Email alert action fails with “Failed to send email. Status code: NotFound” when using Microsoft Graph and ${DefaultEmailCC}

2/20/2026 6:48 PM

2/20/2026 7:29 PM

Environment

• Product: SolarWinds Platform

• Feature: Core alerting – Send an Email/Page action

• Mail transport: Microsoft Graph / OAuth 2.0 (MSGraphClient)

• Scope: Any alert using ${DefaultEmailCC} in the CC field

Error

From ActionsExecutionAlert log:
2026-02-18 10:21:31,018 [198] ERROR AlertingLogger - (null) Sending the email from address-1@domain.name to address2@domain.name,address3@domain.name with subject ALERT: Node <Node Name> is Down using SMTP Server <SMTP Server address> failed. Failed to send email. Status code: NotFound
System.Exception: Failed to send email. Status code: NotFound
at SolarWinds.Orion.Core.Actions.Utility.Smtp.Clients.MSGraphClient.Send()
at SolarWinds.Orion.Core.Actions.Impl.Email.EmailExecutor.SendEmail(EmailConfiguration config)
at SolarWinds.Orion.Core.Actions.Impl.Email.EmailExecutor.ExecuteInternal()

2026-02-18 10:21:31,044 [198] ERROR AlertingLogger - (null) Action [Action: ID: 109, ActionType: Email, Title: Send an Email/Page (ALERT: Node ${NodeName} is ${Status}), Description: To: address2@domain.name,address3@domain.name <br/>From: address-1@domain.name<br/>Subject: ALERT: Node ${NodeName} is ${Status}<br/>CC: ${DefaultEmailCC}, Enabled: True, Order: 2, Approved: , Context: SolarWinds.Orion.Core.Models.Actions.Contexts.AlertingActionContext, EnviromentType: Alerting, ExecutionMode: Trigger, EntityType: Orion.Nodes, EntityUri: swis://<SolarWindsPlatformServer>/Orion/Orion.Nodes/NodeID=2977, AlertContext: AlertName: Node is down, CreatedBy: , AlertActiveId: 32279648, AlertObjectId: 1212231] execution has failed.
System.Exception: Failed to send email. Status code: NotFound
at SolarWinds.Orion.Core.Actions.Utility.Smtp.Clients.MSGraphClient.Send()
at SolarWinds.Orion.Core.Actions.Impl.Email.EmailExecutor.SendEmail(EmailConfiguration config)
at SolarWinds.Orion.Core.Actions.Impl.Email.EmailExecutor.ExecuteInternal()
at SolarWinds.Orion.Core.Actions.ActionExecutorBase.Execute(IServiceProvider serviceProvider, ActionDefinition definition, ActionContextBase context, CancellationToken cancellationToken)

Problem

Email alert actions intermittently or consistently fail when executed by the alert engine, even though:

• The Microsoft Graph SMTP server test (Send Test Email) succeeds.

• The To and From addresses used by the alert are valid.

Symptoms

In ActionsExecutionAlert.log and/or ActionsExecution.log you see entries similar to:

Sending the email from address-1@domain.name to address2@domain.name,address3@domain.name with subject ALERT: Node <Node Name> is Down using SMTP Server <SMTP Server address> failed.
Failed to send email.
Status code: NotFound
System.Exception: Failed to send email. Status code: NotFound
   at SolarWinds.Orion.Core.Actions.Utility.Smtp.Clients.MSGraphClient.Send()
   at SolarWinds.Orion.Core.Actions.Impl.Email.EmailExecutor.SendEmail(EmailConfiguration config)
   at SolarWinds.Orion.Core.Actions.Impl.Email.EmailExecutor.ExecuteInternal()

The corresponding alert action definition includes a CC macro:

Action [Action: ID: 109, ActionType: Email, Title: Send an Email/Page (ALERT: Node ${NodeName} is ${Status}), 
Description: To: address2@domain.name <br/>
From: address-1@domain.name<br/>
Subject: ALERT: Node ${NodeName} is ${Status}<br/>
CC: ${DefaultEmailCC}, Enabled: True, Order: 2, ...]
execution has failed.
System.Exception: Failed to send email. Status code: NotFound

Network Performance Monitor

The ${DefaultEmailCC} macro expands to the Default Send Email Action CC value configured under:

Settings → Alerts & Reports → Configure Default Send Email Action

When the alert executes, SolarWinds resolves ${DefaultEmailCC} into one or more CC addresses. If any of those addresses:

• No longer exist (stale mailbox or distribution list),

• Are not resolvable in the Microsoft 365 tenant used by Graph, or

• Are otherwise invalid for Graph,

the Microsoft Graph send call (MSGraphClient.Send) fails with HTTP 404 NotFound, causing the entire email action to fail.

The Send Test Email button on the SMTP/Graph configuration may still succeed if it does not use ${DefaultEmailCC} or uses a different set of recipients, which can make this issue appear only during actual alert execution.

Option 1 – Remove ${DefaultEmailCC} from affected alerts

1. Go to Settings → All Settings → Manage Alerts.

2. Edit the affected alert (for example, Node is down).

3. Under Trigger Actions (and Reset Actions, if applicable), edit the Send an Email/Page action.

4. In the CC field:

   • Remove the ${DefaultEmailCC} macro.

   • Optionally replace it with explicit, known-good addresses (e.g. noc-team@domain).

5. Save the alert and test (Simulate/Execute) to confirm the email now sends successfully.

In the referenced environment, removing ${DefaultEmailCC} from the alert CC field and sending only to valid To addresses resolved the failure.

Option 2 – Correct the default CC value used by ${DefaultEmailCC}

If you want to continue using ${DefaultEmailCC} globally:

1. Go to Settings → Alerts & Reports → Configure Default Send Email Action.

2. Inspect the CC field and:

   • Remove any obsolete DLs or mailboxes.

   • Replace or fix any invalid or external addresses that Microsoft Graph cannot resolve.

3. Save the changes.

4. Re-test an alert that uses ${DefaultEmailCC} in CC.

Once all addresses in the default CC list are valid from Microsoft Graph’s perspective, and the default From/Reply-To address is a mailbox that Microsoft Graph can send as (for example, changing address-1@domain.name to address1@domain.name), alerts using ${DefaultEmailCC} should execute successfully.

Validation

After applying one of the resolutions above:

1. Simulate/Execute the alert from Manage Alerts.

2. Confirm:

   • The email is received by the intended recipients.

   • ActionsExecutionAlert.log no longer shows Status code: NotFound or MSGraphClient.Send exceptions for this action.