Microsoft 365 Alert Routing

Customer tenant setup & notification configuration

INTERLINKED / OPERATIONS GUIDE

Purpose and Scope

This process centralises configured Microsoft 365 alerts in a single mailbox within the customer’s tenant, ensuring alert tickets are raised under the correct customer in Autotask rather than the default “Interlinked” account.

Replace customerdomain.com throughout with the customer’s actual domain. Click any heading to expand its instructions. Navigation paths remain visible while individual sections are collapsed.

Enter the customer’s domain to update the example addresses throughout this guide. This only changes the guide, not tenant settings.

0 sections complete

Progress is saved in this browser only, not shared between users or devices. Reset before starting a different customer.

1. Create the Interlinked Support Guest AccountMicrosoft Entra admin center → Entra ID → Users → New user → Invite external user
  1. Check for an existing guest account before creating a duplicate.
  2. Invite an external user with:
    • Email:
    • Display name: Interlinked Support
    • Company name: Interlinked
    • Usage location: Australia
  3. Select Review + invite, check the details, then Invite. Confirm the account appears as a Guest.

Do not assign administrator roles as part of this step.

2. Create the Customer Tenant Alerts Shared MailboxMicrosoft 365 admin center → Teams & groups → Shared mailboxes
  1. Use an account with the Exchange Administrator role. Check for an existing mailbox before creating a duplicate.
  2. Select Add a shared mailbox:
    • Name: Tenant Alerts
    • Email: tenant.alerts
    • Domain: Customer’s domain
  3. Save and confirm the address is .

Replace customerdomain.com with the customer’s actual domain. Keep direct sign-in blocked for the shared mailbox account.

3. Create the Tenant Alerts Contact in AutotaskAutotask → CRM → Contacts
  1. Check for an existing contact matching . Reuse a matching contact rather than creating a duplicate.
  2. Create under the correct customer organisation:
    • First name: Tenant
    • Last name: Alerts
    • Email:
  3. Exclude the contact from ALL notifications.
  4. Save and confirm the customer organisation and email address.

Use the customer’s Tenant Alerts address, not .

4. Configure the Mailbox Forwarding RuleOutlook on the web → Open another mailbox → Tenant Alerts → Settings → Mail → Rules

This rule forwards all incoming messages to . Confirm you are configuring the customer’s Tenant Alerts mailbox, not your own.

  1. Sign in using a customer-tenant account with Full Access to the shared mailbox. From your profile, select Open another mailbox and open .
  2. In the shared mailbox’s rules, add:
    • Name: Forward to Interlinked Support
    • Condition: Apply to all messages
    • Action: Forward to
    • Recipient:
  3. Save and confirm the rule is enabled.

Forwarded messages appear to come from Tenant Alerts rather than the original sender. Keep direct sign-in blocked. Complete the external-forwarding configuration before testing delivery.

5. Allow External Forwarding for the Tenant Alerts MailboxMicrosoft Defender → Email & collaboration → Policies & rules → Threat policies → Anti-spam policies

Allow external forwarding only for Tenant Alerts. Do not enable it tenant-wide or change the default policy to allow forwarding for all users.

  1. Check for an existing suitable custom outbound policy.
  2. If one exists: Edit users, groups, and domains. Add under Users without removing existing users. Confirm Automatic forwarding is On - Forwarding is enabled.
  3. If none exists: Create policy → Outbound. Name it Allow Automatic Forwarding - Tenant Alerts. Include only under Users. Set Automatic forwarding rules to On - Forwarding is enabled. Review the remaining protection settings and create the policy.
  4. Confirm the policy is enabled and takes priority over other outbound policies matching Tenant Alerts.
  5. Send a test message and confirm forwarding to .

If forwarding remains blocked, check Exchange remote-domain settings and mail flow rules for additional restrictions.

6. Configure Microsoft 365 Alert RecipientsUpdate existing notification recipients after mailbox forwarding has been tested.
  1. Confirm Tenant Alerts exists and forwarding has been tested.
  2. For each editable notification recipient list:
    • Add .
    • Remove if listed.
    • Keep all other recipients and settings unchanged.
  3. Save and test where available. Confirm delivery to Tenant Alerts, forwarding to Interlinked Support, and a ticket under the correct customer in Autotask.

For the alert configurations below, do not create missing policies or rules. Leave disabled notifications disabled. The mailbox-specific outbound forwarding policy in section 5 is a separate setup step.

For notifications tied to reviewers or administrator accounts, record for follow-up rather than removing the reviewer or administrator.

6.1. Microsoft Defender
6.1.1 Defender XDR Incident NotificationsDefender → Settings → Microsoft Defender XDR → General → Email notifications → Incidents
  1. Review existing rules/policies. If none exist, skip this section. Do not create a new rule or policy.
  2. Open each existing configuration: Edit rule → Recipients. Where an editable recipient list is available:
    • Add .
    • Remove if listed.
    • Keep all other recipients and settings unchanged.
  3. Select Send test email and confirm delivery to Tenant Alerts and forwarding to Interlinked Support. Review and save the changes. Reopen and confirm the recipient list. Repeat for remaining existing configurations.

Do not change severity, sources, device scope, or notification frequency.

6.1.2 Defender Response Action NotificationsDefender → Settings → Microsoft Defender XDR → General → Email notifications → Actions
  1. Review existing rules/policies. If none exist, skip this section. Do not create a new rule or policy.
  2. Open each existing configuration: Edit → Recipients. Where an editable recipient list is available:
    • Add .
    • Remove if listed.
    • Keep all other recipients and settings unchanged.
  3. Select Send test email and confirm delivery to Tenant Alerts and forwarding to Interlinked Support. Review and save the changes. Reopen and confirm the recipient list. Repeat for remaining existing configurations.

Do not change action sources, selected actions, device group scope, action statuses, or enabled state.

6.1.3 Defender for Endpoint Alert NotificationsDefender → Settings → Endpoints → General → Email notifications
  1. Review existing rules/policies. If none exist, skip this section. Do not create a new rule or policy.
  2. Open each existing configuration: Recipient tab. Where an editable recipient list is available:
    • Add .
    • Remove if listed.
    • Keep all other recipients and settings unchanged.
  3. Select Send test email and confirm delivery to Tenant Alerts and forwarding to Interlinked Support. Review and save the changes. Reopen and confirm the recipient list. Repeat for remaining existing configurations.

Do not change alert severities, device group scope, organisation name, tenant-specific link, or device information settings.

6.1.4 Defender Vulnerability NotificationsDefender → Settings → Endpoints → General → Email notifications → Vulnerabilities
  1. Review existing rules/policies. If none exist, skip this section. Do not create a new rule or policy.
  2. Open each existing configuration: Edit rule → Recipients. Where an editable recipient list is available:
    • Add .
    • Remove if listed.
    • Keep all other recipients and settings unchanged.
  3. Review and save the changes. Reopen and confirm the recipient list. Repeat for remaining existing configurations.

Do not change vulnerability events, severity threshold, device group scope, organisation name, or enabled state.

6.1.5 Defender Alert PoliciesDefender → Email & collaboration → Policies & rules → Alert policy
  1. Review existing rules/policies. If none exist, skip this section. Do not create a new rule or policy.
  2. Open each existing configuration: Edit email notification recipients. Where an editable recipient list is available:
    • Add .
    • Remove if listed.
    • Keep all other recipients and settings unchanged.
  3. Review and save the changes. Reopen and confirm the recipient list. Repeat for remaining existing configurations.

Do not change policy conditions, severity, thresholds, daily notification limits, email notification settings, or enabled state.

6.1.6 Defender for Cloud Apps NotificationsDefender → Cloud Apps → Policies → Policy management
  1. Review existing rules/policies. If none exist, skip this section. Do not create a new rule or policy. If Cloud Apps is unavailable, skip this section.
  2. Open each existing configuration: Edit policy → Alerts. Where an editable recipient list is available:
    • Add .
    • Remove if listed.
    • Keep all other recipients and settings unchanged.
  3. Review and save the changes. Reopen and confirm the recipient list. Repeat for remaining existing configurations.

Do not change policy conditions, actions, severity, alert limits, notification settings, or enabled state.

Personal administrator notifications: Settings → Cloud Apps → My account → My email notifications sends to the signed-in administrator’s email alias. Do not change the administrator account or assign roles solely to redirect these notifications. Record for follow-up.

6.1.7 Email User Reported SettingsDefender → Settings → Email & collaboration → Email user reported settings
  1. Check the existing reporting configuration. If reporting is disabled or Microsoft-only, leave unchanged and skip.
  2. Under Add an Exchange Online mailbox to send reported messages to, replace the existing mailbox selection with .
  3. Keep Send reported items to and all other settings unchanged.
  4. Save, reopen, and confirm the selected mailbox.

Do not enable reporting or change reporting policies. If the mailbox field is unavailable, record for follow-up rather than changing the reporting destination.

6.1.8 Teams User Reported SettingsDefender → Settings → Email & collaboration → Teams user reported settings
  1. Check the existing reporting configuration. If reporting is disabled or Microsoft-only, leave unchanged and skip.
  2. Under Add an Exchange Online mailbox to send reported items to, replace the existing mailbox selection with .
  3. Keep Send reported items to and all other settings unchanged.
  4. Save, reopen, and confirm the selected mailbox.

Do not enable reporting or change reporting policies. If the mailbox field is unavailable, record for follow-up rather than changing the reporting destination.

6.2. Microsoft Entra
6.2.1 Entra ID Protection Risk Alerts and Weekly DigestEntra → ID Protection → Dashboard → Users at risk detected alerts / Weekly digest
  1. If settings are unavailable, record and skip.
  2. For risk alerts, add under Add custom email here. Remove or deselect if listed. Keep other recipients and the risk threshold unchanged. Save.
  3. Review Weekly digest separately. If Send weekly digest emails is No, leave disabled.
  4. Do not assume the risk-alert custom email also receives the digest. If Tenant Alerts cannot be selected, record for follow-up and retain existing recipients.

Do not assign administrator roles or change administrator email addresses solely to receive notifications.

6.2.2 Entra Connect Health NotificationsEntra Connect Health → Sync errors → Notification settings
  1. If the customer does not use Connect Health, skip.
  2. If Get email notification for alerts is No, leave disabled and skip.
  3. Under Custom notification emails:
    • Add .
    • Remove if listed.
    • Keep all other recipients and settings unchanged.
  4. Leave All global administrators unchanged.
  5. Save, reopen, and confirm recipients.

If Interlinked Support receives notifications through All global administrators rather than the custom list, record for follow-up. Do not change roles or account email addresses.

6.2.3 Admin Consent Request NotificationsEntra → Entra ID → Enterprise apps → Consent and permissions → Admin consent settings
  1. If Users can request admin consent to apps they are unable to consent to is No, skip. Do not enable the workflow.
  2. Review Who can review admin consent requests and Selected users will receive email notifications for requests.
  3. Record whether Interlinked Support is an existing reviewer. Keep reviewers, notifications, reminders, and request expiry unchanged.

Requires follow-up: There is no standalone notification address to replace here. Do not remove Interlinked Support or add Tenant Alerts as a reviewer solely to redirect notifications. Record in the onboarding checklist.

6.2.4 Access Review NotificationsEntra → ID Governance → Access Reviews
  1. If no access reviews exist, skip. Do not create a review.
  2. Inspect each existing review’s reviewers, email notifications, and reminders. For recurring reviews, check both Current and Series.
  3. Record whether is a reviewer. Keep all reviewers and settings unchanged. Record Interlinked Support notification delivery as Requires follow-up.

Do not replace reviewers with Tenant Alerts solely to redirect notifications. Do not change scope, schedules, reminders, or automatic access-removal settings.

6.3. Microsoft Purview
6.3.1 Microsoft Purview DLP NotificationsPurview → Solutions → Data loss prevention → Policies → Edit policy → Rules → Incident reports
  1. If no DLP policies exist, skip. Do not create a policy.
  2. Edit each existing policy and its existing rules. Review Incident reports.
  3. Where administrator alert emails or email incident reports are already enabled, update recipients:
    • Add .
    • Remove if listed.
    • Keep all other recipients and settings unchanged.
  4. If email notifications are disabled, leave disabled.
  5. Save the rule, complete the policy review, and save the policy. Keep the existing policy mode unchanged. Reopen and confirm. Repeat for remaining policies and rules.

Do not change conditions, actions, severity, thresholds, notification content, user notifications, policy tips, or enabled/simulation state.

Microsoft Intune — NOT IN USE YET
Intune Device Compliance Notifications — NOT IN USE YETIntune → Devices → Compliance → Policy → Properties → Actions for noncompliance → Edit

TO BE ADDED AFTER REVIEW. Not part of the active procedure.

  1. If no compliance policies exist, skip. Do not create a policy.
  2. Review existing Send email to end user actions. If no email action exists, leave unchanged.
  3. Review Additional recipients groups. Record selected groups and whether Interlinked Support receives notifications through them. Keep unchanged and record any Tenant Alerts replacement as Requires follow-up.

Additional recipients are selected through Entra groups, not by entering Tenant Alerts directly. Do not change shared group membership solely to redirect notifications without reviewing other policy and access impacts.

Keep end-user notifications, templates, schedules, assignments, and all other noncompliance actions unchanged. Do not add actions.