Maintain contactable tenant-security addresses alongside Azure alert routing

Source facts

Microsoft advises keeping the contactable email addresses for an organization’s Global Admins, Technical Contacts and Security Admins current and correct. The source says those addresses are used for security issues that affect workloads at the tenant level. Microsoft Learn.

Applicability

Use this review for the contact records responsible for receiving tenant-level Azure security information. Identify the people or governed mailboxes represented by those records and the team responsible for maintaining them. Keep this contact review separate from application-specific action groups and workload incident channels.

DSE recommendation

DSE recommends assigning an owner to periodically reconcile the named contact records with the current response organization. Verify that each address is reachable and monitored through an approved contact test. Include role changes and offboarding in the review triggers. Record the intended escalation route without distributing sensitive tenant administration details unnecessarily.

Verification

Inspect the actual contact values with an authorized administrator and compare them with the approved roster. Document the outcome of a permitted delivery test and identify who will act on a received security notice. Resolve obsolete or unmonitored addresses through the normal identity process. Keep a dated contact-review record rather than assuming a configured Azure alert proves these separate email paths are maintained.

Official references

Microsoft Learn: Security notifications overview.