How to Retrieve Detailed Activity Info from Microsoft 365 Security Alerts
Question details
Administrators need to extract detailed activity information, such as the affected site and user, from Microsoft 365 security alert notifications.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- An administrator receives an alert email when a user is added as a site collection administrator, but the email lacks specific details about the affected site or user.
- Observed behavior
- The default alert emails do not include the granular activity list that is normally visible in the alert flyout within the admin center.
Ensure you have global administrator or security administrator privileges in your Microsoft 365 tenant to access Microsoft Purview, audit logs, and Graph API.
Investigate Microsoft Purview Audit Logs
Since standard alert emails do not include full flyout details, you must manually query the audit logs to extract the required fields.
Microsoft 365 alert policies are limited in the data they can push via standard email notifications. To retrieve granular details like the specific SharePoint site URL or the newly added user, administrators must query the underlying event data directly in the compliance portal.
Log in to the Microsoft Purview compliance portal using your administrator credentials.
Navigate to the 'Audit' section and run a search for the 'Added site collection admin' activity around the specific time the alert was triggered.
Click on the corresponding audit record in the search results to view the full details, which will reveal the affected site URL and the target user.
Consult the Microsoft Q&A Community for Graph API Solutions
If you need to build a custom automated alerting system using Microsoft Graph API, seeking guidance from engineers in the Microsoft community is highly recommended.
Simplify Your Workflow with WPS Office
While Microsoft 365 provides complex enterprise security and compliance tools, daily document creation shouldn't require administrative overhead. WPS Office offers a free, lightweight, and highly compatible alternative to Microsoft Office for your personal and professional productivity needs.
- 1. Download WPS Office: Visit the official WPS website and download the installer for your operating system.
- 2. Install the application: Run the setup file and follow the quick installation prompts.
- 3. Start creating: Launch WPS Office to open, edit, and save documents in Microsoft formats with zero learning curve.
Frequently Asked Questions
Why doesn't Microsoft 365 include full activity details in alert emails?
Microsoft 365 standard alert emails are designed to act as concise, high-level notifications. To protect sensitive tenant data and reduce email payload size, granular details like affected site URLs and specific user IDs are kept secured within the admin center flyouts or Purview audit logs.
Can I customize the email template for Microsoft 365 security alerts?
Out-of-the-box Microsoft 365 alert policies do not offer extensive email template customization to include custom dynamic variables. You would need to use Power Automate combined with the Graph API to build custom alerting flows.
Where can I find the complete SharePoint audit data for site collection admin changes?
You can view complete SharePoint activity by navigating to the Microsoft Purview compliance portal, selecting 'Audit', and searching for specific SharePoint site administration activities during the timeframe the alert was generated.
