Microsoft 365 Admin Center Informational alerting rule

Microsoft.SystemCenter.M365.Rules.MessageCenterAlertingRule.Info (Rule)

When this rule receives an Admin Center message of "stayInformed" category, it generates or updates a corresponding Informational Alert in the Operations Manager.

Knowledge Base article:

Summary

The rule calls Microsoft 365 Management API to get the list of Messages for the Subscription from the Admin Center.

Then, the rule generates an Informational Alert in the Operations Manager targeted to the Subscription for each Message.

The Messages are suppressed by means of a unique ID. If the Message data provided by the API changes, the rule updates the Alert payload and the context accordingly.

See the list of Messages in Microsoft 365 Admin Center

Causes

An error state is caused by having issues with connecting to Microsoft 365 API EndPoint. It can be caused by the following:

Issues with global connection to Microsoft 365 API EndPoint.
Credentials for Microsoft 365 Subscriptions account are not correct.
Microsoft 365 Subscriptions account is not allowed to get data from Microsoft 365 EndPoint API.

Resolutions

Resolution depends on the specific error. Verify and/or fix the following:

Connectivity to Microsoft 365 API, including firewall and proxy settings.
Credentials for Microsoft 365 subscription may need to be changed or updated.
Update permissions for the Microsoft 365 API subscription.

Element properties:

Target

Microsoft.SystemCenter.M365.Subscription

Category

Alert

Enabled

False

Alert Generate

True

Alert Severity

Information

Alert Priority

Normal

Remotable

True

Alert Message

Admin Center

{1} {0}

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.SystemCenter.M365.DataSource.MessageAlerts	Default
Detection	ConditionDetection	System.ExpressionFilter	Default
Alert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Microsoft.SystemCenter.M365.Rules.MessageCenterAlertingRule.Info" Enabled="false" Target="Microsoft.SystemCenter.M365.Subscription" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Alert</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Microsoft.SystemCenter.M365.DataSource.MessageAlerts">

      <TimeoutSeconds>300</TimeoutSeconds>

      <IntervalSeconds>900</IntervalSeconds>

      <SyncTime/>

      <SubscriptionId>$Target/Property[Type="Microsoft.SystemCenter.M365.Subscription"]/SubscriptionId$</SubscriptionId>

      <AuthorityUrl>$Target/Property[Type="Microsoft.SystemCenter.M365.Subscription"]/AuthorityUri$</AuthorityUrl>

      <MicrosoftGraphUrl>$Target/Property[Type="Microsoft.SystemCenter.M365.Subscription"]/ManagementServiceUri$</MicrosoftGraphUrl>

      <TenantId>$Target/Property[Type="Microsoft.SystemCenter.M365.Subscription"]/TenantId$</TenantId>

    </DataSource>

  </DataSources>

  <ConditionDetection ID="Detection" TypeID="System!System.ExpressionFilter">

    <Expression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">Property[@Name='EventType']</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Message</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">Property[@Name='Category']</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">stayInformed</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </Expression>

  </ConditionDetection>

  <WriteActions>

    <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>0</Severity>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="Microsoft.SystemCenter.M365.MessageCenter.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/Property[@Name='Description']$</AlertParameter1>

        <AlertParameter2>$Data/Property[@Name='IncidentId']$</AlertParameter2>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/Property[@Name='IncidentId']$</SuppressionValue>

      </Suppression>

      <Custom1>$Data/Property[@Name='EventType']$</Custom1>

      <Custom3>$Data/Property[@Name='IncidentStatus']$</Custom3>

      <Custom4>$Data/Property[@Name='IncidentId']$</Custom4>

      <Custom5>$Data/Property[@Name='Title']$</Custom5>

      <Custom9>$Data/Property[@Name='Additional Information']$</Custom9>

    </WriteAction>

  </WriteActions>

</Rule>