Security Policy Errors

How to Fix Unable to Add Recipients to Microsoft Defender Alert Policies

Maira Mehtab Sep 20, 2026 869 views

Question details

A global administrator is experiencing inconsistent behavior when attempting to add recipients to Microsoft Defender alert policies, with changes failing to submit or persist.

Product: Microsoft Defender
Device & OS: not provided
Scenario: Modifying alert policy recipients as a global administrator
Observed behavior: Changes to alert policy recipients fail to submit or do not persist after saving.

Before you start

Ensure you are logged in with Global Administrator or Security Administrator privileges in the Microsoft 365 Defender portal before attempting to modify alert policies.

Solution 1Recommended

Verify if the Alert Policy is a Default Policy

Determine if the policy you are trying to edit is a built-in default policy, as some of these cannot be edited directly.

Microsoft Defender includes several system-managed default alert policies designed to maintain a baseline level of security. To prevent accidental misconfiguration, Microsoft restricts direct editing of these default policies.

Locate the policy

Navigate to the Microsoft 365 Defender portal and find the specific alert policy you are attempting to modify.

Check policy restrictions

Review the policy details to see if it is marked as a default or built-in policy. If the editing options are grayed out or changes fail to save, it is likely a restricted default policy.

Create a custom policy alternative

If you need specific recipients for an alert type covered by a restricted default policy, create a new custom alert policy with identical parameters and assign your desired recipient list.

Solution 2

Manage Custom Policies via PowerShell

Use PowerShell to verify and manage custom alert policies if the web portal is failing to save your changes.

Free Microsoft Office alternative

Try WPS Office for a Streamlined Document Management Experience

While troubleshooting Microsoft 365 admin policies can be highly complex, managing your daily documents shouldn't be. WPS Office is a free, lightweight, and user-friendly alternative to Microsoft Office, offering powerful tools without the heavy administrative overhead.

1. Download the installer: Visit the official WPS Office website and download the free version for your operating system.
2. Install the software: Run the installation package and follow the quick on-screen instructions.
3. Open your files: Launch WPS Office and instantly open your existing Microsoft Office documents without any formatting loss.

Fully compatible with Microsoft Office formats (Word, Excel, PowerPoint).Lightweight installation with lightning-fast startup speeds.Familiar user interface ensuring a seamless transition for all users.Built-in PDF editing tools for comprehensive document workflows.

microsoft office alternative - wps office

Frequently Asked Questions

Why can't I edit certain Microsoft Defender alert policies?

Microsoft Defender includes system-managed default alert policies to ensure baseline security monitoring. To protect these core configurations, Microsoft restricts administrators from directly editing them, including modifying their recipient lists.

Can I use PowerShell to add recipients to Defender alert policies?

Yes, administrators can use Exchange Online PowerShell to manage custom alert policies. Cmdlets such as 'New-ProtectionAlert' and 'Set-ProtectionAlert' allow you to securely configure and modify policy recipients.

What should I do if my policy changes in the Defender portal are not saving?

First, verify that your account has the necessary Global Administrator or Security Administrator roles. If permissions are correct, check if the policy is a restricted default policy. If it is a custom policy, try applying the changes via PowerShell instead of the web portal.

Microsoft Office Security Issues