Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
defender_ensure_notify_alerts_severity_is_highProvider: Azure
Service:
defenderSeverity: HIGH
Categories:
loggingResource type:
microsoft.resources/subscriptionsWhat this check verifies
Microsoft Defender for Cloud email notifications use a minimum alert severity ofHigh or more inclusive (Medium/Low). The evaluation inspects security contacts to confirm a threshold is defined and not Critical.
Risk
Setting the threshold toCritical or leaving it unset limits alerting, causing delayed detection of High/Medium threats. Attackers can persist, escalate privileges, and exfiltrate data, impacting confidentiality, integrity, and availability via ransomware or service disruption.
Recommendation
Configure the minimum alert notification severity toHigh (or Medium/Low) and send to accountable recipients and RBAC roles. Apply defense in depth: route alerts to SIEM, use redundant contacts, and periodically test delivery. Review thresholds regularly to balance noise while avoiding false negatives.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-email-notifications
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/enable-high-severity-email-notifications.html
- https://docs.microsoft.com/en-us/rest/api/securitycenter/securitycontacts/list
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = defender_ensure_notify_alerts_severity_is_high. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks