Merge pull request MicrosoftDocs#7567 from MicrosoftDocs/chrisda

Chrisda to Master

Author: chrisda

exchange/exchange-ps/exchange/New-ActivityAlert.md

@@ -148,7 +148,7 @@ The Operation parameter specifies the activity that triggers an activity alert.
 
 A valid value for this parameter is an activity that's available in the Microsoft 365 audit log. For a description of these activities, see [Audited activities](https://docs.microsoft.com/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance#audited-activities).
 
-Although this parameter is technically capable of accepting multiple values separated by commas, multiple values don't work.
+You can enter multiple values separated by commas. If the values contain spaces or otherwise require quotation marks, use the following syntax: `"Value1","Value2",..."ValueN"`.
 
 You can't use this parameter if the Type parameter value is ElevationOfPrivilege.
 

exchange/exchange-ps/exchange/New-ProtectionAlert.md

@@ -464,7 +464,7 @@ Accept wildcard characters: False
 ### -Operation
 The Operation parameter specifies the activities that are monitored by the alert policy. For the list of available activities, see the Audited activities tab at [Audited activities](https://docs.microsoft.com/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance#audited-activities).
 
-You can specify multiple values separated by commas.
+Although this parameter is technically capable of accepting multiple values separated by commas, multiple values don't work.
 
 You can only use this parameter when the ThreatType parameter has the value Activity.
 

exchange/exchange-ps/exchange/Set-ProtectionAlert.md

@@ -441,7 +441,7 @@ Accept wildcard characters: False
 ### -Operation
 The Operation parameter specifies the activities that are monitored by the alert policy. For the list of available activities, see the Audited activities tab at [Audited activities](https://docs.microsoft.com/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance#audited-activities).
 
-You can specify multiple values separated by commas.
+Although this parameter is technically capable of accepting multiple values separated by commas, multiple values don't work.
 
 You can only use this parameter when the ThreatType parameter has the value Activity.