Description:

 The 'Additional email addresses' setting in Microsoft Defender for Cloud allows you to configure one or more additional email addresses that will receive important security notifications related to your Azure environment. Configuring a Security Contact Email ensures that security alerts, updates, and notifications are sent to the right stakeholders within your organization, such as security personnel or incident response teams.

This feature is vital for ensuring that security-related notifications are promptly delivered to the appropriate team members who can take action, improving the organization’s ability to respond to security incidents in a timely manner.

Rationale: 

By configuring a Security Contact Email in Microsoft Defender for Cloud, organizations ensure that all critical security notifications are delivered to the relevant team members. This ensures that security alerts, such as vulnerabilities or incident alerts, are not missed, allowing the security team to take swift action to mitigate risks. Additionally, this practice helps meet compliance requirements like SOC 2, HIPAA, and NIST, which emphasize timely response to security events.

Impact: 

Enabling additional email addresses for security notifications ensures that the right people in your organization are kept informed about potential threats, vulnerabilities, and compliance requirements. It helps ensure that your team receives the notifications promptly, reducing the likelihood of a security breach. However, too many email notifications could create noise, so it’s essential to carefully manage the addresses to avoid overwhelming the recipients with irrelevant alerts.

Default Value: 

By default, no additional email addresses are configured. This feature needs to be manually enabled to send notifications to security teams.

Pre-requisites:

  • Microsoft Defender for Cloud: Ensure that Microsoft Defender for Cloud is enabled for your environment.

  • Permissions: Ensure you have the appropriate permissions to modify the environment settings in Microsoft Defender for Cloud (e.g., Owner or Contributor role).

  • Security Contact Email: Ensure that the relevant security contact email is available for configuring additional notifications.

Remediation:

Automated Steps to Ensure 'Additional Email Addresses' are Configured with a Security Contact Email:

  1. Sign in to the Azure portal using an account with appropriate permissions.

  2. Navigate to Microsoft Defender for Cloud:

    • In the Azure portal, search for Microsoft Defender for Cloud and open it.

  3. Go to Environment Settings:

    • In the Microsoft Defender for Cloud dashboard, click on Environment settings under the Management section.

  4. Configure Security Contact Email:

    • Under the Security Contact Email section, you will see a field for Additional email addresses.

    • Enter the Security Contact Email (e.g., the email of the security team or incident response team) in the Additional email addresses field.

    • You can add multiple email addresses by separating them with commas or configuring an email distribution list for the team.

  5. Save Settings:

    • After configuring the security contact email(s), save the changes.

    • Microsoft Defender for Cloud will now send security alerts and notifications to the specified email addresses.

Automated Implementation Using Azure CLI:

To configure additional email addresses using Azure CLI:

az security settings update --name "SecurityContactEmail" --value "<security_contact_email@example.com>"


This command will update the security contact email in Microsoft Defender for Cloud. 

Replace <security_contact_email@example.com> with the actual email address of your security team.

Backout Plan:

To revert or remove additional email addresses:

  1. Sign in to the Azure portal with appropriate permissions.

  2. Navigate to Microsoft Defender for Cloud:

    • Go to Microsoft Defender for Cloud in the Azure portal.

  3. Go to Environment Settings:

    • In the Microsoft Defender for Cloud dashboard, click on Environment settings.

  4. Remove Email Address:

    • In the Additional email addresses section, remove the configured security contact email.

  5. Save Settings:

    • Ensure the changes are saved, and the email notifications will no longer be sent to the removed email addresses.

References: