Email notification to subscription owner for high severity alerts should be enabled

What does the recommendation "Email notification to subscription owner for high severity alerts should be enabled" check?

Flags any subscription whose Defender for Cloud security contact does not route high severity alerts to people holding the Owner role. It inspects the per-subscription security contact configuration and specifically the 'notify by role' setting (the Owner role toggle) together with the minimal severity threshold, not the free-text email list. A subscription that emails a named security mailbox but has the Owner role notification switched off still flags, as does one where the Owner role is notified but only for Low or Medium alerts. The control does not verify that anyone actually opens the mail, that the listed addresses are valid, or that attack path notifications are configured, and it says nothing about whether the underlying Defender plans are switched on.

Why does "Email notification to subscription owner for high severity alerts should be enabled" matter?

Defender for Cloud can detect a live intrusion, a compromised identity or data being exfiltrated in progress, but a detection nobody sees only buys the attacker time. If high severity alerts never reach the subscription owner, the person with the authority to isolate a resource or revoke a credential learns of the breach from a customer, a regulator or the press instead of from Azure. The gap is usually silent: the alert fires, sits in the portal, and is found days later during a post-incident review. Routing alerts to the Owner role rather than to a single inbox means notifications survive staff turnover, mailbox renames and out-of-office gaps, which is precisely when slow incident response turns a contained event into a reportable breach with regulatory deadlines attached.

How do I fix "Email notification to subscription owner for high severity alerts should be enabled"?

1. In the portal, open Microsoft Defender for Cloud, go to Environment settings, select the subscription, then Email notifications, and under 'Notify the following email recipients' tick the Owner role and set 'Notify about alerts with the following severity (or higher)' to High.
2. To script it, set the security contact: az security contact create -n 'default' --notifications-by-role '{"state":"On","roles":["Owner"]}' --alert-notifications '{"state":"On","minimalSeverity":"High"}'
3. To enforce it across subscriptions, assign the built-in audit policy by its display name so you never paste a GUID by hand: pid=$(az policy definition list --query "[?displayName=='Email notification to subscription owner for high severity alerts should be enabled'].name" -o tsv); az policy assignment create --name notify-owner-high-alerts --policy "$pid" --scope /subscriptions/<subscription-id>

# Set a monitored security contact and enable High-severity alert emails
# on the current subscription. --alert-notifications and --notifications-by-role
# take a JSON object, not a bare string; the role list lives inside that object.
az security contact create \
  --name default \
  --emails "[email protected]" \
  --alert-notifications '{"state":"On","minimalSeverity":"High"}' \
  --notifications-by-role '{"state":"On","roles":["Owner"]}'

# Apply it across every subscription you can see.
for sub in $(az account list --query "[].id" -o tsv); do
  az account set --subscription "$sub"
  az security contact create --name default \
    --emails "[email protected]" \
    --alert-notifications '{"state":"On","minimalSeverity":"High"}'
  echo "$sub: security contact set, high-severity alerts on"
done

# Ratchet it shut: audit any subscription missing a contact email.
az policy assignment create \
  --name audit-security-contact \
  --policy 4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7 \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"