How to Set SharePoint Alerts for Site Creation and Deletion
Question details
The user wants to configure automated email notifications to monitor whenever new SharePoint sites are created or existing sites are deleted.
- Product
- SharePoint / Microsoft Purview
- Device & OS
- not provided
- Scenario
- Monitoring a Microsoft 365 environment for tracking SharePoint site lifecycle changes, regardless of whether the action is performed by a global administrator or another user.
- Observed behavior
- By default, the system does not automatically send email alerts to administrators when non-global admin users create or delete SharePoint sites.
Ensure you have the necessary administrator permissions (such as Compliance Administrator or Global Administrator) in your Microsoft 365 tenant, and verify that Microsoft 365 audit logging is enabled for your organization.
Configure Alert Policies in Microsoft Purview Compliance Portal
Set up a custom alert policy linked to the unified audit log to automatically email specified recipients whenever a SharePoint site is created or deleted.
This method utilizes Microsoft 365's audit logging features to track administrative and user activities. By creating a custom alert policy, you can ensure that designated administrators or compliance officers are instantly notified of site lifecycle events, even if the action is triggered by users with restricted administrative access.
Log in to the Microsoft Purview compliance portal (compliance.microsoft.com) using an account with appropriate administrative privileges.
On the left navigation pane, click on 'Policies' and then select 'Alert policies' from the expanded menu.
Click the '+ New alert policy' button. Enter a descriptive name for your policy (e.g., 'SharePoint Site Changes'), provide a brief description, and choose a severity level for the alert.
In the 'Create alert settings' step, choose 'Custom alert'. Under the activity dropdown, search for and select the specific SharePoint activities: 'Created site' and 'Deleted site'. It is recommended to check your audit logs beforehand to confirm the exact event names used in your tenant.
Specify the email addresses of the users who should receive the notifications. Review your settings and click 'Finish' to save and activate the alert policy.
Manage Your Documents Effectively with WPS Office
While SharePoint handles your organizational sites and file repositories, you still need a powerful application to create and edit the documents stored within them. WPS Office provides a lightweight, highly compatible, and free alternative to Microsoft Office, making it easy to handle your daily document workflows.
- 1. Download the Installer: Visit the official WPS Office website and download the free installer for Windows, Mac, or Linux.
- 2. Install WPS Office: Run the downloaded file and follow the simple on-screen instructions to install the suite on your device.
- 3. Edit Your Documents: Open WPS Office to instantly view and edit your Word, Excel, and PowerPoint files without worrying about formatting issues.
Frequently Asked Questions
Can I set up SharePoint alerts if I am not a global admin?
Yes. As long as you have been assigned the Compliance Administrator or Security Administrator roles in Microsoft Entra ID (formerly Azure AD), you will have the necessary permissions to access the Microsoft Purview compliance portal and create alert policies.
Why am I not receiving email alerts immediately after a SharePoint site is deleted?
Microsoft 365 audit logs are not strictly real-time. It takes time for the system to ingest the audit data. Consequently, it can take up to 24 hours for the alert policy to process the event and trigger an email notification.
How do I find the exact event name for site creation in the audit log?
Before setting up your alert policy, go to the 'Audit' section in the Purview portal. Run a manual search for recent SharePoint activities. Reviewing the results will show you the exact Activity names (such as 'Created site') utilized in your specific Microsoft tenant.
Do alert policies work for Microsoft Teams site creations as well?
Yes. When a new team is created in Microsoft Teams, an underlying SharePoint site is automatically provisioned. Therefore, a policy set to monitor the 'Created site' activity will also trigger when a new Team is formed.
