Back to Checks
azure

Security contact has additional email addresses configured

defender_additional_email_configured_with_a_security_contact
Service: defenderSeverity: low
OfficialBuilt-inVerified
Categories:forensics-ready
Resource Type:microsoft.resources/subscriptions

Microsoft Defender for Cloud security contact settings include additional email recipients defined in the emails field to receive alert notifications.

Prowler logoProwlerprowler-provider-azure

Risk

Relying only on subscription owners for alerts creates a single point of failure. Missed or delayed notifications extend attacker dwell time, enabling data exfiltration (confidentiality), unauthorized changes (integrity), and service disruption (availability). Absence or turnover can silently suppress alerts.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_additional_email_configured_with_a_security_contact

Recommendation

Use a monitored, team-managed distribution list as the security contact in emails. Include SOC/on-call for 24/7 coverage and enable role-based notifications for redundancy. Tune severities to reduce noise while capturing high-risk events, and integrate alerts with ticketing/SIEM for defense in depth and rapid response.

Remediation

CLI

az rest --method put --url https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Security/securityContacts/default?api-version=2020-01-01-preview --body '{ "properties": { "emails": "<EMAIL>" } }'

Terraform

resource "azurerm_security_center_contact" "<example_resource_name>" {
  email = "<EMAIL>" # Critical: ensures at least one security contact email is configured
}

NativeIaC

// Configure a security contact at subscription scope
targetScope = 'subscription'

resource <example_resource_name> 'Microsoft.Security/securityContacts@2020-01-01-preview' = {
  name: 'default'
  properties: {
    emails: '<EMAIL>' // Critical: set at least one email to pass the check
  }
}

Other

1Sign in to the Azure portal
2Go to Microsoft Defender for Cloud > Environment settings
3Select the target subscription
4Click Email notifications
5In Email addresses, enter at least one email (comma-separated for multiple)
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_additional_email_configured_with_a_security_contact(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            security_contact_configurations,
        ) in defender_client.security_contact_configurations.items():
            subscription_name = defender_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for contact_configuration in security_contact_configurations.values():
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=contact_configuration
                )
                report.resource_name = (
                    contact_configuration.name
                    if contact_configuration.name
                    else "Security Contact"
                )
                report.subscription = subscription_id

                if len(contact_configuration.emails) > 0:
                    report.status = "PASS"
                    report.status_extended = f"There is another correct email configured for subscription {subscription_name} ({subscription_id})."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"There is not another correct email configured for subscription {subscription_name} ({subscription_id})."

                findings.append(report)

        return findings

References