Back to Checks
azure

Security contact has alert notifications enabled with minimum severity High or lower

defender_ensure_notify_alerts_severity_is_high
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:logging
Resource Type:microsoft.resources/subscriptions

Microsoft Defender for Cloud email notifications use a minimum alert severity of High or more inclusive (Medium/Low). The evaluation inspects security contacts to confirm a threshold is defined and not Critical.

Prowler logoProwlerprowler-provider-azure

Risk

Setting the threshold to Critical or leaving it unset limits alerting, causing delayed detection of High/Medium threats. Attackers can persist, escalate privileges, and exfiltrate data, impacting confidentiality, integrity, and availability via ransomware or service disruption.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_ensure_notify_alerts_severity_is_high

Recommendation

Configure the minimum alert notification severity to High (or Medium/Low) and send to accountable recipients and RBAC roles. Apply defense in depth: route alerts to SIEM, use redundant contacts, and periodically test delivery. Review thresholds regularly to balance noise while avoiding false negatives.

Remediation

CLI

az rest --method PUT --url "https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Security/securityContacts/default?api-version=2023-12-01-preview" --body '{"properties":{"emails":"<EMAIL>","isEnabled":true,"notificationsSources":[{"sourceType":"Alert","minimalSeverity":"High"}]}}'

Terraform

resource "azapi_resource" "<example_resource_name>" {
  type      = "Microsoft.Security/securityContacts@2023-12-01-preview"
  name      = "<example_resource_name>"
  parent_id = "/subscriptions/<SUBSCRIPTION_ID>"

  body = jsonencode({
    properties = {
      emails               = "<EMAIL>"
      isEnabled            = true
      notificationsSources = [
        {
          sourceType     = "Alert"
          minimalSeverity = "High" # Critical line: sets minimum alert severity to High to pass the check
        }
      ]
    }
  })
}

NativeIaC

targetScope = 'subscription'

resource contact 'Microsoft.Security/securityContacts@2023-12-01-preview' = {
  name: '<example_resource_name>'
  properties: {
    emails: '<EMAIL>'
    isEnabled: true
    notificationsSources: [
      {
        sourceType: 'Alert'
        minimalSeverity: 'High' // Critical line: sets minimum alert severity to High to pass the check
      }
    ]
  }
}

Other

1In Azure Portal, go to Defender for Cloud > Environment settings > select your subscription
2Open Email notifications
3Turn on "Send email notifications for alerts"
4Set "Minimum alert severity" to High (or Medium/Low)
5Enter at least one email address
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_ensure_notify_alerts_severity_is_high(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            security_contact_configurations,
        ) in defender_client.security_contact_configurations.items():
            subscription_name = defender_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for contact_configuration in security_contact_configurations.values():
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=contact_configuration
                )
                report.resource_name = (
                    contact_configuration.name
                    if contact_configuration.name
                    else "Security Contact"
                )
                report.subscription = subscription_id
                report.status = "FAIL"
                report.status_extended = f"Notifications are not enabled for alerts with a minimum severity of high or lower in subscription {subscription_name} ({subscription_id})."

                if (
                    contact_configuration.alert_minimal_severity
                    and contact_configuration.alert_minimal_severity != "Critical"
                ):
                    report.status = "PASS"
                    report.status_extended = f"Notifications are enabled for alerts with a minimum severity of high or lower ({contact_configuration.alert_minimal_severity}) in subscription {subscription_name} ({subscription_id})."

                findings.append(report)

        return findings

References