A workspace admin is setting up automated monitoring so that if a branch's visitor-count Eventstream reports a value above a defined threshold, a Teams message is sent to the operations channel automatically. Conceptually, what two things must be defined together for this to work in Data Activator?

Every Data Activator rule pairs a condition, evaluated continuously against incoming data such as an Eventstream's visitor-count values, with an action that fires automatically once that condition is met, such as sending a Teams message to an operations channel; both halves are required, since a condition without an action would just observe silently and an action without a condition would fire constantly or never. Sensitivity labels and endorsement levels are governance and trust concepts applied to items themselves; they don't evaluate live data values or trigger notifications. Deployment pipeline stages and Git branches belong to Fabric's lifecycle-management tooling for promoting and versioning item definitions, an entirely different concern from reacting to live telemetry. Row-level security roles and column masks are data-access controls that restrict what a given user can see in a table; they have no role in defining a monitoring rule or its response. Once the pair is defined, it's worth testing the threshold against a realistic range of past visitor counts so normal daily peaks don't trigger the alert constantly.