Security Policy Errors

How to Restore the TenantAdmins Recipient in Microsoft Defender Alert Policies

Chanuka Geekiyanage Oct 10, 2026 868 views

Question details

The user needs to restore the built-in TenantAdmins recipient for Microsoft Defender alert-policy email notifications after it was accidentally removed.

How to Restore the TenantAdmins Recipient in Microsoft Defender Alert Policies

Product: Microsoft Defender
Device & OS: not provided
Scenario: Configuring email notification recipients in Microsoft Defender alert policies to ensure administrators receive security alerts.
Observed behavior: The built-in TenantAdmins group is hidden and no longer searchable or available to add back once it has been removed from the Defender alert policy.

Before you start

Ensure you have global administrator or security administrator privileges in the Microsoft 365 admin center to modify alert policies and manage mail-enabled security groups.

Solution 1Recommended

Use Alternative Mail-Enabled Administrator Groups

Since the built-in TenantAdmins group is hidden and cannot be manually re-added, the best workaround is to replace it with a standard mail-enabled security group.

TenantAdmins is a built-in hidden administrative group rather than a standard Microsoft 365 group. Because the recipient search only queries standard mailboxes and mail-enabled groups in Exchange, the hidden TenantAdmins group will not appear in search results once removed.

To ensure your administration team continues to receive alerts without disruption, you should create or assign a different mail-enabled administrative distribution group.

Access Microsoft Defender Portal

Navigate to Alert Policies

Go to the 'Policies & rules' section in the left-hand navigation pane and select 'Alert policies' from the available options.

Edit the Target Policy

Click on the specific alert policy you wish to update, then select 'Edit policy' from the flyout pane.

Assign a New Recipient Group

In the 'Set your recipients' section, search for and select an existing mail-enabled security group or administrator distribution group to replace the missing TenantAdmins recipient.

Use Alternative Mail-Enabled Administrator Groups

Contacting Microsoft Support: If your organization's compliance regulations strictly require the use of the original built-in TenantAdmins group, you must contact Microsoft Support directly to have it restored from the backend.

Free Microsoft Office alternative

Manage Your Security Compliance Reports Easily with WPS Office

While configuring your Microsoft 365 security policies, you may need a reliable, cost-effective office suite for your team. WPS Office provides a lightweight, highly compatible alternative to Microsoft Office, perfect for drafting security documentation and managing administrative spreadsheets.

1. Download and Install: Get WPS Office Free from the official website and run the lightweight installer on your device.
2. Open Existing Documents: Open your exported security reports and Excel logs directly in WPS Office without formatting loss.
3. Save and Share: Edit your documents and save them in standard Microsoft Office formats like .docx or .xlsx for seamless sharing.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats.Free to download and use with a highly familiar user interface.Lightweight software that loads quickly on any device, reducing system strain.Perfect for documenting security policies, alert configurations, and audit logs.

microsoft office alternative - wps office

Frequently Asked Questions

Why did TenantAdmins disappear from my Microsoft Defender alert policy?

TenantAdmins is a built-in hidden group. If a user manually removes it from the alert policy recipients list, the Exchange recipient search cannot query it again because it is hidden from standard directories by default.

Can I restore TenantAdmins from the Deleted Groups section in Microsoft 365?

No, TenantAdmins is not a standard Microsoft 365 group. Checking the Deleted Groups section in the Microsoft 365 admin center will not help you restore this specific hidden recipient.

How do I create a replacement group for Defender alert notifications?

You can go to the Exchange admin center or Microsoft 365 admin center to create a new mail-enabled security group, add your administrators to this group, and assign it to your Defender alert policies as a direct replacement.

Microsoft Office Security Issues