Description:

Security Center emails the subscription owners whenever a high-severity alert is triggered for their subscription. You should provide a security contact email address as an additional email address.


Rationale:

Azure Security Center emails the Subscription Owner to notify them about security alerts. Adding your Security Contact's email address to the 'Additional email addresses' field ensures that your organization's Security Team is included in these alerts. 


Impact:

This ensures that the proper people are aware of any potential compromise in order to mitigate the risk in a timely fashion.


Default Value:

By default, there are no additional email addresses entered.


Audit:

  1. Sign in to your Azure account.

  2. Go to Security Center

  3. Click on Pricing & settings

  4. Click on the appropriate Management Group, Subscription, or Workspace

  5. Click on Email notifications

  6. Check the valid security contact email address is listed in the Additional email addresses field with an appropriate role to use(as default there are no additional email addresses are added).

Remediation:

Pre-requisites:


  1. An Azure Defender plan for Enhanced security plan. But is not required to set the additional email address, However, to send the notifications we need to use the security center in the region selected.

Implementation Steps:

  1. Go to Security Center

  2. Click on Pricing & settings

  3. Click on the appropriate Management Group, Subscription, or Workspace

  4. Click on Email notifications

  5. Set the valid security contact email address is listed in the Additional email addresses field with an appropriate role to use.

Backout Plan:

  1. Go to Security Center

  2. Click on Pricing & settings

  3. Click on the appropriate Management Group, Subscription, or Workspace

  4. Click on Email notifications

  5. Change the valid security contact email address is listed in the Additional email addresses field along with the appropriate role to use.

References: