> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/tenant/administration/alert-configuration.md).

# Alert Configuration

Alerts in CIPP come in two flavours, and both are listed here. Audit log alerts watch the Microsoft 365 audit log and fire as matching entries arrive. Scripted alerts run on a recurring schedule and check a specific condition each time they execute. This page shows every configured alert rule of both kinds, with the tenants they cover and what happens when they trigger, and lets you edit, clone, disable or remove them.

## Action Buttons

Use [Add Alert](/user-documentation/tenant/administration/alert-configuration/alert.md) to create a new alert rule of either type.

## Table Details

| Column           | Description                                                                                                                                                                                                                             |
| ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Tenants          | The tenants or tenant groups the alert is scoped to.                                                                                                                                                                                    |
| Event Type       | Whether the rule is an audit log alert (`Audit log Alert`) or a scripted alert that runs on a schedule (`Scheduled Task`).                                                                                                              |
| Enabled          | Whether the alert is currently live. A disabled alert keeps its full configuration but never triggers: audit log alerts stop matching incoming entries, and scripted alerts are skipped when their next run is due.                     |
| Conditions       | For audit log alerts, the configured conditions written out in plain language, joined with "and" when more than one is set. For scripted alerts, the name of the alert being run.                                                       |
| Repeats Every    | How often the alert runs. Audit log alerts show `When received`, as they fire as matching log entries arrive; scripted alerts show their configured recurrence.                                                                         |
| Actions          | What CIPP does when the alert triggers. For audit log alerts this is the list of chosen response actions, such as generating a ticket or disabling the user in the log entry. For scripted alerts it is the configured delivery method. |
| Alert Comment    | The optional free-text comment saved with the alert.                                                                                                                                                                                    |
| Excluded Tenants | Any tenants or tenant groups left out of the alert's scope.                                                                                                                                                                             |

{% hint style="info" %}
Excluded tenants only apply where the alert is scoped broadly, such as to all tenants or to a tenant group. A scripted alert that names its tenants individually has nothing to exclude, so this column stays empty.
{% endhint %}

## Table Actions

<table><thead><tr><th>Action</th><th>Description</th><th data-type="checkbox">Bulk Action Available</th></tr></thead><tbody><tr><td>View Task Details</td><td>Opens the underlying scheduled task, showing its run history and results. Greyed out for any row whose <strong>Event Type</strong> is not <code>Scheduled Task</code>.</td><td>false</td></tr><tr><td>Edit Alert</td><td>Opens the alert for editing so its tenants, conditions, schedule and actions can be adjusted and saved back over the existing rule.</td><td>false</td></tr><tr><td>Clone &#x26; Edit Alert</td><td>Opens a copy of the alert for editing, saving it as a new rule and leaving the original untouched. Useful for applying the same alert to a different set of tenants.</td><td>false</td></tr><tr><td>Enable Alert</td><td>Turns a disabled alert back on after confirmation, so it starts triggering again from the next matching log entry or scheduled run. Greyed out for alerts that are already enabled.</td><td>true</td></tr><tr><td>Disable Alert</td><td>Stops the alert triggering after confirmation, leaving its tenants, conditions and actions in place so it can be switched back on later. Greyed out for alerts that are already disabled.</td><td>true</td></tr><tr><td>Delete Alert</td><td>Removes the alert rule after confirmation. The alert stops firing immediately and cannot be recovered.</td><td>true</td></tr></tbody></table>

{% hint style="info" %}
Disabling is the reversible alternative to deleting. Editing a disabled alert and saving it keeps it disabled, so an alert stays off until you explicitly enable it again.
{% endhint %}

***

## Feature Requests / Ideas

We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.cipp.app/user-documentation/tenant/administration/alert-configuration.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.