Notifying Administrators When a Policy Matches

Set a policy to raise a notification in the console each time it matches a request.

Select Notify when you want to know that a policy is being hit. It is useful on a new deny policy, where you want to confirm what it is catching before you rely on it, and on an allow policy that covers a sensitive tool.

Notify is independent of the action. You can select it alongside Allow and alongside Deny.

Steps

Open the Add Policy panel.
Expand Action.
Select Allow or Deny.
Select Notify.

Note: Selecting Notify does not change whether the request is allowed or denied. It only records the match and raises a notification.
Save the policy.

Result

Each time the policy matches a request, a notification is raised for all administrators of your tenant and the request is written to the transaction log with notify=true in the Action Params field.

Next steps

Notifications appear under the bell icon in the console. To have notified activity sent to an inbox instead, build a filtered transaction view in Insights and attach it to a scheduled report, see Creating a Filtered View of Notified Transactions and Scheduling an Email Report of Notified Transactions.