Why Microsoft 365 Defender Alerts Appear in Microsoft Purview
Question details
An informational Email and Collaboration alert for a forwarding or redirect rule generates an email notification but does not show up in the Microsoft 365 Defender Incidents and Alerts area. The alert is instead routed to the Microsoft Purview portal.
- Product
- Microsoft 365 Defender / Microsoft Purview
- Device & OS
- not provided
- Scenario
- Tracking email forwarding or redirect rule alerts in the Microsoft 365 security and compliance portals.
- Observed behavior
- The generated alert is missing from Microsoft 365 Defender and is only visible within the Microsoft Purview portal.
Ensure you have the appropriate administrator permissions assigned in both the Microsoft 365 Defender and Microsoft Purview portals to view compliance alerts.
Locate Compliance Alerts in Microsoft Purview
Check the Microsoft Purview portal for compliance-related alerts that do not generate a corresponding incident in Defender.
Microsoft structures its administrative portals based on incident categories. While security threats and malware incidents are routed to Microsoft 365 Defender, compliance and data governance events—such as email forwarding or redirect rules—are managed exclusively through Microsoft Purview.
Open your web browser and log in to the Microsoft Purview compliance portal using your global administrator or compliance administrator credentials.
On the left-hand navigation menu, scroll down and click on 'Alerts' to open the centralized alerts dashboard.
Use the search bar or date filters to locate the specific Email and Collaboration alert for the forwarding or redirect rule that triggered your email notification.
Looking for a simpler, cost-effective office suite?
While managing enterprise security and compliance in Microsoft 365 portals can be complex, your daily document creation doesn't have to be. WPS Office is a lightweight, fully-featured alternative to Microsoft Office that is perfect for users who want straightforward productivity.
Frequently Asked Questions
Why does Microsoft separate Defender and Purview alerts?
Microsoft separates alerts by operational focus. Microsoft 365 Defender is designed for security operations and threat protection, whereas Microsoft Purview focuses on data governance, risk, and compliance management.
Can I make Purview compliance alerts appear in Defender?
Natively, certain compliance alerts like forwarding rules remain isolated in Purview by design. To view all alerts in a single pane of glass, organizations often utilize Microsoft Sentinel to ingest logs from both portals.
How do I turn off email notifications for forwarding rule alerts?
In the Microsoft Purview portal, go to 'Policies' then 'Alert policies'. Locate the specific policy for forwarding rules, edit the policy, and uncheck or modify the 'Send email notifications' setting.
