Azure Compliance ControlsMicrosoft Defender for Cloud
Security contacts should have attack path email notifications enabled at the configured minimum risk level
Checks that Microsoft Defender for Cloud sends attack path email notifications for each subscription, with a minimal risk level defined. The notification setting must be present and its configured risk level must meet the required threshold.
What this control checks
Attack path email notifications are enabled with a minimal risk level that meets the threshold.
Framework mappings
The clauses this control is mapped to in each framework.
- 9.1.15 Ensure that 'Notify about attack paths with the following risk level (or higher)' is enabled
- 8.1.15 Ensure that 'Notify about attack paths with the following risk level (or higher)' is enabled
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- OPS-05.01B System components under the cloud service provider's responsibility that are used to operate the cloud service in the production environment are configured with malware protection according to the policies and instructions.
- 164.308(a)(6)(i) Security incident procedures
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_defender_attack_path_notifications_properly_configured - Prowler Check:
defender_attack_path_notifications_properly_configured
Last reviewed: 2026-10-11