AlertControl for the security officer: monitoring Microsoft 365
As a security officer, CISO or ISO lead you want to show that you recognise and follow up suspicious activity. AlertControl for Microsoft 365 puts all security events from Microsoft 365 on one timeline, with a severity per event, the Secure Score with recommendations and AI advice with priorities. It supports you with ISO 27001, NEN 7510 and NIS2, but does not make you compliant.
Updated 2 November 2026
Logging and monitoring
ISO 27001 requires in its logging and monitoring controls (8.15 and 8.16) that you record events and monitor for anomalous behaviour. Microsoft 365 records a lot, but spread across several portals. AlertControl brings those logs together and makes anomalies visible, so monitoring becomes a fixed, demonstrable routine.
Prioritising
Not every event is equally important. AlertControl gives every event a severity and filters on medium and higher by default. Sign-ins from abroad, repeated failed sign-ins, role changes, new inbox rules and unusually many downloads get a high severity. The AI advice combines that with the MFA status and the Secure Score into a list of priorities.
Reporting duty and incidents
Under NIS2 you report a significant incident within 24 hours with an early warning. The timeline of the last 24 hours, with all details per event, helps you quickly judge what happened, which accounts are involved and when it started. You submit the report itself to your CSIRT or supervisory authority.
Roles and access
AlertControl only shows what a role may also see in Microsoft 365. For security officers, Security Reader is the recommended role: see everything, change nothing. AlertControl itself only has read permissions, sessions last at most 8 hours and roles are rechecked every fifteen minutes.
Frequently asked questions
No. AlertControl reads the Microsoft 365 logs and presents them clearly on one timeline, with severity and advice. It is intended for organisations without their own SOC or SIEM, or as an addition for Microsoft 365.
Yes, in the same way as with ISO 27001: it makes logging and monitoring of Microsoft 365 visible and demonstrable. Healthcare organisations get an adjusted rate.
Yes. Our partner LinkSecure can take over the daily monitoring and helps with incidents, ISO 27001 and NIS2 through CyberDesk.
See for yourself what is happening in your Microsoft 365?
Try AlertControl free for 30 days. You sign in with your Microsoft account and grant read-only consent once.