Manage Microsoft 365 Alert Status
Short answer
E You can change the status to Investigating, Active, Resolved, or Dismissed.
Question
Key Takeaways
The exam tests whether you know that alert statuses are mutable; the common trap is assuming a resolved or specific state locks the alert from further administrative action.
This question tests knowledge of the available status options for managing alerts within the Microsoft Purview compliance portal. It establishes that administrators can transition an alert between Active, Investigating, Resolved, or Dismissed states.
Common mistake: Many candidates select 'Active or Investigating only' because they assume once an alert reaches a certain state (like Resolved), it cannot be changed back, which is incorrect in the Purview UI.
Expert Analysis
Why the Answer Is Correct
According to Microsoft documentation on managing alerts in Purview, administrators can assign one of four specific statuses to an alert: Active, Investigating, Resolved, or Dismissed. This flexibility allows security teams to track the lifecycle of an investigation effectively. Even if an alert appears 'resolved', an admin with appropriate permissions can re-open it by changing its status back to Active or Investigating.Why the Other Options Are Wrong
Option A is incorrect because the status is definitely changeable by authorized users. Option B and C are too restrictive, ignoring the ability to mark alerts as Active or Dismissed. Option D incorrectly excludes 'Dismissed', which is a standard final state for alerts that turn out to be false positives or irrelevant.Community Comment Notes
Community feedback was split, but the majority correctly identified E based on testing. User JimboJones99 confirmed the answer by referencing official Microsoft Learn documentation. User Jo696 provided a direct quote from the docs listing the four valid statuses. However, users like Ruslan23 and SharePat argued for A, claiming they couldn't see a way to change the status, likely due to role permissions or misunderstanding the UI flow.Official Reference
https://learn.microsoft.com/en-us/purview/alert-policies#manage-alerts
This link opens the official vendor documentation in a new tab.
Exam Strategy
Always verify the full list of allowed states in the vendor documentation rather than relying on intuition about workflow logic. In Microsoft Purview, 'Resolved' is not a terminal lock; remember that all four statuses are actionable choices for admins.
Frequently Asked Questions
Can I change an alert from Resolved back to Active?
What are the exact status values for SC-400 alerts?
Community Votes
56% of anonymous learners picked answer E. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
JimboJones99 👍 5 Answered EI think the given answer is correct - E https://learn.microsoft.com/en-us/purview/alert-policies#manage-alerts
-
Ruslan23 👍 4 Answered ANo change status option on resolved alerts, I have the global administrator role assigned.
-
SharePat 👍 2I don't see a way to change the status once it has been resolved so A
-
Athena94 👍 2Answer is correct, I tested it.
-
Jo696 👍 1https://learn.microsoft.com/en-us/purview/alert-policies Assign a status to alerts: You can assign one of the following statuses to alerts: Active (the default value), Investigating, Resolved, or Dismissed. Then, you can filter on this setting to display alerts with the same status setting. This status setting can help track the process of managing alerts.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.