Check ID: defender_ensure_notify_alerts_severity_is_high
Provider: Azure
Service: defender
Severity: HIGH
Categories: logging
Resource type: microsoft.resources/subscriptions

What this check verifies

Microsoft Defender for Cloud email notifications use a minimum alert severity of High or more inclusive (Medium/Low). The evaluation inspects security contacts to confirm a threshold is defined and not Critical.

Risk

Setting the threshold to Critical or leaving it unset limits alerting, causing delayed detection of High/Medium threats. Attackers can persist, escalate privileges, and exfiltrate data, impacting confidentiality, integrity, and availability via ransomware or service disruption.

Recommendation

Configure the minimum alert notification severity to High (or Medium/Low) and send to accountable recipients and RBAC roles. Apply defense in depth: route alerts to SIEM, use redundant contacts, and periodically test delivery. Review thresholds regularly to balance noise while avoiding false negatives.

Remediation

az rest --method PUT --url "https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Security/securityContacts/default?api-version=2023-12-01-preview" --body '{"properties":{"emails":"<EMAIL>","isEnabled":true,"notificationsSources":[{"sourceType":"Alert","minimalSeverity":"High"}]}}'

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_ensure_notify_alerts_severity_is_high. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks