Cis Azure Foundations 8.1.12

---
name: cis-azure-foundations-8.1.12
description: "Ensure the Microsoft Defender for Cloud 'Security alert emails' is configured"
category: cis-azure-foundations
version: "5.0.0"
author: cyberstrike-official
tags: [cis, azure, security, defender, email-notifications]
cis_id: "8.1.12"
cis_benchmark: "CIS Microsoft Azure Foundations Benchmark v5.0.0"
tech_stack: [azure]
cwe_ids: []
chains_with: []
prerequisites: []
severity_boost: {}
---

# 8.1.12 Ensure the Microsoft Defender for Cloud 'Security alert emails' is configured (Automated)

## Description

Ensure that Microsoft Defender for Cloud is configured to send security alert email notifications to a designated security contact, enabling prompt response to security incidents.

## Rationale

Configuring security alert email notifications ensures that the appropriate personnel are informed when security alerts are generated by Microsoft Defender for Cloud. Without email notifications, critical security alerts may go unnoticed, delaying incident response and potentially allowing threats to persist or escalate. Designating a security contact ensures accountability and timely action on security events.

## Impact

Configuring email notifications has minimal impact. The designated recipients will receive email alerts for security events, which may result in a high volume of emails depending on the environment size and activity. Organizations should ensure the designated recipients can manage the alert volume effectively.

## Audit Procedure

**From Azure Portal:**

1. Go to `Microsoft Defender for Cloud`.
2. Under `Management`, click `Environment settings`.
3. Click the name of a subscription.
4. Select the `Email notifications` blade.
5. Verify that a valid email address is configured in the `Email recipients` field.
6. Ensure `Notify about alerts with the following severity (or higher)` is enabled.

**From Azure CLI:**

```
az account get-access-token --query "{subscription:subscription,token:accessToken}" -o tsv
```

Then query the security contacts API:

```
az rest --method get --url "https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/securityContacts?api-version=2020-01-01-preview"
```

Verify that `emails` field contains valid email addresses.

**From PowerShell:**

```
Get-AzSecurityContact | Select-Object Name, Email, AlertNotifications
```

Ensure `Email` contains a valid address and `AlertNotifications` is `On`.

## Expected Result

A valid security contact email address should be configured and alert notifications should be enabled.

## Remediation

**From Azure Portal:**

1. Go to `Microsoft Defender for Cloud`.
2. Under `Management`, click `Environment settings`.
3. Click the name of a subscription.
4. Select the `Email notifications` blade.
5. In the `Email recipients` field, enter a valid email address for the security contact.
6. Set `Notify about alerts with the following severity (or higher)` to the desired level.
7. Click `Save`.

**From Azure CLI:**

```
az rest --method put --url "https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/securityContacts/default?api-version=2020-01-01-preview" --body '{"properties":{"emails":"security@example.com","alertNotifications":{"state":"On","minimalSeverity":"High"}}}'
```

**From PowerShell:**

```
Set-AzSecurityContact -Name "default" -Email "security@example.com" -AlertAdmin -NotifyOnAlert
```

## Default Value

By default, no security contact email is configured for alert notifications.

## References

1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-email-notifications
2. https://learn.microsoft.com/en-us/azure/defender-for-cloud/security-policy-concept
3. https://learn.microsoft.com/en-us/rest/api/defenderforcloud/security-contacts
4. https://learn.microsoft.com/en-us/powershell/module/az.security/set-azsecuritycontact

## Profile

- Level 1