PIM Manager settings · Settings > Mail & alerting

Alert on these events

Key	Alerting.Events
Where	Settings > Mail & alerting > Alerting
Type	Map (one value per item)
Default	All events on
Confirmation	PIM Manager asks you to confirm before it is switched off.

What it does

Which situations send an alert. Run failure: a scheduled run failed or a safety breaker held it (re-mailed at most daily). Drift: the tenant differs from the desired state (default every two weeks). Expiring access: access ending within 14 days or lifecycle dates due within 30 days. Break-glass: an emergency override was activated. Coverage: new gaps, orphan or unmanaged privileged groups, ownerless departments, unanswered reviews. Target missing: a delegation's Azure resource or role is gone (daily). Pending: changes staged over a day ago and never committed (daily).

When set

When an event is on: its alert is mailed to the alert recipients and posted to the webhook, and recorded in Recent alerts. The PIM Manager applies a change at once; scheduled jobs on their next run. Run-failure alerts wait 45 minutes after a commit while it rolls out. A further event, sessions-revoked (a sign-in session revoke was queued), is listed by its raw name.

When blank or default

When an event is off: that alert is not mailed or posted. The underlying pages (Drift, Coverage, Jobs, Pending changes) still show the findings.

Risk and how to reverse it

Turning off engine failure or break-glass hides failed runs and emergency access from the people who should react. Safety-breaker mails (removal budget, disable abort, policy mass change) are sent to the recipients regardless of these switches. Reversible: switch the event back on; alerts skipped meanwhile are not re-sent.

Requires

Admin role in PIM Manager. Alert recipients or a webhook, and working mail sending. The drift report cadence is a separate SuperAdmin setting on the same card.