Security contact has additional email addresses configured

Check ID: defender_additional_email_configured_with_a_security_contact
Provider: Azure
Service: defender
Severity: LOW
Categories: forensics-ready
Resource type: microsoft.resources/subscriptions

What this check verifies

Microsoft Defender for Cloud security contact settings include additional email recipients defined in the emails field to receive alert notifications.

Risk

Relying only on subscription owners for alerts creates a single point of failure. Missed or delayed notifications extend attacker dwell time, enabling data exfiltration (confidentiality), unauthorized changes (integrity), and service disruption (availability). Absence or turnover can silently suppress alerts.

Recommendation

Use a monitored, team-managed distribution list as the security contact in emails. Include SOC/on-call for 24/7 coverage and enable role-based notifications for redundancy. Tune severities to reduce noise while capturing high-risk events, and integrate alerts with ticketing/SIEM for defense in depth and rapid response.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az rest --method put --url https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Security/securityContacts/default?api-version=2020-01-01-preview --body '{ "properties": { "emails": "<EMAIL>" } }'

resource "azurerm_security_center_contact" "<example_resource_name>" {
  email = "<EMAIL>" # Critical: ensures at least one security contact email is configured
}

// Configure a security contact at subscription scope
targetScope = 'subscription'

resource <example_resource_name> 'Microsoft.Security/securityContacts@2020-01-01-preview' = {
  name: 'default'
  properties: {
    emails: '<EMAIL>' // Critical: set at least one email to pass the check
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_additional_email_configured_with_a_security_contact. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Databricks workspace uses VNet injection All virtual machines have endpoint protection installed

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires