question

[Edited]Regarding tracking the total play time of the player, we do not recommend doing this, you can try to track the time of each game. You should send the current time at the beginning and end to Server-side store it in PLAYER READ ONLY DATA or PLAYER INTERNAL DATA, and when the player sends the score, the server or Azure Function will check whether the time matches the score. At the same time, you can store the data of each game of the player in PLAYER READ ONLY DATA or PLAYER INTERNAL DATA for you to view.

If you are using statistics to store scores, it is strongly recommended that you do not turn on Allow client to post player statistics (off by default) to ensure that only the server and Azure Function can modify the statistics. You can check if player has enough game time, if the score is in range (if set), and you can set up multiple checkpoints to check in segments to ensure player doesn't get lots of scores at once.

Regarding push notifications, if you use statistics to store scores, and the highest score is the highest score among all players, then you can set the prize table to push notifications when the leaderboard resets. The premise is that push notifications have been configured, refer to Push Notifications quickstart - PlayFab | Microsoft Docs. Of course, you can also push notifications manually, also refer to the quick start above.

If your players have set email addresses, it is more convenient to use email to send message. You can use GetPlayerProfile or GetUserAccountInfo to get the player's email.

Note: If you can identify a player as a cheater, you can ban the user in Game Manager or using BanUsers.

To be added is:

Good cheat prevention logic is complex and will be title specific. There are a huge number of possible things the developer could check. In the most robust systems, the title would submit the set of data about all the actions the player took during the game session, so that the cheat detection logic could walk through it and validate all the steps. In that model, the title would also emit an event with a hash signature for that dataset, so that the developer could check for duplicates – which could indicate someone cheating by simply recording (or artificially generating) a session and replaying it. But also, cheat protection should evolve over time, as any popular game will see cheaters adapting to the things that prevent them from posting scores.