Enable Email Notification for Alerts

01 Sign in to Azure Management Console.

02 Navigate to Azure Security Center blade at https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/.

03 In the navigation panel, choose Pricing & settings to access your Azure account subscriptions.

04 On Pricing & Settings page, click on the name of the Azure subscription that you want to examine.

05 In the blade navigation panel, choose Email notifications to access the page with the contact information required to receive alert notifications from Microsoft Azure Security Center.

06 In the Notification types section, check the Notify about alerts with the following severity (or higher) setting configuration. If the setting is not active (i.e. it cannot be configured), follow this conformity rule to set at least one security contact email address for Azure Security Center notifications. If Notify about alerts with the following severity (or higher) is unchecked, the "Email Notification for Alerts" security feature is not enabled within the current Azure cloud subscription.

07 Repeat step no. 4 – 6 for each Microsoft Azure subscription available in your account.

01 Run account get-access-token command (Windows/macOS/Linux) using custom query filters to retrieve the "Email Notification for Alerts" security feature configuration status for the selected Azure subscription:

az account get-access-token
	--query "{subscription:subscription,accessToken:accessToken}"
	--out tsv | xargs -L1 bash -c 'curl -X GET -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/securityContacts?api-version=2017-08-01-preview' | jq '.|.value[1]'|jq '.properties.alertNotifications'

02 The command output should return the requested configuration status:

"Off"

03 Repeat step no. 1 and 2 for each Microsoft Azure subscription available in your account.

01 Sign in to Azure Management Console.

02 Navigate to Azure Security Center blade at https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/.

03 In the navigation panel, choose Pricing & settings to access your Azure account subscriptions.

04 On Pricing & Settings page, click on the name of the Azure subscription that you want to examine.

05 In the blade navigation panel, choose Email notifications to access the page with the contact information required to receive alert notifications from Microsoft Azure Security Center.

06 In the Notification types section, check the checkbox next to Notify about alerts with the following severity (or higher) to send email notification for alerts to the email address(es) provided in the Email address configuration box.

07 Click Save to apply the changes. When Azure Security Center detects security breaches inside your Azure cloud account, the subscription administrator(s) will receive alert notifications on the configured security contact email address(es).

08 If required, repeat steps no. 4 – 7 for other Microsoft Azure cloud subscription available.

01 Define the necessary parameters for the account get-access-token command, where alertNotifications configuration attribute is set to On in order to enable the "email notification for alerts" feature. Save the following content to a JSON file named enable-high-severity-alerts.json and replace the highlighted details, i.e. <azure-subscription-id>, <security-email-address> and <security-phone-number>, with your own configuration and contact information:

{
"id":"/subscriptions/<azure-subscription-id>/providers/Microsoft.Security/securityContacts/default1",
   "name":"default1",
   "type":"Microsoft.Security/securityContacts",
   "properties":{
  	"email":"<security-email-address>",
  	"phone":"<security-phone-number>",
  	"alertNotifications": "On",
  	"alertsToAdmins":"On"
   }
}

02 Run account get-access-token command (Windows/macOS/Linux) using the parameters defined at the previous step (i.e. enable-high-severity-alerts.json file) to enable email notification for alerts for the selected Microsoft Azure cloud subscription:

az account get-access-token
	--query "{subscription:subscription,accessToken:accessToken}"
	--out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/securityContacts/default1?api-version=2017-08-01-preview -d@"enable-high-severity-alerts.json"'

03 If successful, the command output should return the updated Security Center configuration policy, e.g.:

{
"id":"/subscriptions/<azure-subscription-id>/providers/Microsoft.Security/securityContacts/default1",
   "name":"default1",
   "type":"Microsoft.Security/securityContacts",
   "properties":{
  	"email":"<security-email-address>",
  	"phone":"<security-phone-number>",
  	"alertNotifications": "On",
  	"alertsToAdmins":"On"
   }
}

04 If required, repeat steps no. 1 – 3 for other Microsoft Azure cloud subscription available.