Skip to content

Acknowledge a security alert

Record that you looked at a security alert in your tenant, such as a break-glass sign-in, so that it no longer counts as open.

Who can do it

A tenant administrator. Every built-in tenant role can read the alerts, but the console offers Acknowledge only to a person who holds the permission to acknowledge them.

Before you start

  • Sign in normally. A break-glass session cannot acknowledge an alert, not even the one it raised, and neither can a platform operator working inside your tenant through support access.
  • An alert stays open, whatever its age, until it is acknowledged. It is acknowledged once.

Steps

  1. Open Security Alerts from the sidebar, or select View all security alerts in the header bell.
  2. Under Status, keep Open to see the alerts that wait for you. Choose Acknowledged or All to see the others.
  3. Read the alert: what happened, the Identity it is about, when it Occurred and the Session it opened.
  4. Select Acknowledge on the alert.
  5. Optionally, write a Note (optional) of up to 1000 bytes. It is stored with the acknowledgment.
  6. Select Acknowledge in the dialog.

What you see when it worked

The console shows Alert acknowledged and the alert leaves the open list. Under Acknowledged it shows who acknowledged it, when, and your note. The alert and the audit record of the event stay as they were, and the acknowledgment is written to your audit log.

If it fails

What you see Cause What to do
"A break-glass session cannot acknowledge a security alert. Sign in normally to acknowledge it." You are signed in through emergency access Sign out and sign in normally, then acknowledge
"A platform-mediated session cannot acknowledge a security alert. A member of this tenant acknowledges it from their own session." The session is a support-access session A member of your tenant acknowledges it
The acknowledgment is refused as already done Someone acknowledged it first; the first acknowledgment is kept Nothing to do; read it under Acknowledged
The dialog does not let you confirm The note is longer than 1000 bytes Shorten the note
"This account cannot read security alerts." You do not hold the permission to read them Ask a tenant administrator

Without the console

Surface How
API GET /api/v3/admin/tenants/{tenantId}/security-alerts?status=OPEN (operation listTenantSecurityAlerts)
API POST /api/v3/admin/tenants/{tenantId}/security-alerts/{alertId}/acknowledgment, optionally with {"note": "..."} (operation acknowledgeTenantSecurityAlert)
  • Security Alerts: what the screen shows and every decision you make on it.