> ## Content Index
> Fetch the complete content index at: https://blog.lsonline.fr/llms.txt
> Use this file to discover other available public pages before exploring further.

# SharePoint site alert policy
- URL: https://blog.lsonline.fr/2019/01/24/sharepoint-site-alert-policy/
- Published: 2019-01-24T22:04:25.000Z
- Updated: 2026-01-27T18:10:57.000Z
- Description: If you have one or more user accounts with SharePoint administrator role and sensitive data stored in SharePoint, how can be notified if one of them try to access on them?
- Author: Laurent Sittler
- Tags: Security, Governance, SharePoint

In your Microsoft 365 environment, you need to create multiple accounts with the "SharePoint Administrator" role, but by doing so, you take the risk that these user accounts will gain access to "sensitive" data stored in SharePoint sites collections.

Currently, you can't prevent one or more of these user accounts to access specific SharePoint sites (that makes sense, they are SharePoint administrators) 😑

So, how to secure these specific SharePoint sites?

You can't?... not in the true sense of the word!

You can configure alert policies such as "added site collection admin" to be notified or all activities in relation to sharing, users, and group management of one of several SharePoint actions. You will be notified as soon as at least one SharePoint criterion is met.

Please find now below the steps how to implement this kind of policy on your Tenant:

### Set-Up

1. You have to be connected on your **Microsoft 365 Central Admin** as a *global admin*
2. Click on the **Security & Compliance** link from the left navigation of the central admin
3. From the left navigation, expand the **Alert** section by clicking on it, and click on **Alert Policy**
4. Click on the **New alert policy** button to launch the wizard and fill out the form

![](https://blog.lsonline.fr/content/images/2019/01/LsOnline-M365-NewAlertPolicyButton.jpg)

1. *Name your alert*  
  - **Name**: name of your policy (ex: SharePoint Administrator)
  - **Description**: it is recommended (ex: notify me for any change about site collection administrator for a specific site)
  - **Severity**: to help with tracking and managing the alerts generated by a policy ("Assigning a higher severity to activities that can result in severely negative consequences, such as detection of malware after delivery to users, viewing of sensitive or classified data, sharing data with external users, or other activities that can result in data loss or security threats").  
  Since in this case, the alert is created for security access, the severity will be `high`
  - **Category**: to help with tracking and managing the alerts generated by a policy.  
  Since in this case, the alert is created when permission was changed, the category will be `Permissions`

![](https://blog.lsonline.fr/content/images/2019/01/LsOnline-Alert-NameYourAlertScreen.jpg)

1. *Create alert settings*  
  - **Select an activity**: use a filter to find quickly the type of activity. In our case, we want to be alerted when a site collection admin is added, so, we choose `Added site collection admin`.  
> Important: if you site collection uses security groups rather than user accounts as site collection administrators, this kind of alert will does not work.

  - add a condition **Site collection URL is**: this alert can be concerned only for a specific site(s). Add a condition to specify which site collections will be concerned (separate site collection URL by a comma)
  - add a condition **User is**: this alert can be concerned only for a specific user(s). Add a condition to specify which user(s) will be concerned if necessary (you have to know in advance which user(s) and if this list of users has to be updated, you will have to edit this alert setting)

![](https://blog.lsonline.fr/content/images/2019/01/LsOnline-Alert-CreateAlertSettings.jpg)

1. *Set your recipients*  
  - **Email recipients**: specify which user has to be notified by email when an alert occurs (up to 500 recipients)

![](https://blog.lsonline.fr/content/images/2019/01/LsOnline-Alert-Recipients.jpg)

1. *Review your settings*  
  - Keep **Yes, turn it on right now** selected if everything is ok

![](https://blog.lsonline.fr/content/images/2019/01/LsOnline-Alert-FinishSetp-1.jpg)

### Test your alert

1. Connect to your Microsoft 365 **SharePoint admin center** with another SharePoint Administrator account
2. Select the targeted site collection(s) on which you have bound the alert
3. Change the site collection administrators

### Result

1. The recipients receive an email

![](https://blog.lsonline.fr/content/images/2019/01/LsOnline-MailAlert.jpg)

1. From the **Security & Service > Alerts > View Alert**, a new alert was added

![](https://blog.lsonline.fr/content/images/2019/01/LsOnline-AlertView.jpg)

1. From the **Security & Service > Alerts > Dashboard**, if you have added the *Recent Alerts widget*, the graph was updated with the latest alerts

> \[note\]**Note**  
>  
> You will find more details about severity, category, etc. on this [Microsoft Documentation](https://docs.microsoft.com/en-us/office365/securitycompliance/alert-policies?ref=blog.lsonline.fr)
  
  
Hoping this post will help you 🚀