> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/azure-devops/settings/notifications.md).
# Notifications
The notification settings in StepSecurity let you receive alerts about critical security events by email, Slack, or Microsoft Teams. These notifications keep you informed about potential security risks in your pipelines and in the tokens that hold access to your organization.
**To reach this page:** open the sidebar and go to Settings > Notifications.
### Notification Channels
Enter your email address, or provide a Slack or Teams webhook URL, to receive alerts. Follow these instructions to create a [Slack webhook](https://api.slack.com/messaging/webhooks) or a [Teams webhook](https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook?tabs=newteams%2Cdotnet).
### Notification Events
Select the security events you want to be notified about. Events are grouped by the product area that raises them.
{% hint style="info" %}
Only one notification is sent per pipeline. A repeated event on the same pipeline is not sent again.
Token events are sent once, when a token starts breaching a policy. They also require the matching control to be switched on under [Control Evaluation](/azure-devops/settings/control-evaluation.md). If the control is off, selecting the event here has no effect.
{% endhint %}
#### **Harden Runner**
These events fire when Harden-Runner observes something during a pipeline run. Each one corresponds to a detection type described in [Detections](/azure-devops/harden-runner/detections.md).
* **Notify when new endpoint is discovered**: the job called an outbound endpoint that is not in its baseline
* **Notify when file overwrites are detected**: a source code file was overwritten during the run
* **Notify when outbound connections are detected**: outbound network connections were observed during the run
#### **PAT Governance**
These events fire when a Personal Access Token starts violating your PAT Governance policy, or is nearing expiration. Each one is tied to a control, and the thresholds that decide when it fires are set under [Control Evaluation](/azure-devops/settings/control-evaluation.md).
| Event | Fires when | Control |
| ---------------------------------------------------------------------- | -------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| **Notify when a token is issued for longer than the allowed lifetime** | A token is issued for longer than its limit, or is already older than it | [Tokens Should Be Rotated Within Max Age](/azure-devops/overview.md#tokens-should-be-rotated-within-max-age) |
| **Notify when a token holds high privilege scopes** | A token holds a scope Microsoft rates high privilege, or grants full access | [Tokens Should Have Minimum Scopes](/azure-devops/overview.md#tokens-should-have-minimum-scopes) |
| **Notify when a token has not been used recently** | A token sits idle past its limit | [Tokens Should Be Actively Used](/azure-devops/overview.md#tokens-should-be-actively-used) |
| **Notify when a token's owner is deactivated or removed** | A token's owner is deactivated in the directory or removed from the organization | [Tokens Should Belong To Active Users](/azure-devops/overview.md#tokens-should-belong-to-active-users) |
| **Remind before a token expires, at 30, 7 and 1 days** | A token is approaching its expiration date, at each configured reminder band | [Tokens Should Be Rotated Within Max Age](/azure-devops/overview.md#tokens-should-be-rotated-within-max-age) |
The reminder bands shown on the last event reflect the **Remind at** value set under Control Evaluation. Change that value to change when reminders are sent.
#### Preview
The Preview panel shows the message your organization would receive, based on the events you have selected. It updates as you change the selection, and shows a prompt to select an event while none are selected.
StepSecurity sends one grouped message per organization per scan, to whichever channels are configured above. Only the events you have selected appear in it.
#### Saving Your Preferences
Once you have configured the notification settings, select **Save** to apply your changes.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.stepsecurity.io/azure-devops/settings/notifications.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
