Manage Microsoft 365 Alert Status
You have a Microsoft 365 alert named Alert2 as shown in the following exhibit. You need to manage the status of Alert2. To which status can you change Alert2? - 
Community Votes
56% of anonymous learners picked answer E. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you know that alert statuses are mutable; the common trap is assuming a resolved or specific state locks the alert from further administrative action.
This question tests knowledge of the available status options for managing alerts within the Microsoft Purview compliance portal. It establishes that administrators can transition an alert between Active, Investigating, Resolved, or Dismissed states.
Many candidates select 'Active or Investigating only' because they assume once an alert reaches a certain state (like Resolved), it cannot be changed back, which is incorrect in the Purview UI.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
According to Microsoft documentation on managing alerts in Purview, administrators can assign one of four specific statuses to an alert: Active, Investigating, Resolved, or Dismissed. This flexibility allows security teams to track the lifecycle of an investigation effectively. Even if an alert appears 'resolved', an admin with appropriate permissions can re-open it by changing its status back to Active or Investigating.Why the Other Options Are Wrong
Option A is incorrect because the status is definitely changeable by authorized users. Option B and C are too restrictive, ignoring the ability to mark alerts as Active or Dismissed. Option D incorrectly excludes 'Dismissed', which is a standard final state for alerts that turn out to be false positives or irrelevant.Community Comment Notes
Community feedback was split, but the majority correctly identified E based on testing. User JimboJones99 confirmed the answer by referencing official Microsoft Learn documentation. User Jo696 provided a direct quote from the docs listing the four valid statuses. However, users like Ruslan23 and SharePat argued for A, claiming they couldn't see a way to change the status, likely due to role permissions or misunderstanding the UI flow.Official Reference
Exam Strategy
Always verify the full list of allowed states in the vendor documentation rather than relying on intuition about workflow logic. In Microsoft Purview, 'Resolved' is not a terminal lock; remember that all four statuses are actionable choices for admins.
Frequently Asked Questions
Can I change an alert from Resolved back to Active?
Yes. If an alert has been marked as Resolved, an administrator can change its status back to Active or Investigating to continue the review process.
What are the exact status values for SC-400 alerts?
The four valid statuses are Active (default), Investigating, Resolved, and Dismissed.