This report crosses Lighthouse M365 usage data (monthly active users per service across managed tenants) with Datto RMM alert volumes (device-level alerts by severity and category) to test whether tenants with higher M365 workload activity also generate proportionally more device alerts. Two data sources, one question: is cloud-heavy usage putting more strain on endpoints?
This report crosses Lighthouse M365 usage data (monthly active users per service across managed tenants) with Datto RMM alert volumes (device-level alerts by severity and category) to test whether tenants with higher M365 workload activity also generate proportionally more device alerts. Two data sources, one question: is cloud-heavy usage putting more strain on endpoints?
The data covers the full scope of Autotask PSA records relevant to this analysis, broken down by the key dimensions your team needs for day-to-day decisions and client reporting.
Who should use this: NOC teams, service managers, and operations leads managing alert workflows
How often: Daily for alert triage, weekly for noise reduction, monthly for monitoring optimization
This report crosses Lighthouse M365 usage data (monthly active users per service across managed tenants) with Datto RMM alert volumes (device-level alerts by severity and category) to test whether tenants with higher M365 workload activity also generate proportionally more device alerts. Two data sources, one question: is cloud-heavy usage putting more strain on endpoints?
| Tenant | M365 Users | RMM Alerts | Alerts/User | Alert Level |
|---|---|---|---|---|
| Client A | 312 | 18,743 | 60.1 | Very High |
| Client B | 287 | 8,214 | 28.6 | Moderate |
| Client C | 245 | 14,892 | 60.8 | Very High |
| Client D | 198 | 4,127 | 20.8 | Normal |
| Client E | 176 | 5,893 | 33.5 | Moderate |
| Client F | 154 | 11,247 | 73.0 | Very High |
| Client G | 143 | 3,891 | 27.2 | Moderate |
| Client H | 128 | 2,456 | 19.2 | Normal |
| Client I | 112 | 3,214 | 28.7 | Moderate |
| Client J | 97 | 1,847 | 19.0 | Normal |
The relationship is not straightforward. Client F has only 154 M365 users but generates 73 alerts per user - the highest ratio in the dataset. Client D, with 198 users, produces a much healthier 20.8 alerts per user. The biggest tenants (A, B, C) show mixed results: A and C sit at 60+ alerts per user while B manages 28.6. M365 user count alone does not predict alert volume.
EVALUATE TOPN(15,
SUMMARIZECOLUMNS(
BI_Autotask_Companies[company_name],
"M365_Users", SUM(BI_Lighthouse_M365_Usage[active_users]),
"RMM_Alerts", COUNTROWS(BI_Datto_Rmm_Alerts),
"Alerts_Per_User", DIVIDE(
COUNTROWS(BI_Datto_Rmm_Alerts),
SUM(BI_Lighthouse_M365_Usage[active_users])
)
),
SUM(BI_Lighthouse_M365_Usage[active_users]), DESC
)Exchange-heavy tenants generate the most RMM alerts. Tenants where Exchange is the dominant workload average 38.2 alerts per user, compared to 8.4 for Yammer-dominant tenants. This makes sense: Exchange activity drives Outlook usage, which drives local PST handling, calendar sync, and add-in activity - all of which produce device-level events that the RMM agent picks up.
EVALUATE
SUMMARIZECOLUMNS(
BI_Lighthouse_M365_Usage[service_name],
"Active_Users", SUM(BI_Lighthouse_M365_Usage[active_users]),
"Related_Alerts", COUNTROWS(BI_Datto_Rmm_Alerts),
"Alerts_Per_User", DIVIDE(
COUNTROWS(BI_Datto_Rmm_Alerts),
SUM(BI_Lighthouse_M365_Usage[active_users])
)
)
ORDER BY [Alerts_Per_User] DESC| Tenant Size | Tenants | Critical | Warning | Info | Critical % |
|---|---|---|---|---|---|
| Large (200+ users) | 8 | 4,217 | 18,432 | 23,891 | 9.1% |
| Medium (50-199) | 23 | 2,876 | 12,143 | 18,764 | 8.5% |
| Small (<50 users) | 31 | 1,043 | 5,892 | 7,054 | 7.5% |
Larger tenants produce a higher percentage of critical alerts. Tenants with 200+ M365 users see 9.1% of their alerts classified as critical, versus 7.5% for small tenants. This suggests that higher cloud workload activity does not just generate more alerts - it generates proportionally more serious ones. The 8 large tenants alone account for 4,217 critical alerts, nearly half of all critical events.
Disk space alerts dominate in all three high-alert tenants. Client F is the worst case at 51% disk alerts, which tracks with its high OneDrive and Exchange usage pushing local sync and cache files. This is the mechanism: M365 sync activity fills local disks, which triggers RMM disk space alerts. The connection between cloud usage and device alerts runs through storage.
The 8 large tenants (13% of the total) produce nearly half of all RMM alerts. That is a 3.8x overrepresentation. Small tenants, making up 50% of the tenant count, generate just 14.7% of alert volume. The alert load is top-heavy, which means focusing remediation on the largest tenants will have an outsized impact on total alert noise.
EVALUATE
SUMMARIZECOLUMNS(
"Tenant_Size", SWITCH(TRUE(),
SUM(BI_Lighthouse_M365_Usage[active_users]) >= 200, "Large (200+)",
SUM(BI_Lighthouse_M365_Usage[active_users]) >= 50, "Medium (50-199)",
"Small (<50)"
),
"Tenant_Count", DISTINCTCOUNT(BI_Lighthouse_Tenants[tenant_id]),
"Total_Alerts", COUNTROWS(BI_Datto_Rmm_Alerts),
"Critical_Alerts", COUNTROWS(
FILTER(BI_Datto_Rmm_Alerts, BI_Datto_Rmm_Alerts[severity] = "Critical")
),
"Alert_Pct", DIVIDE(
COUNTROWS(BI_Datto_Rmm_Alerts),
CALCULATE(COUNTROWS(BI_Datto_Rmm_Alerts), ALL())
)
)Client A (60.1), Client C (60.8), and Client F (73.0) produce double to triple the fleet average of 33.1 alerts per user. Client F is the standout - despite having only 154 M365 users, it generates 11,247 RMM alerts, with 51% being disk space warnings driven by heavy OneDrive and Exchange sync activity.
Tenants where Exchange is the primary workload average 38.2 alerts per user, compared to 8.4 for Yammer-dominant tenants. The mechanism is local: Outlook sync, PST management, and calendar add-ins all drive device-level activity that triggers RMM monitoring policies.
Client D (198 users, 20.8 alerts/user) and Client H (128 users, 19.2 alerts/user) demonstrate that large M365 footprints can coexist with healthy alert ratios. The difference is infrastructure management - proper disk quotas, sync policies, and monitoring thresholds keep alert noise in check even at scale.
1. Audit disk space policies for Client F, A, and C. These three tenants account for the highest alerts-per-user ratios, and disk space is the dominant alert category. Review OneDrive sync folder locations, Outlook cache sizes, and local storage quotas. Moving sync targets to larger volumes or implementing Files On-Demand can cut disk alerts by 40-60%.
2. Adjust RMM monitoring thresholds for Exchange-heavy tenants. The current one-size-fits-all alert policy treats a 200-user Exchange tenant the same as a 20-user Yammer-only tenant. Create a separate monitoring profile for tenants where Exchange represents more than 60% of M365 activity. Raise the disk space warning threshold from 80% to 85% and set CPU alerts to sustained usage only.
3. Build a monthly "Alert Efficiency" dashboard showing alerts per M365 user. This metric normalizes alert volume by tenant activity level, making it easy to spot which tenants are generating disproportionate noise. Use the DAX queries in this report as the foundation. Any tenant exceeding 50 alerts per user should trigger an automatic review.
Not directly. M365 usage itself does not generate RMM alerts. The connection runs through local resources: Exchange and OneDrive activity consumes disk space and memory on endpoints, which triggers RMM monitoring thresholds. Tenants with proper disk quotas and sync policies can have high M365 usage without elevated alerts.
Exchange activity maps heavily to the Outlook desktop client, which maintains local caches (OST files), processes calendar sync, and runs add-ins. These local operations consume disk and CPU, triggering RMM alerts. Teams, by contrast, is more browser-based and streams content rather than caching it locally, leaving a lighter endpoint footprint.
Based on this dataset, tenants below 25 alerts per M365 user are performing well. The fleet average is 33.1, but that number is pulled up by a few high-noise tenants. Anything above 50 alerts per user warrants investigation, as it typically indicates disk space issues, overly aggressive monitoring policies, or unresolved recurring problems.
Connect Proxuma Power BI to your PSA, RMM, and M365 environment, use an MCP-compatible AI to ask questions, and generate custom reports - in minutes, not days.
See more reports Get started