> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/alerts/enable-alert-notifications.md).
# Enable Alert Notifications
Every alert Augmentt detects is saved and visible in the Alerts feed regardless of your notification settings — enabling notifications just controls who gets told, how, and through which channel.
This page covers turning notifications on and choosing how they reach you. For what each alert umbrella covers and how often Augmentt actually scans for new alerts, see [How Alerts Work](/modules/secure/alerts/how-alerts-work.md) and the [Alerts section of the FAQ](/frequently-asked-questions.md#alerts).
You have three delivery channels, and you don't have to pick just one.
## What the icons mean
In the Alerts list, each company's **Notifications enabled** column shows an icon for each delivery channel, so you can tell what's active for that company at a glance, without opening Settings.
* :envelope: — **Email**
* :ticket: — **PSA**
* :share-nodes: — **Webhook**
A faded icon means that channel isn't configured for that company yet; once you enable a channel, its icon lights up.
## Severity and notification enablement are two different controls
It's easy to assume that an alert's **severity** (Informational, Low, Medium, High, Critical — set per alert type from **Secure > Alerts > Settings**) is what determines whether you're notified about it. It isn't. They're two independent settings that both happen to live under Alerts:
* **Severity** categorizes how serious an alert type is. It affects how alerts are labeled, filtered, and prioritized in the Alerts feed and in reports.
* **Notification enablement** (this page) controls whether an alert type pings you at all, and through which channel — regardless of its severity.
{% hint style="info" %}
Changing an alert type's severity does not turn its notifications on or off, and disabling notifications for an alert type doesn't remove it from the Alerts feed or from severity-based reporting — it only stops the email, ticket, or webhook. If you're trying to quiet an alert type, adjust it here, not in the Severity settings.
{% endhint %}
## Email
From the **Settings** tab, enable or disable each alert type individually and set a **Default Recipient** for the tenant. Higher thresholds mean fewer, more significant alerts; lower thresholds mean more coverage but more noise — tune this per client based on how closely they want to be watched.
To configure recipients across every client at once instead of one at a time, use **All Companies > Options > Edit recipient**.
**How often you'll hear from Augmentt by email.** Email notifications are digested, not sent one-for-one per event: you'll get a single email per day, per policy type, per client — not one email per alert. If five users lose their MFA requirement in the same posture check, that's one email listing all five, not five separate emails. This keeps a busy client's inbox usable even with a lot of daily churn. PSA tickets and webhook events, by contrast, are delivered per alert as each one is created — see below.
## PSA ticketing
Enable the ticket icon for a company from **Secure > Alerts > All Companies** to have qualifying alerts create a ticket directly in Autotask, ConnectWise, Syncro, or HaloPSA. This is a per-company setting, not global — turn it on for the clients where you want alerts to flow into your ticketing queue automatically. Unlike email, PSA tickets are created per alert as it happens, not digested.
For step-by-step instructions on connecting each PSA, see Setting Up Your PSA Integration.
## Webhook
Webhook delivery pushes every alert event to an HTTPS endpoint you control, as it happens, instead of waiting on Augmentt's own email or PSA formatting. It's the right channel when you want to:
* Feed alerts into a SIEM, SOAR, or security data lake alongside signals from your other tools.
* Route alerts into a ticketing or chat system that isn't one of the four PSAs Augmentt integrates with natively (for example, a custom internal queue, Jira, or a Teams/Slack channel via an automation platform like Zapier or Power Automate).
* Build your own alert logic on top of Augmentt's detections — custom routing rules, deduplication, enrichment, or dashboards that the built-in email and PSA options don't support.
{% hint style="warning" %}
Webhook delivery isn't self-service. Contact Augmentt support to request it — it uses header-based authentication that has to be configured on our end, and this typically takes **7 or more business days** to process. Plan ahead if you're building a launch or migration around it.
{% endhint %}
Once support has enabled it for your account, turn it on per tenant from the webhook icon in the **All Companies** or **Companies** tab.
{% hint style="info" %}
The webhook icon doesn't show up in the **Notifications enabled** column at all until Augmentt support has enabled webhook delivery for your account — it's not just faded, it isn't there yet. Once support turns it on, it'll appear alongside the email and PSA icons.
{% endhint %}
Each webhook event looks like this:
```json
{
"resource": "alert",
"eventType": "alert_created",
"organizationId": "...",
"customerId": "...",
"integrationContext": {
"parentTenantId": "...",
"tenantId": "..."
},
"alert": {
"customer": "...",
"alert_type": "office365_test_alerttype1",
"title": "...",
"description": "...",
"severity": "medium",
"id": "...",
"eventDateTime": "...",
"userStates": [{"aadUserId": "..."}],
"targetUserStates": [{"id": "..."}],
"alertType": "...",
"eventSettings": {},
"user_name": "...",
"target_user_name": "..."
}
}
```
## Alert filtering: alerts from ignored users
Also on the **Settings** tab, the **Alert filtering** section has a single toggle: **Include alerts from ignored users**.
Ignored users aren't managed in the app — they don't consume a license slot and won't show up in most of Augmentt's UI — but their Microsoft 365 activity can still be risky (a suspicious sign-in on a stale service account, for example). By default this toggle is **on**, so you still get security alerts for ignored users' activity even though you're not actively managing them. Turn it **off** to discard alerts from ignored users entirely, if you'd rather not hear about accounts you've deliberately excluded from management.
{% hint style="info" %}
This is a **per-tenant** setting, configured the same way as the rest of this page — there's no global switch that applies it across every client at once. Set it individually for each company from the **Settings** tab.
{% endhint %}
## Snoozing or muting a notification
Already aware of a specific alert and don't need to keep hearing about it? See [Snoozing and muting alerts](/modules/secure/alerts/how-alerts-work.md#snoozing-and-muting-alerts) on the How Alerts Work page — snoozing quiets the notification without disabling the alert type or losing it from the Alerts feed.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://helpdesk.augmentt.com/modules/secure/alerts/enable-alert-notifications.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.