Back to Checks
azure

Security contact notifications include the Owner role

defender_ensure_notify_emails_to_owners
Service: defenderSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:microsoft.resources/subscriptions

Microsoft Defender for Cloud email notifications target subscription users in the Owner role through role-based recipients.

Prowler logoProwlerprowler-provider-azure

Risk

Without notifying Owners, critical alerts can be missed, delaying incident response. Attackers gain longer dwell time for data exfiltration, privilege abuse, and service disruption, undermining confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_ensure_notify_emails_to_owners

Recommendation

Enable role-based notifications to the Owner role and use monitored, up-to-date distribution lists. Add secondary recipients (SOC/security admins) for redundancy, tune thresholds to reduce noise, and integrate with SIEM/automation. Apply defense in depth and least privilege for alert dissemination.

Remediation

CLI

az security contact create --name default --email <EMAIL> --alerts-admins On

Terraform

# Enable notifications to subscription owners (Owner role)
resource "azurerm_security_center_contact" "<example_resource_name>" {
  email               = "<email@example.com>"
  alert_notifications = true
  alerts_to_admins    = true  # CRITICAL: Notifies users with the Owner role
}

NativeIaC

// Enable Defender for Cloud notifications to the Owner role
resource contact 'Microsoft.Security/securityContacts@2023-12-01-preview' = {
  name: 'default'
  properties: {
    emails: '<email@example.com>'
    notificationsByRole: {
      state: 'On'   // CRITICAL: Turn on role-based notifications
      roles: [ 'Owner' ] // CRITICAL: Ensure the Owner role is notified
    }
  }
}

Other

1In the Azure portal, go to Microsoft Defender for Cloud
2Select Environment settings > choose the target subscription
3Open Email notifications
4Enable "Send email notifications to users with the following roles"
5Select the role: Owner
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_ensure_notify_emails_to_owners(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            security_contact_configurations,
        ) in defender_client.security_contact_configurations.items():
            subscription_name = defender_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for contact_configuration in security_contact_configurations.values():
                report = Check_Report_Azure(
                    metadata=self.metadata(),
                    resource=contact_configuration,
                )
                report.resource_name = (
                    contact_configuration.name
                    if contact_configuration.name
                    else "Security Contact"
                )
                report.subscription = subscription_id
                if (
                    contact_configuration.notifications_by_role.state
                    and "Owner" in contact_configuration.notifications_by_role.roles
                ):
                    report.status = "PASS"
                    report.status_extended = f"The Owner role is notified for subscription {subscription_name} ({subscription_id})."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"The Owner role is not notified for subscription {subscription_name} ({subscription_id})."

                findings.append(report)

        return findings

References