Check Details

• Resource: Microsoft Defender for Cloud
• Check: Ensure Additional Email Address Is Configured
• Risk: If additional security contact email addresses are not configured, critical security alerts may not reach all responsible stakeholders, potentially delaying incident response and remediation efforts.

Remediation via Azure Portal

1. Log in to the Azure Portal.
2. Navigate to Microsoft Defender for Cloud.
3. In the left-hand menu, select Environment settings.
4. Select the relevant Subscription.
5. Under Settings, select Email notifications.
6. In the Additional email addresses field, enter one or more valid organizational email addresses separated by commas.
7. Click Save to apply the configuration.

Remediation via Azure CLI

1. Open Azure Cloud Shell or a local terminal with Azure CLI installed.

2. Check the current security contact configuration:

   

   az security contact list
   

3. Configure additional email addresses for security alerts:

   

   az security contact create \
    --name default \
    --email "primary@example.com" \
    --alert-notifications On \
    --alerts-admins On \
    --additional-emails "security@example.com,ops@example.com"
   

4. Verify that additional email addresses are configured:

   

   az security contact show \
    --name default \
    --query additionalEmails
   

Replace the example email addresses with valid organizational email accounts. Ensure that security and operational teams are included to maintain effective incident communication.