# Ensure That 'All users with the following roles' is set to 'Owner' (Automated)

- Source: https://support.icompaas.com/support/solutions/articles/62000219765-ensure-that-all-users-with-the-following-roles-is-set-to-owner-automated-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [2. Security Center](https://support.icompaas.com/support/solutions/folders/62000167545)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

This setting makes sure that all Owner role users automatically receive security alert emails. Turning it on ensures that subscription owners are notified about important security issues without needing to add their emails manually.

  

Rationale:

Sending security alerts to all users with the Owner role ensures that the people responsible for managing the subscription are immediately aware of important security issues. This improves response time and helps prevent security risks from being overlooked.

  

Impact:  
Enabling this setting may result in more alert emails being sent to subscription owners, which could lead to notification fatigue. However, this is outweighed by the benefit of ensuring that critical security issues are not missed.

  

Default Value:

By default, this setting is disabled (notifications to users with the Owner role are not automatically enabled).

  

Pre-requisites:

A valid security contact email must be configured in Microsoft Defender for Cloud before enabling notifications for users with the Owner role.

  

Test Plan:

1.  Open the Azure portal at [https://portal.azure.com](https://portal.azure.com/).
    
2.  In the portal, search for Microsoft Defender for Cloud.
    
3.  Under Management, select Environment settings and choose the target subscription.
    
4.  Under Settings, go to Email notifications.
    
5.  In the Email recipients section, verify that the option “All users with the following roles: Owner” is selected.
    

           ![](https://support.icompaas.com/assets/kb/4b32fdabf65c90fe.png)

6.  If it is not selected, follow the implementation Steps.
    

Implementation Steps:

1.  Open the Azure Portal [https://portal.azure.com](https://portal.azure.com/)
    
2.  In the portal, search for Microsoft Defender for Cloud.
    
3.  Under Management, select Environment settings and choose the target subscription.
    

      ![](https://support.icompaas.com/assets/kb/927a2cfd2bec3349.png)

4.  Under Settings, go to Email notifications.
    
5.  Ensure a valid security contact email is configured.
    
6.  In the Email recipients section, set the option to ‘All users with the following roles: Owner.
    

             ![](https://support.icompaas.com/assets/kb/628049060288fb9a.png)

7.  Save the configuration to apply the setting.
    

Backout Plan:

1.  Open the Azure portal at [https://portal.azure.com](https://portal.azure.com/).
    
2.  In the portal, search for Microsoft Defender for Cloud.
    
3.  Under Management, select Environment settings and choose the target subscription.
    
4.  Under Settings, go to Email notifications.
    
5.  In the Email recipients section, change the selection back to its previous value.
    
6.  Save the changes to revert the configuration.
    

  

Reference:

-   [https://learn.microsoft.com/azure/defender-for-cloud](https://learn.microsoft.com/azure/defender-for-cloud)
    
-   [https://learn.microsoft.com/azure/governance/policy/samples/cis-azure-1-4](https://learn.microsoft.com/azure/governance/policy/samples/cis-azure-1-4)
    
-   [https://learn.microsoft.com/azure/defender-for-cloud/security-alert-email-notifications](https://learn.microsoft.com/azure/defender-for-cloud/security-alert-email-notifications)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.