The rule calls Office 365 Management API to get the list of incidents for the Subscription.
An incident (and the corresponding alert) is considered to be active and displayed in Active Incidents list if any of the affected services has one of the following states:
If all affected services for the incident are in other states, then the incident (and the alert) is considered to be resolved.
The rule generates an Alert targeted to the Subscription in the Operations Manager for each Active or Resolved Incident.
Alerts are suppressed by means of a unique Incident ID. The rule updates Alert payload and context if data provided by API for Incident changes.
Use 'Include Resolved Incidents' and 'Reopen Closed Alerts' to customize the rule behavior.
See the list of Active and Resovled Incidents in Office 365 Admin Center