The four signal classes
- Service health (Microsoft's side): advisories/incidents per workload — via admin center, or app-only API pull (our scan's ServiceHealth leg). Route: ops channel, immediately; annotate your own dashboards with it (the Pulse pattern: advisory markers on quality charts).
- Quality (your users' experience): CQD trends — poor-call %, transport mix, per-site outliers (the triage module's weekly fifteen minutes, automated). Route: network/voice owners.
- Configuration drift (your side): the policy estate changing — who/what/when, with before/after. This is literally serv365's scan: nightly canonical snapshot, diff, Teams-card alert. Route: the admins who own the policy area; unexplained drift = incident.
- Change-from-Microsoft (the roadmap bearing down on you): MC posts scored and — with a connected tenant — VERDICTED against your actual config ('this retirement touches 4 of your policies'). Route: weekly review + act-by-date tracking. Without this class, the other three explain outages you could have prevented.
Patterns that make it real
- Alert into Teams itself (webhook/Workflows — the delivery architecture doc'd in this very platform) BUT with the resilience module's caveat: class-1 outage comms need a non-Teams channel.
- Canaries where telemetry lags: a scheduled join/call probe per critical site beats waiting for advisories (resilience module's latency finding).
- Dashboards answer questions, alerts demand actions: a page for 'how are we', a ping ONLY for 'someone must act now' — alert fatigue is monitoring debt.
- Correlation is the payoff: quality dip + drift event + MC post on one timeline is root-cause-in-minutes; it is the entire thesis of putting these four classes in one place.
What to watch (watching the watchers)
- Coverage honesty: which policy surfaces/signal classes are NOT monitored — the list, maintained, beats false confidence (serv365 shows its scan coverage and its NO_MAPPING count for this reason).
- Alert-to-action ratio per route: alerts that never produce action get retired or rerouted — quarterly pruning.
- Drift-explained rate: % of drift events matched to a change record — below ~90% means unmanaged change is normal in your estate.
- The end-to-end drill: inject a benign policy change -> drift alert lands -> the on-call explains it from the card alone. Minutes, measured; that's your monitoring's real SLA.