Need to add defender alert notification for an email address through powershell as we have multiple subscriptions.

Question

Hi,

We want to add Microsoft defender notification through powershell as we have multiple subscriptions on diff tenants. Either by powershell or partner centre powershell . Attaching screenshot -

Already read the article - https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-email-notifications

Answer 1

Hello

The PowerShell module Az.Security contains the cmdlet Set-AzSecurityContact. This would allow to to use the switch parameter -NotifyOnAlert, though this doesn't allow you to specify the minimum severity.

If you wanted to specify the severity, you can invoke the rest API using PowerShell. Here is an example using a single subscription, though you may want to modify for your needs

Connect-AzAccount -Subscription $SubscriptionId

$SubscriptionId = "00000000-0000-0000-0000-000000000000"
$Method = "PUT"
$URI = "https://management.azure.com/subscriptions/$SubscriptionId/providers/Microsoft.Security/securityContacts/default?api-version=2020-01-01-preview" 
$Body = @'
{
    "properties": {
        "notificationsByRole": {
            "state": "On",
            "roles": [
                "Owner",
                "ServiceAdmin"
            ]
        },
        "emails": "john@contoso,com",
        "phone": "",
        "alertNotifications": {
            "state": "On",
            "minimalSeverity": "Medium"
        }
    }
}
'@

Invoke-AzRestMethod  -Method $Method -Uri $URI -Payload $Body
    

I hope this helps provide you with the information you need. If it does, please make sure to mark the question as answered so it helps other people in future.

Kind regards

Alistair