Security contact has attack path email notifications enabled

Check ID: defender_attack_path_notifications_properly_configured
Provider: Azure
Service: defender
Severity: HIGH
Categories: logging
Resource type: microsoft.resources/subscriptions

What this check verifies

Microsoft Defender for Cloud attack path email notifications are configured per subscription with a defined minimal risk level, and the setting is present and meets the required threshold.

Risk

Without alerts on exploitable attack paths, security teams lose visibility, enabling lateral movement, privilege escalation, and data exfiltration before containment, degrading confidentiality, integrity, and availability.

Recommendation

Enable and maintain attack path notifications with a minimal risk level at or above your tolerance (e.g., High). Send to monitored, role-based recipients. Apply defense in depth by integrating alerts with central monitoring and automation for prompt triage.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az rest --method put --uri https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Security/securityContacts/default?api-version=2020-01-01-preview --body '{"properties":{"emails":"[email protected]","attackPathNotifications":{"state":"On","minimalRiskLevel":"Low"}}}'

# Enable attack path email notifications at minimal risk level
resource "azapi_resource" "<example_resource_name>" {
  type = "Microsoft.Security/securityContacts@2020-01-01-preview"
  name = "default"
  body = jsonencode({
    properties = {
      emails = "[email protected]"
      attackPathNotifications = {
        state = "On"              # CRITICAL: enables attack path email notifications
        minimalRiskLevel = "Low"  # CRITICAL: sets minimal risk level to pass the check
      }
    }
  })
}

// Enable attack path email notifications at minimal risk level
resource securityContact 'Microsoft.Security/securityContacts@2020-01-01-preview' = {
  name: 'default'
  properties: {
    emails: '[email protected]'
    attackPathNotifications: {
      state: 'On'              // CRITICAL: enables attack path email notifications
      minimalRiskLevel: 'Low'  // CRITICAL: sets minimal risk level to pass the check
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_attack_path_notifications_properly_configured. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

All virtual machines have endpoint protection installed Log Analytics agent auto-provisioning is on for VMs

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires