and groups, so you can add a mail-enabled group or a shared address that feeds your ticketing system. Set a daily notification limit on noisy policies so one incident doesn't flood the queue, and keep the alert dashboard as the record.

## Sources

- [Microsoft Learn: Alert policies in the Microsoft Defender portal (Microsoft Defender XDR)](https://learn.microsoft.com/en-us/defender-xdr/alert-policies)
- [Microsoft Learn: Alert policies in the Microsoft Defender portal (Defender for Office 365)](https://learn.microsoft.com/en-us/defender-office-365/alert-policies-defender-portal)
- [Microsoft Learn: Remove blocked users from the Restricted entities page](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-restore-restricted-users)
- [Microsoft Learn: New-ProtectionAlert (Security & Compliance PowerShell)](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-protectionalert)
- [NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management (April 2025)](https://csrc.nist.gov/pubs/sp/800/61/r3/final)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [SMTP Error Code Lookup](https://iblockspam.com/tools/smtp-error-codes): Paste a bounce or type a code like 550 5.7.26: plain-English meaning, likely causes and fixes, with sources.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-alert-policies-email (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt