2.3.1 Ensure That 'All users with the following roles' is set to 'Owner'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Enable security alert emails to subscription owners.

Rationale:

Enabling security alert emails to subscription owners ensures that they receive security alert emails from Microsoft. This ensures that they are aware of any potential security issues and can mitigate the risk in a timely fashion.

Solution

From Azure Portal

From Azure Home select the Portal Men

Select Microsoft Defender for Cloud

Click on Environment Settings

Click on the appropriate Management Group, Subscription, or Workspace

Click on Email notifications

In the drop down of the All users with the following roles field select Owner

Click Save

From Azure CLI
Use the below command to set Send email also to subscription owners to On.

az account get-access-token --query '{subscription:subscription,accessToken:accessToken}' --out tsv | xargs -L1 bash -c 'curl -X PUT -H 'Authorization: Bearer $1' -H 'Content-Type: application/json' https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/securityContacts/default1?api-version=2017-08-01-preview -d@'input.json''

Where input.json contains the Request body json data as mentioned below.
And replace validEmailAddress with email ids csv for multiple.

{
'id': '/subscriptions/<Your_Subscription_Id>/providers/Microsoft.Security/securityContacts/default1',
'name': 'default1',
'type': 'Microsoft.Security/securityContacts',
'properties': {
'email': '<validEmailAddress>',
'alertNotifications': 'On',
'alertsToAdmins': 'On',
'notificationsByRole': 'Owner'
}
}

Default Value:

By default, Owner is selected

See Also

https://workbench.cisecurity.org/files/4052