Email alerts for Conditional Access changes

What can I inspect in the native tools?

Use the Entra audit record to investigate policy administration and the sign-in logs to inspect policy impact. They answer different questions: a policy edit is not itself a sign-in failure. Establish the time and object involved before assuming that a reported access problem came from the latest policy change.

This procedure delivers selected administrative changes by email. It does not enforce a recovery action or automatically roll the policy back. Keep a verified Conditional Access backup and use the dedicated recovery procedure if an administrator decides that restoration is appropriate.

How do I enable email alerts for Conditional Access changes?

1. Select the tenant in TenuVault and open Alerts. Add an Email destination under Channels. Start with a small approved recipient list rather than a broad distribution to everyone who might be interested. Notifications are a Pro feature.

2. Follow the permissions documentation to enable email sending and Conditional Access audit reading on the existing app registration. Email needs Mail.Send; Conditional Access watching needs AuditLog.Read.All and an administrator role allowed to read audit logs. Sign in again after permission changes as documented.

3. Add an alert from the Conditional Access changes template and select the email channel. Enable Conditional Access on Change watching, review the shared polling interval and confirm that the alert row does not report Not sending changes.

Which changes and recipients should I choose?

Conditional Access watching covers policy, named-location and authentication-strength changes. Authentication-strength audit events do not name the strength, so those messages use a generic label. Failed attempts are excluded. A deletion digest has warning severity, while less severe updates need a suitably low minimum severity to pass the alert.

Email-address recipients can include distribution lists and Microsoft 365 group addresses. Exchange handles their expansion, and Microsoft 365 group delivery depends on members subscribing to group mail. An Entra group chosen by object ID resolves up to 200 non-guest members and needs the additional group-reading permissions described in the docs.

How do I keep useful changes from being filtered out?

Start with the service and change types you actually need. Policy-name filters narrow the result further, and Exact name stops matching after a rename. Changed settings contain is useful for specific updates, but creates and deletes do not name settings and therefore never pass that filter.

Actors are off by default because names are personal data. Enable them only for destinations your organization permits. Changed policy values are compared only to identify setting names and are not retained or emailed in change alerts. A message can show names such as conditions.users.excludeGroups without exposing the saved value.

How can I try this on my tenant?

Download TenuVault, use Check the last 7 days to review the alert selection, and send a test to an approved mailbox. Verify the actual recipient delivery, then inspect Deliveries for failures or retries. Missing email permission fails the email delivery while other configured channels can continue working.

For a live check, make an approved harmless edit to a non-production policy and observe a subsequent poll. Record the event and receipt times. Keep the app running and signed in for desktop checks. If you require off-computer coverage, configure the Azure watcher with Conditional Access enabled and complete its separate email setup before handing ownership over.

• Change alert delivery options
• Back up Conditional Access policies
• Investigate policy changes
• Download TenuVault