Returns who hears about this tenant's protected domains and at which severities - the settings pane on the Domain Protection page. Read by the same helper the notifier uses, so this reports precisely what it will act on.

notifySeverities is the EFFECTIVE set. A tenant that has never configured the setting is reported with the default [critical, high] and isDefault: true; an empty list is the customer deliberately turning everything off (enabled is derived from it - no severity selected is what "off" means; there is no separate master toggle). supportedSeverities lists the four levels update-notification-settings accepts, strongest first.

additionalRecipients may be any address - there is no domain restriction - and an EMPTY list means nobody is mailed. There is no fallback to the tenant's administrators: for a managed or supported tenant the user list includes CanIPhish staff, so that fallback would quietly mail us instead of the customer, who would never learn they were unnotified. Digests start once the notifier is armed, and their branding follows the tenant's white-label settings; the settings can be read and changed before then.

A storage read failure is not distinguishable from "never configured": the helper returns the defaults (enabled, no recipients, isDefault true) in both cases, exactly as the portal renders them. Nothing is written on this path.

Requires an Enterprise subscription (ErrorCode ENTERPRISE_REQUIRED; not satisfied by Professional, and get-entitlements.isEnterpriseEntitled does not imply it for partner-managed or staff-trial tenants). Admin-only read; no other paid entitlement required.