Custom Admins can be configured to receive suspicious activity email notifications. The goal of this knowledge article is to provide reasons why a Custom Admin is not receiving suspicious activity email notifications, along with the solutions to correct the issue.

• Email notifications
• Suspicious Activity Report
• Custom Admins

There are two possible causes for this issue:

1. The Custom Admin role requires Manage Users or Manage Groups permissions to receive suspicious activity email notifications, as user permission is necessary to receive the suspicious email notifications generated by affected users.
2. The Custom Admin is experiencing E-Mail Deliverability issues. This issue is visible in the system log by using the following query:
   

   eventType eq "system.email.delivery" and outcome.result eq "FAILURE"

Administrators should first verify that the Custom Admin role is granted the Manage Users permission. 

1. Grant the Manage Users permission to the Custom Admin role.

2. For this role, edit the assigned resource set and verify that All users is selected.

3. Click Save.

NOTE: A service account can be configured to receive the emails and automatically forward them as needed.

If the above permissions are assigned correctly, and the Custom Admin role already has the Manage Users permission, then the issue can be further investigated by following the Troubleshooting E-Mail Deliverability steps.

Related References

• Use custom admin roles
• Configure email notifications for an admin role
• Create a resource set
• Troubleshooting E-Mail Deliverability