How Many Alerts for SharePoint File Uploads in Purview?
You have a Microsoft 365 E5 subscription that contains a user named User1 and a Microsoft SharePoint Online site named Site1. You create the alert policy shown in the following exhibit. To Site1, User1 uploads the files shown in the following table. How many alerts will be generated in response to the file uploads? - 
- 
Community Votes
61% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests two conditions at once: the .docx file-name filter and Purview's one-minute alert aggregation; the trap is counting every .docx upload as a separate alert or including the .xlsx file.
This SC-400 question tests how a Microsoft Purview alert policy, a .docx file-name filter, and one-minute alert aggregation determine the number of alerts after User1 uploads files to SharePoint Site1. The page establishes that the correct count is two: the .xlsx file is ignored, and the matching .docx uploads form one aggregated alert plus a later separate alert.
The most common wrong choice is D (4), which counts each .docx upload as its own alert and ignores the one-minute aggregation rule that combines matching events.
Community Discussion (9 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The alert policy in the exhibit is scoped to SharePoint upload activity and filters on.docx files, so File3.xlsx cannot trigger an alert. Microsoft Purview alert policies use alert aggregation: matching events that occur within one minute are added to the same alert instead of creating separate alerts. The.docx uploads that fall inside the same one-minute window therefore produce one alert, while the later.docx upload at 08:05:10 falls outside that window and creates a second alert. That gives two alerts total, matching option B. This is also why community users such as Dools and 46a982f land on two after applying the one-minute rule and excluding the.xlsx file.Why the Other Options Are Wrong
Option A (1) would require the later.docx upload to be part of the same aggregation window, but it occurs after the one-minute window and is not merely a duplicate event. Option D (4), favored by thetootall, Ruslan23, and SDiwan, counts every.docx file as a separate alert and ignores alert aggregation entirely. Option C (3) typically comes from either including the.xlsx upload or splitting the aggregated.docx events incorrectly. Option E (5) counts all five uploads, including the filtered.xlsx file, so it overcounts both the filter and the aggregation behavior. The exhibit's file-name condition and Purview's aggregation rule are the two facts that eliminate these choices.Community Comment Notes
JimboJones99 gives the clearest explanation of aggregation, noting that another matching event "within one minute" adds details to the existing alert rather than creating a new one. thetootall, Ruslan23, and SDiwan argue for four alerts, but their counts treat each.docx upload as independent and skip the aggregation behavior. Lukas2100 reaches two, although the reasoning mentions a five-minute range; the underlying one-minute aggregation and the excluded.xlsx file still support two. Dools and 46a982f directly cite the one-minute rule and the.xlsx filter, and 46a982f links to Microsoft's alert aggregation documentation. predator8149 suggests one alert based on five-minute consolidation, but that would incorrectly fold the later.docx event into the first alert.Official Reference
Exam Strategy
Treat the file-name filter and the aggregation interval as two separate gates: first remove non-matching files like .xlsx, then group the remaining matching events by the one-minute aggregation window before counting alerts. This prevents the common D=4 trap of counting each .docx upload individually.
Frequently Asked Questions
Why doesn't File3.xlsx generate an alert?
The alert policy condition filters on .docx file names, so an .xlsx upload does not match the policy and is not counted as an alert.
Why do multiple .docx uploads produce only one alert?
Microsoft Purview alert aggregation adds matching events that occur within one minute to an existing alert instead of creating a separate alert for each upload.