The alerts center

01In a nutshell #sec_222852fd

The Alerts Center transforms a stream of technical events into a list of prioritized problems, each with its consequence, age, scope and the page where to fix it.

02The problem #sec_b1cabfb7

A recertification platform produces signals permanently: a tenant that no longer responds, an element that the scope does not cover, a reviewer who has never opened his queue. Taken one by one, these signals are accurate. Stacked in a chronological list, they become unreadable.

The flaw is not the volume — it is the repetition. The same incident verified every hour produces one line per verification. After a week, a single problem occupies one hundred and sixty lines, and a really new problem drowns in it. The screen ends up measuring the frequency of checks, not the state of the system.

There is also a question that no one decides: when does an alert disappear? If the closure is manual, the list swells with problems that have long been resolved that no one has thought to check. If nothing closes, it just swells. In both cases the administrator stops consulting it — and it is the day when it should have been read.

03The approach #sec_1a0237d5

An alerts screen has only one job: to say what needs to be done now.

Three principles follow from this.

1. We list problems, not events. The occurrences of the same incident are grouped into a single line, identified by what really characterizes it: its family, its subject and the campaign concerned. One hundred and sixty lines become one problem again.

2. Repetition is data, not noise. Once grouped, the frequency becomes useful information: “since 12 days • 4 occurrences • last one 58 min ago”. An incident that is twelve days old and is re-raised every time does not say the same thing as an incident that appeared yesterday. The line shows it without having to count.

3. A resolved problem removes itself. There is no “mark as resolved” button. The system knows when it last checked; if a problem has not been re-raised since, it no longer exists. It switches to the Resolved tab on its own. No one can make a problem disappear by checking it — and no one has to do the cleaning.

04How it works #sec_d80e1494

The severity blocks

Problems are arranged in three blocks, and each header says what to think about it rather than just a word:

Inside a block, the sort is by age: the oldest first. A critical problem that has been dragging on for twelve days comes before yesterday’s — it is the one that has already cost something.

What a line carries

Each line answers four questions in the order in which they are asked:

• What — the problem stated by its consequence ( “Campaign delayed” ), with its probable cause below ( “The deadline has passed and some requests remain undecided” ).
• Where — the typed scope: the campaign concerned, the request, or the workspace. When the subject is a technical identifier, a Copy button avoids having to retype it by hand.
• Since when — the age of the problem and the pace of its repetition.
• How to fix it — a link to the page where the action is taken.

Freshness, displayed permanently

A banner indicates “Checked 1 hour ago”, at the top of the screen as at the bottom. We therefore always know the age of what we are looking at — and, if no check has ever taken place, the screen says so instead of displaying a reassuring empty list.

The empty state, which is not just a dash

When there is nothing to report, the screen lists what has been checked, with the actual numbers: “2 campaigns and 9 requests have been checked on this workspace, without reporting anything.” An absence of problems is only valuable if we know what it applies to.

05The catalog of families #sec_c4cd7825

What the workspace administrator can correct

What falls under the subscription

Three families escape the workspace: interrupted tenant connection, unusable application registration, security group not found. Neither the tenant, nor the application registration, nor the directory are controlled from a workspace.

They remain displayed — they explain an empty collection or an incomplete scope, and an administrator needs this explanation. But the line bears the mention Subscription instead of a Fix link: redirecting to a page where nothing can be done would be worse than offering nothing.

06Filter and search #sec_fd23e8b3

Two filters, no more: category and campaign. Each active filter is displayed as a chip, removable with a click — so you always see what you don’t see.

The free search is on the problem title, its subject and the campaign name.

The two tabs Active Problems and Resolved carry their counter. The active counter is red when it is not zero: it is the only alarm color on the screen, and it remains subdued.

07What the auditor finds there #sec_b42c1894

The screen is opened to them in read mode. They read what a compliance report never says: the incidents that accompanied a campaign. An element excluded from the scope, a reviewer who has not decided anything, an escalation without a recipient — all facts that qualify the probative value of a certification rate.

Here, age is the decisive information: a critical problem opened twelve days ago during an active campaign is a finding in itself.

08Proper use #sec_f88e69d6

What the Alert Center is made for: starting your administration day on it, handling the critical block before the rest, and using age as an arbiter between two apparent emergencies.

What it is not made for: serving as an activity log — that is the role of the audit trail, which records human actions and not machine findings. Nor a progress dashboard: that is the role of the Steering.

09To remember #sec_997300c6

The Alert Center does not signal more, it signals better. By grouping occurrences, dating problems, naming their consequence rather than their symptom and attaching each to an action, it transforms a list that no one reads into a work queue that can be emptied.

And because a problem closes itself as soon as it ceases to exist, the list remains credible over time — a condition without which no alert screen is consulted for more than three weeks.

10Feature status #sec_3a5f205b

The screen, the problem model and the catalog of families are delivered. The detection of the seven families introduced in v1.0 (delayed campaign, reviewer without activity, expired delegation, exclusion to be re-examined, pending deletion request, escalation without recipient, missing email template) remains to be written on the verification jobs side: no producer raises them automatically yet.