Defender for Cloud keeps notifying me of nothing

Question

Defender for Cloud keeps notifying me of nothing

Jonah Bader 105

Every day I get emails from Microsoft Security alerting me of critical risks like the following. User's image When I click the link, I get brought to a page that shows the attack path, as well as the recommended remediation. Notice the "0 active recommendations."

When I open the Remediation tab, the only remediation listed is "Machines should have vulnerability findings resolved". Clicking that item brings me to this final page: User's image

Status is completed, Attack Paths shows 0, and there are no Findings in the right pane. It says the last change date was 10/5, but I receive this critical risk email every day. (and I have 2 resources that are doing this).

What am I missing, or what needs to change? I already know how to remove myself from the emails, but I still want to get them when there is an actual risk detected. Any advice for fixing my environment?

Answer accepted by question author

0 additional answers

Your answer

Answer 1

SUNOJ KUMAR YELURU 16,851 MVP Volunteer Moderator

Hello @Jonah Bader

To follow How to Fix :

Run these steps in the Azure Portal:

Go to Microsoft Defender for Cloud → Recommendations
Filter by Affected resources = [the ones triggering the emails]
Look for any recommendations in Healthy or Completed state that still show as Recently changed
Manually dismiss or mark as resolved

Run these steps in the Azure Portal:

Go to Microsoft Defender for Cloud → Recommendations
Filter by Affected resources = [the ones triggering the emails]
Look for any recommendations in Healthy or Completed state that still show as Recently changed
Manually dismiss or mark as resolved

Check Automation Rules

If you’re using Microsoft Sentinel or Defender for Cloud’s Workflow Automation:

Check Workflow automation → Rules
See if there’s a rule that triggers email for all alerts regardless of state

If the Answer is helpful, please click Accept Answer and Up-Vote, so that it can help others in the community looking for help on similar topics.

Jonah Bader 105 Reputation points

2025-10-09T14:23:33.4266667+00:00
Thanks for the quick comment! I do see some recommendations for this resource in the Microsoft Defender for Cloud menu. These are all listed as low risk or not evaluated, some are completed, and I don't see any indicator of 'Recently changed', so I guess my questions are this:

Are these low-risk items what is causing the alert?

Why does the alert classify this as a critical risk?
SUNOJ KUMAR YELURU 16,851 Reputation points MVP Volunteer Moderator

2025-10-11T10:22:01.5666667+00:00

Hi @@Jonah Bader

The low-risk items seen in the Defender for Cloud menu are likely recommendations (suggestions for improvement). Critical alerts are usually triggered by high-severity findings or specific threat patterns, meaning the low-risk items are probably not the direct cause of the critical alert.

The system is likely configured to send a daily digest of active risks. If the underlying configuration or finding that triggered the critical alert has not been fully remediated or explicitly suppressed, the alert engine will re-trigger the notification daily, even if the initial alert instance was marked "Completed."

To fix the environment and receive alerts only when a new risk occurs, you must identify the specific Alert ID from the daily email. Use this ID to investigate the exact finding that triggered the critical alert. Then, either fully remediate the underlying high-severity finding or use the "Suppress" or "Mark as False Positive" function associated with that specific alert type to prevent future notifications for those two resources, while keeping the general alert mechanism active for other resources.

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.

Share via

Defender for Cloud keeps notifying me of nothing

0 additional answers

Your answer