How to Block Subdomain users from SaaS Alert Monitoring?

There are two scenarios for which it is possible to block users within a Microsoft 365 Tenant from being monitored by SaaS Alerts.

Scenario 1 – The Tenant manages a primary domain and one or more subdomains of the primary domain.  An Example of this structure is:

• Tenant Primary Domain: ‘@somecompanyname.com’
• subdomain1: ‘@sales.somecompanyname.com’
• subdomain2: ‘@corp.somecompanyname.com’

In the above scenario, when the Tenant is connected to SaaS Alerts for security monitoring all the users for the Primary Domain and both subdomains will automatically be imported for monitoring, and all will be counted as billable users. 

In this case the MSP may request that the users of subdomain1 and / or subdomain2 be removed from the system and not monitored or counted as billable users. The request must be submitted to the account manager or support and will be technically managed by SaaS Alerts engineers.

There are no additional approvals required for this scenario

Scenario 2 – The Tenant manages a primary domain and one or more additional unique domains within the same Microsoft 365 Tenant.  An Example of this structure is:

• Tenant Primary Domain: ‘@somecompanyname.com’
• additionalDomain1: ‘@somecompanyname.net’
• additionalDomain2: ‘@somecompanyname.org’

In the above scenario, when the Tenant is connected to SaaS Alerts for security monitoring all the users for the Primary Domain and both additional unique domains will automatically be imported for monitoring, and all will be counted as billable users. 

In this case the MSP may request that the users of additionalDomain1 and / or additional Domain2 be removed from the system and not monitored or counted as billable users. The request must be submitted to the account manager or support and will be technically managed by SaaS Alerts engineers.

There are no additional approvals required for this scenario

What about user Groups?

The above scenarios should never be referred to as “Groups”, or “Groupings”.  The term “Groups” in the context of Microsoft 365 or Google Workspace refers to logical collections of users within the same domain that are used for simultaneous message routing to groups of users, as well as the application of security privileges or other system settings to multiple users at the same time. 

User Groups may not be excluded from monitoring when a Microsoft 365 or Google Workspace tenant is connected to SaaS Alerts.