Security contact notifications include the Owner role

Check ID: defender_ensure_notify_emails_to_owners
Provider: Azure
Service: defender
Severity: MEDIUM
Categories: identity-access
Resource type: microsoft.resources/subscriptions

What this check verifies

Microsoft Defender for Cloud email notifications target subscription users in the Owner role through role-based recipients.

Risk

Without notifying Owners, critical alerts can be missed, delaying incident response. Attackers gain longer dwell time for data exfiltration, privilege abuse, and service disruption, undermining confidentiality, integrity, and availability.

Recommendation

Enable role-based notifications to the Owner role and use monitored, up-to-date distribution lists. Add secondary recipients (SOC/security admins) for redundancy, tune thresholds to reduce noise, and integrate with SIEM/automation. Apply defense in depth and least privilege for alert dissemination.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az security contact create —name default —email <EMAIL> —alerts-admins On

# Enable notifications to subscription owners (Owner role)
resource "azurerm_security_center_contact" "<example_resource_name>" {
  email               = "<[email protected]>"
  alert_notifications = true
  alerts_to_admins    = true  # CRITICAL: Notifies users with the Owner role
}

// Enable Defender for Cloud notifications to the Owner role
resource contact 'Microsoft.Security/securityContacts@2023-12-01-preview' = {
  name: 'default'
  properties: {
    emails: '<[email protected]>'
    notificationsByRole: {
      state: 'On'   // CRITICAL: Turn on role-based notifications
      roles: [ 'Owner' ] // CRITICAL: Ensure the Owner role is notified
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_ensure_notify_emails_to_owners. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Security contact alert notifications are set to High All virtual machines have system updates applied

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires