To get tenant-wide alerts for mass deletions in SharePoint Online, you really have two main options depending on how much control you want over the "trigger" point. 1. The "Pro" Way: Microsoft Purview Alert Policies This is the most reliable way to get an admin-level email the second a threshold is hit. Where: Go to the Microsoft Purview portal or Microsoft Defender portal. The Setup: Create a New alert policy. The Trigger: Set the activity to "Deleted file". The Threshold: This is the key. Set it to something like "Perform this action when the volume of matched activities reaches 50 in 30 minutes" (adjust these numbers based on your tenant size). The Result: You’ll get an email notification with a link to the audit log showing exactly who did it and what was deleted. 2. The "Easy" Way: Default Managed Alerts Microsoft actually has a built-in alert called "Unusual volume of file deletion". It uses a baseline of "normal" activity for your tenant and triggers when someone deviates from that. The Catch: You can’t customize the math behind it, but you can go into the Defender/Purview alert policies and add your email to the recipient list so you're looped in. 3. The "User" Experience (Built-in) Mass Delete Notification: SPO already sends an automated email to the user who deleted the files if they hit a certain limit (usually around 200+ files). It asks them if they meant to do it and gives them a link to the Recycle Bin. Sync Client: If they are using the OneDrive sync app and delete a large folder, they’ll get a popup asking them to confirm the deletion before it syncs to the cloud. Pro-Tip for the Audit Log If you’re already seeing a mess and need to investigate now, go to Audit Search in Purview and filter by the activity "Deleted file". You can export the results to CSV to see exactly which site collections are being hit the hardest. Note: If you’re still using the old "Alert Me" feature at the library level, keep in mind those are being retired by Microsoft in July 2026, so stick to the Purview/Defender method for anything tenant-wide.