Email notification for Microsoft Defender for Azure Not Sent to Additional email address

Josh Davidson 0 Reputation points
2023-01-19T01:17:25.1566667+00:00

I received an email alert from Microsoft Defender, but only because I was an owner of the account and Owners were a notification group. My Additional email addresses list did not receive any of the emails. Why, what is the purpose of that list if it doesn't work.

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,492 questions
{count} votes

2 answers

Sort by: Most helpful
  1. Marilee Turscak-MSFT 37,141 Reputation points Microsoft Employee
    2023-01-20T21:08:19.4333333+00:00

    Hi Josh Davidson,

    I agree that the Additional email recipients should also receive the alerts.

    I have often seen the alerts get blocked before for people who had spam filters on their emails, so they should make sure to check their spam and junk sections. If possible, the receivers should also make sure that they allow the sender of azure-noreply@microsoft.com. If the users have any email security products, or if you have any conflicting email application rules, the alerts may also get blocked.

    If you have already checked for all of those variables, another consideration is whether the right severity level of the incident for those recipients. You can also do a detection test from the page where you download the onboarding package script at security.microsoft.com to confirm.

    [https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-email-notifications?view=o365-worldwide#troubleshoot-email-notifications-for-alerts

    Let me know if this helps. If the users still face this issue I'll be happy to troubleshoot over email.

    -

    If the information helped you, please Accept the answer. This will help us and also improve discoverability for others in the community who might be researching similar issues.


  2. Marilee Turscak-MSFT 37,141 Reputation points Microsoft Employee
    2023-01-20T22:43:23.82+00:00

    Hi Josh Davidson ,

    To help me to scope this situation better, would you please send me a screenshot of your email configuration and the full blade where you have configured these settings? (AzCommunity@Microsoft.com "Attn: Marilee Turscak")

    If you set up Email notifications for the "Security Alerts" blade, it will not send notifications for Recommendations, and recommendation-based alerts need to be set up separately via workflow automation with a Logic App. https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation

    Other things to check:

    -You can remove them via the Portal, save, and re-add to see if the emails work after that.

     Once I get the screenshots I can better determine if this could be an issue on our end or if this is configuration-related.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.