Action group: real alert e-mails only start ~24h after the receiver confirms the OTP code, test e-mail arrives right away

Hi all,

We set up a new action group with 3 e-mail receivers for some security alerts, and we're seeing something we can't find in the docs.

What happens

1. Each receiver gets the new one-time code e-mail and confirms it within the 30 min, then gets "You're now in the ... action group".
2. The Test button on the action group works right away, the test e-mail arrives in minutes.
3. But for about 24 hours after confirming the code, no real alert e-mail is sent.
   The alert history says "Action group ... executed", but our Exchange Online message trace has no record of any e-mail, from any sender, not delivered, not filtered, not failed.
4. After ~24h, real alerts start arriving normally and keep working.

We saw it twice, same action group, different people

In the 2nd case, the other 2 receivers got those same 5 alerts fine, so it's per receiver, not per action group.

What we ruled out

• No alert processing rules on the subscription, all receivers show Enabled
• Common alert schema on, location Global
• Message trace without a sender filter, so azure-noreply@, azureemail-noreply@ and ******@mail.windowsazure.com are all covered
• Nothing in quarantine or junk, no mail-flow changes on our side
• No rate-limit notice, and the volume was low (a few alerts a day)
• No Service Health events for those days

Questions

1. Is a ~24h delay between confirming the code and getting real alert e-mails expected? If yes, is it documented anywhere?
2. Why does the Test e-mail go out right away when real alerts don't? Right after adding someone, the test tells you everything works when it doesn't.
3. Is there a way (portal or API) to see if a receiver is fully active, so we know when someone will actually get alerts?

Happy to share alert IDs privately if someone from Microsoft wants to look at the backend. Thank you!