This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(12.8, 85%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMP%3C/text%3E%3C/svg%3E)
Hello Team,
Greetings!!
I would like to understand if there is any solution for below requirement?
How to create a logic app that will send an email notification to respective business stakeholders(Resource/Subscription owners based on tags), if Microsoft defender for cloud creates/trigger specific MDC recommendation?
Ex:- I want my logic app to send an email notification about SQL database vulnerability findings to be resolved. So whenever if there were any new recommendations from this I need to send an auto notification to team.
I understand we might have governance rules for this ask but wondering if there is logic app deployment as well. Please advise me on this?
Thank you.
Hi @Future Kortor ,
Hope you are doing well.
Do you have solution for above requirement. I could see somehow you have developed the similar log for Key vault alerts.
Looking forward to hearing from you.
Thank you.
The following article explains part of the solution. Logic apps have a connector for Office365 email.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation
MDFC also has a built-in assignment feature: https://learn.microsoft.com/en-us/azure/defender-for-cloud/governance-rules
Hi @Andrew Blumhardt ,
Thanks for responding to this.
I have created the governance rule and assigned to owner on a specific recommendation, however it doesn't get notified to owner even after waiting for a month almost.
Besides this I have also got confirmation from Microsoft support engineer saying that governance rules have some expected bugs, and they were in preview state currently.
Please suggest us, if there is any other alternative for this.
Thank you.
There is a logic app trigger for MDFC recommendations. I am not certain if it provides the specific SQL recommendation name but I think it should at least provide the device name and recommendation URL.
The hard part may be finding the owner based on the device name and tag. If that data is in a log analytics workspace it would be a fairly simple query. It might be possible to query AAD. The best source would be the Azure Resource Graph but I am not certain if that is accessible from a logic app. You need a table of devices and users that you can query.
General outline:
When recommendation is created
Where Name contains "SQL"
Lookup the device owner
Email the device owner that a new recommendation is available along with the URL
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(201.6, 66%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERK%3C/text%3E%3C/svg%3E)
Can you please help me with the name of logic app trigger for MDFC recommendations?
Yes, I am also looking for the same scenario where we want to create a logic app policy json for email notification if any scan results or recommendations Microsoft defender for cloud triggers or create any?
Anyone help me over here?