Configure channels, administrator recipients, owner routing, and expiry thresholds for Microsoft Entra app credential alerts in Organization Settings. You can also edit the alert email template and, when available for your organization, send a test notification to saved administrator recipients.
Before you start
Open Organization Settings. Only AppAlert organization owners can change these settings; other members have read-only access. A Microsoft administrator role alone does not grant this AppAlert access.
The Notifications section contains channels, recipients, and thresholds. Email template contains template editing and, when available for your organization, the test-send control. On mobile, use Settings section to switch between them. Save each edited card with its own save button.
Choose notification channels
Under Notification Channels, set Email Notifications for credential alerts and Weekly Digest for the digest, then choose Save Channels. Also review the recipient and threshold cards. Enabling a channel alone does not set a usable recipient or make every credential eligible for an alert.
Set administrator recipients
In Admin Recipients, enter the notification addresses under Admin notification emails, then choose Save Recipients. Use addresses monitored by people who coordinate renewals. Email Notifications must also be enabled under Notification Channels; saved recipients alone do not enable delivery. These recipients provide the fallback when direct owner routing cannot find usable owner addresses.
AppAlert stores recipient addresses and notification records as described in Data handling.
Route alerts to application owners
In Routing Preferences, Notify application owners directly controls direct owner notifications. When enabled, usable owner addresses from the synced inventory receive owner notifications; credentials without usable owner addresses fall back to configured admin recipients. An alert run also falls back to administrators when every owner recipient is suppressed or permanently rejected. Temporary delivery failures retry. A bounce reported after provider acceptance affects later eligible alerts rather than triggering an immediate fallback. Bcc admin recipients on owner notifications controls whether administrators receive a copy of owner notifications. Choose Save Recipients to apply these choices. Owner and administrator delivery still require Email Notifications under Notification Channels.
Owner routing is an organization policy. It does not require a separate owner opt-in inside AppAlert. Check the owner records in Microsoft Entra and your organization's communication policy before enabling it.
Owner routing readiness previews routing with owner notifications enabled and the saved administrator/Bcc settings. It does not switch on owner notifications. Counts cover active, unexpired credentials and count an address once per credential; they can differ from the urgent Operations queue. A missing or stale sync warning means you should check the inventory before relying on the preview.
Choose notification thresholds
Under Notification Thresholds, select the days-before-expiry values for each credential type and choose Save Thresholds. At least one threshold must remain selected across the configuration. These settings determine alert eligibility; they do not change the fixed urgency groups in the Operations queue.
Edit the email template
Open Email template. Edit Subject line, Intro paragraph, Action paragraph, and Footer paragraph in Credential alert template. Blank fields use AppAlert's default copy. Use the Supported tokens list shown in the editor; body-only tokens cannot go in the subject. HTML fields accept only the listed email-safe tags and HTTPS links.
The existing catalog_guidance_block token inserts the renewal guidance block in an HTML field. If you omit it, AppAlert appends the relevant renewal guide after the action section. The token name remains unchanged for compatibility.
Check Preview subject and Preview body, then choose Save Template. Previewing a draft does not save it or send an email.
Send a test notification
If Test notification is available, save the template and administrator recipients first. Choose Send test notification to send the saved template to every configured admin recipient through the production email provider. The message uses synthetic organization, application, credential, owner, and expiry data.
You can send one test per 10-minute clock window. A test checks the saved template and administrator delivery path. It does not verify that a real credential meets a threshold or that owner routing will select a particular owner. If the control is unavailable, it may not be enabled for your organization or your access level.
Confirm the result
After saving, verify the saved values and review Notification Audit when an attempt is recorded. If an expected email is missing, follow Missing notifications. Help links in the app open a new tab so you can read guidance without leaving unsaved settings.