Check Details

• Resource: Microsoft Defender for Cloud
• Check: Ensure Security Notifications Are Enabled
• Risk: If security notifications are disabled, critical security alerts may go unnoticed, delaying incident response and increasing the likelihood of prolonged exposure to threats.

Remediation via Azure Portal

1. Log in to the Azure Portal.
2. Navigate to Microsoft Defender for Cloud.
3. In the left-hand menu, select Environment settings.
4. Select the relevant Subscription.
5. Under Settings, select Email notifications.
6. Ensure Email notifications for high severity alerts are set to On.
7. Click Save to apply the configuration.

Remediation via Azure CLI

1. Open Azure Cloud Shell or a local terminal with Azure CLI installed.

2. Check the current security contact configuration:

   

   az security contact list
   

3. Configure security email notifications:

   

   az security contact create \
   --name default1 \
   --email security@example.com \
   --alert-notifications On \
   --alerts-admins On
   

4. Verify that notifications are enabled:

   

   az security contact list \
   --query "[].{Email:email, AlertNotifications:alertNotifications.state}"
   

   Replace security@example.com with the appropriate security contact email address. The output should confirm that alert notifications are enabled. If notifications are already configured correctly, no further action is required.