azure-defender-modify-contacts
Write Defender for Cloud security contacts (Microsoft.Security/securityContacts/write); removing or replacing email/phone recipients silences external alert notification delivery out-of-band from the Azure portal, reducing off-portal incident-response triggers.
match (effective permission)
{
"action": "Microsoft.Security/securityContacts/write",
"scope_type": "subscription"
}
where
principal effectively holds Security Admin, Contributor, Owner, or a custom role granting Microsoft.Security/securityContacts/write at subscription scope
emit
| source type | Identity |
|---|---|
| target type | SecurityService |
| source | <principal> |
| target | <Defender security contact node (SecurityService) in the subscription> |
| permissions | Microsoft.Security/securityContacts/write |
| state logic | ACTIVE when the effective permission is confirmed at subscription scope. BLOCKED if a deny assignment covers securityContacts/write at effective scope. NOTE: Impact is narrower than pricings/write or alertsSuppressionRules/write: alerts still appear in the Azure Security Center portal but are not emailed/texted to the configured recipients. Most effective against organizations relying on email notifications as their primary alert channel. This is a DETECTIVE-CONTROL tampering edge; does not affect resource access controls. |
Narrative
{principal.name} can modify Defender for Cloud security contacts for subscription {target.name} (Microsoft.Security/securityContacts/write). Removing or changing the configured email/phone contacts prevents Defender alert notifications from reaching the security team out-of-band, reducing the chance of rapid off-portal incident response for high-severity alerts.
Raw rule rules/derived/azure/defender.yaml
id: azure-defender-modify-contacts
emits: CanModify
description: Write Defender for Cloud security contacts (Microsoft.Security/securityContacts/write); removing
or replacing email/phone recipients silences external alert notification delivery out-of-band from the
Azure portal, reducing off-portal incident-response triggers.
match_effective_permission:
action: Microsoft.Security/securityContacts/write
scope_type: subscription
where:
- principal effectively holds Security Admin, Contributor, Owner, or a custom role granting Microsoft.Security/securityContacts/write
at subscription scope
emit:
source_type: Identity
target_type: SecurityService
source: <principal>
target: <Defender security contact node (SecurityService) in the subscription>
permissions:
- Microsoft.Security/securityContacts/write
conditions: []
state_logic: 'ACTIVE when the effective permission is confirmed at subscription scope. BLOCKED if a
deny assignment covers securityContacts/write at effective scope. NOTE: Impact is narrower than pricings/write
or alertsSuppressionRules/write: alerts still appear in the Azure Security Center portal but are not
emailed/texted to the configured recipients. Most effective against organizations relying on email
notifications as their primary alert channel. This is a DETECTIVE-CONTROL tampering edge; does not
affect resource access controls.'
confidence: 0.92
derived_from:
- HasPermission(Identity, SecurityService:securityContacts, Microsoft.Security/securityContacts/write)
false_positive_note: "securityContacts/write covers creation, modification, and deletion of security\
\ contact records. Security contacts receive email notifications for high-severity Defender alerts\
\ and Azure Security Center recommendations. Removing contacts or changing email addresses to attacker-controlled\
\ addresses silences or redirects these notifications. This does NOT suppress alerts in the portal\
\ \u2014 alerts remain visible to users with portal access. The evasion value is highest for organizations\
\ without portal-based SOC workflows (e.g., those relying on email or SIEM integration driven by email).\
\ Lower blast radius than plan disablement or suppression-rule creation."
narrative: '{principal.name} can modify Defender for Cloud security contacts for subscription {target.name}
(Microsoft.Security/securityContacts/write). Removing or changing the configured email/phone contacts
prevents Defender alert notifications from reaching the security team out-of-band, reducing the chance
of rapid off-portal incident response for high-severity alerts.'