Email notification for high severity alerts should be enabled

What does the recommendation "Email notification for high severity alerts should be enabled" check?

Flags any subscription where Microsoft Defender for Cloud has no security contact configured to email someone when a high severity alert fires. Specifically it checks that under Environment settings the 'Notify about alerts with the following severity (or higher)' option is enabled and set to High, and that at least one recipient role or explicit email address is defined on the subscription's securityContacts object. It is a per-subscription check, so a contact set on one subscription does not satisfy the control for another. It does not check whether anyone actually reads those emails, whether the mailbox forwards or filters them, whether the alerts also route into a SIEM or ticketing system, or whether lower severity alerts notify anyone at all.

Why does "Email notification for high severity alerts should be enabled" matter?

Defender for Cloud can detect a high severity event, an active credential compromise, a deployed coin miner, mass data exfiltration, but the detection is worthless if it lands in a console nobody is watching. Without an email contact the clock between the alert and a human response stretches from minutes to whenever someone next happens to open the portal, and that gap is exactly when an attacker pivots, escalates and establishes persistence. The same contact details are also how the Microsoft Security Response Centre reaches your team if it spots an issue from its side, so an empty contact silences two warning channels at once. Configuring a notified recipient is the cheapest control here to close, and it converts silent detections into something a duty engineer can triage. The business consequence of leaving it unset is measured not in the cost of the fix but in the extra hours an incident runs undetected before anyone notices.

How do I fix "Email notification for high severity alerts should be enabled"?

1. In Defender for Cloud go to Environment settings, select the subscription, open Email notifications, tick 'Notify about alerts with the following severity (or higher)' and set the level to High, then add recipient roles (Owner is the default) or specific addresses separated by commas and Save.
2. Prefer a monitored distribution list or shared on-call inbox over a single named person, so notifications survive someone leaving or being on holiday.
3. Set this once per subscription at scale by deploying the Microsoft.Security/securityContacts resource through Bicep or Azure Policy (built-in policy 'Email notification for high severity alerts should be enabled', definition 6e2593d9-add6-4083-9c9b-4b7d2188c899) so new subscriptions inherit it automatically.

# Set a monitored security contact and enable High-severity alert emails
# on the current subscription. --alert-notifications and --notifications-by-role
# take a JSON object, not a bare string; the role list lives inside that object.
az security contact create \
  --name default \
  --emails "[email protected]" \
  --alert-notifications '{"state":"On","minimalSeverity":"High"}' \
  --notifications-by-role '{"state":"On","roles":["Owner"]}'

# Apply it across every subscription you can see.
for sub in $(az account list --query "[].id" -o tsv); do
  az account set --subscription "$sub"
  az security contact create --name default \
    --emails "[email protected]" \
    --alert-notifications '{"state":"On","minimalSeverity":"High"}'
  echo "$sub: security contact set, high-severity alerts on"
done

# Ratchet it shut: audit any subscription missing a contact email.
az policy assignment create \
  --name audit-security-contact \
  --policy 4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7 \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"