What security alerts show in the client portal
See what your IT provider caught and handled for you, read in plain words what happened and what they did about it, and, if your company runs its own IT, confirm or deny an unusual sign-in when you are asked.
Overview and History
Security has two tabs. Overview shows how each layer of your protection is doing and your most recent handled events. History lists every security event your provider has handled for you, newest first.
Recent security activity
The newest handled events, each with the date it was resolved. Click one to open it. Until Microsoft 365 is connected for your company, this card says it is waiting on permissions instead, and a banner above offers to start the connection or copy the link for whoever holds the Global Admin role.
Browse
On this page
Why it works this way: What security alerts show in the client portal
Overview is built in layers. The Microsoft 365 layer shows your Secure Score, whether sign-in monitoring is active, how many threats have been handled, a coverage breakdown by area and recommended improvements. The Endpoint Protection layer shows how many computers are protected, how many are in secure mode, how much was blocked this week and when each last checked in. It never shows an all-clear while monitoring is down. If monitoring stops, a banner says so.
Open any event to read it as four short parts. The top shows the event's name, one of three states (Handled, Being handled or Needs your attention) and when it was found. What happened says in one sentence what was flagged, and names the account when it is known. What we did says the step taken, such as "We locked the account so nobody else could use it" or "We signed the account out everywhere", or that your provider is looking at it now. What you should do says whether anything is needed from you, and most of the time the answer is nothing right now.
One button, Contact followed by your IT provider's name, opens a new support request with this event already named in it, so you never have to look up a reference. If a ticket was opened for the event, its number is shown as a link.
If your company runs its own IT and your provider has set the account up as co-managed, the bottom of the page is different. Instead of What we did and What you should do, it asks "Was this you?" with two buttons, "This was me, dismiss" and "Acknowledge, we're handling it". Under "Need help?" there is an Escalate button that opens a ticket with your provider for that alert and takes you to a support message about it. Each press is recorded on the event. When you are the company's own IT staff or owner on a co-managed account, you see a fuller read-only Security page with a Response Rules tab in place of History.
Only the account Owner, Primary Contact and IT Admin roles see Security. The User and Billing roles do not.
Questions this page answers
What does this alert page show?
It is one page for one security event we saw on your systems. The top line names the event and shows where it stands: Handled, Being handled, or Needs your attention. Under that you get three short parts. What happened tells you what we saw. What we did tells you the step we took. What you should do tells you if we need anything from you, and most of the time the answer is nothing. The button at the bottom opens a support message with this alert already named in it, so you do not have to look up a code.
What do the buttons on a security alert do?
You see these buttons if your team runs IT with us. Was this you? has two buttons. Press "This was me, dismiss" when the activity was yours or your team's. We then close the alert. Press "Acknowledge, we're handling it" when your team is taking it from here. We then mark it as being handled. Under Need help? the Escalate button opens a ticket with your IT provider for this alert and tells them you want them on it. It then takes you to a support message with this alert already named, so you can say what you need. Every button you press is written into the alert record your IT provider reads.
Was this helpful?