Showing results for 
Search instead for 
Did you mean: 
Resolver II
Resolver II

Creating flow for Office 365 Service Alerts

I've been working on some updates to @AlanPs1  's Great Flow write up for capturing New Service Health Notices from O365. 

Since Microsoft is notorious for Posting Incident's that have Past Start Times that are not caught by that flow, I decided to create an hourly Flow that checks if the "LastUpdatedTime" is within the last hour and then sends an email.

This works much beter to capture incidents that have been posted in the last hour, but I am having one issue that I am hoping someone can help with.

When the flow triggers and sends the email, it not only includes the latest updated Incident, but the previous ones that are still open as well.

As an example, this morning I received a report containing 5 Incidents, when I would like it to have just included the most recent updated one( circled in Red):


Below are the screens shots of the Arrary's, the Condition and the HTMLTable:




Any help on having the email only include the most recent updated incident would be greatly appreciated!!


Resident Rockstar
Resident Rockstar

Hi @shanemeisner , thank you for posting in the flow Community and thank you for the feedback on my blog post.

This is literally this first chance I've had to get on in a week so happy to try and advise.


Firstly, you are correct. MS seem to have a nack at posting new alerts with start times that aren't real world shall we say.


Based on your description of targeting "LastUpdatedTime", maybe you need to also check that the "StartTime" is say in the last hour, or last 2 hours on that day too.


This would stop you pulling back updates for all events.


So maybe something like this:

@and(greaterOrEquals(item()?['LastUpdatedTime'], addminutes(utcnow(), -60)), greaterOrEquals(item()?['StartTime'], addminutes(utcnow(), -60)))


@and(greaterOrEquals(item()?['LastUpdatedTime'], addminutes(utcnow(), -60)), greaterOrEquals(item()?['StartTime'], addhours(utcnow(), -2)))

will get you better results and cut out some of the other updates?


If you have found my post helpful, please mark thumbs up.


Any other questions, just ask.


Thanks, Alan


Did I answer your question? Mark my post as a solution!

Proud to be a Flownaut!

Thanks for the answer.. I've updated my flow and just waiting for a new update to see if it works.


After playing around a bit with the 2nd filter arrary ( the Start Time was a few days back) I was able to get the email with this as my filter arrary 2:

@and(greaterOrEquals(item()?['LastUpdatedTime'], addminutes(utcnow(), -60)), greaterOrEquals(item()?['StartTime'], addhours(utcnow(), -120)), equals(item()?['EndTime'], Null))

Unfortunately, the email still sends out all items found with the first arrary ( @or(equals(item()?['Status'], 'Service degradation'), equals(item()?['Status'], 'Investigating')) 

In the photo below the bottom item highlighted is what triggered the email, but the items above are still included in the email due to filter array 1


Hi @shanemeisner 

On this one, I am currently looking to enhance this process and have it partly done.


I will come back on this as having a shorter interval, 10 minutes worked better for me. There was also some rationale to that but just can't place it just now. Not looked at it for a while. 


My goal is to get every single message posting as close within 10 minutes and without the Flow being tricked by service degradation logged for a time longer than that spell.


Please persevere with what you are doing as it appears you've got the jist of it overall. You will here from me soon once I have stepped my new process on.


Thanks, Alan

Did I answer your question? Mark my post as a solution!

Proud to be a Flownaut!

Thanks for your responses. I'm also looking to create one last flow report...

As we all know, when an incident is resolved, it just "vanishes" from the Service Health report and you need to review the history to find the what/why.

So, I plan to setup a flow that runs every afternoon with something like @or(equals(item()?['Status'], 'Service restored'), equals(item()?['Status'], 'Post-incident report published')) and the updated time was  in the last 24 hours.

The "Resolved" Flow worked out very well. Surprised many on the team when it came to thier inboxes as some never dispalyed in the Service Health report until they were resolved:


Working off the orginal flow I changed Filter Array 1 to: 

@or(equals(item()?['Status'], 'Service restored'), equals(item()?['Status'], 'Post-incident report published'))

and Filter Array 2 checks for End Time that is within the last 24 hours: 

addhours(utcnow(), -24)

Helpful resources

PP Bootcamp Carousel

Global Power Platform Bootcamp

Dive into the Power Platform stack with hands-on sessions and labs, virtually delivered to you by experts and community leaders.


Power Platform Community Conference On Demand

Watch Nick Doelman's session from the 2020 Power Platform Community Conference on demand!

MPA Community Blog

Power Automate Community Blog

Check out the community blog page where you can find valuable learning material from community and product team members!

Top Solution Authors
Users online (8,615)