> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Sending Email to Administrators on Alert Is Off

### More Info:

Set Send Me Email About Alerts to On.

### Risk Level

Low

### Address

Security

### Compliance Standards

* Cloudanix Best Practice

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Sending Email to Administrators on Alert Is Off" for Azure using the Azure console, follow these steps:

        1. Log in to the Azure portal.
        2. Navigate to the "Monitor" section from the left-hand side menu.
        3. Click on "Alerts" from the Monitor menu.
        4. Select the alert that needs to be remediated.
        5. Click on the "Edit" button.
        6. In the "Actions" section, click on the "Add action group" button.
        7. In the "Create action group" window, enter a name for the action group.
        8. In the "Actions" section of the "Create action group" window, select "Email/SMS/Push/Voice" as the action type.
        9. In the "Email/SMS/Push/Voice" section, enter the email addresses of the administrators who should receive the alert notifications.
        10. Click on the "OK" button to create the action group.
        11. In the "Actions" section of the alert, select the newly created action group.
        12. Save the changes to the alert.

        After completing these steps, the alert will trigger an email notification to the specified administrators when it is triggered.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Sending Email to Administrators on Alert Is Off" in Azure using Azure CLI, you can follow the below steps:

        Step 1: Open the Azure CLI and login to your Azure account using the command:

        ```
        az login
        ```

        Step 2: Once you are logged in, set the subscription in which the alert is created using the command:

        ```
        az account set --subscription <subscription_id>
        ```

        Step 3: Get the list of all the alert rules configured in the subscription using the command:

        ```
        az monitor metrics alert list-rules --resource-group <resource_group_name>
        ```

        Step 4: Identify the alert rule for which the "Sending Email to Administrators on Alert Is Off" misconfiguration exists.

        Step 5: Update the alert rule to enable sending email to administrators on alert using the command:

        ```
        az monitor metrics alert update --resource-group <resource_group_name> --name <alert_rule_name> --email-service-owners true
        ```

        Step 6: Verify the update by checking the alert rule configuration using the command:

        ```
        az monitor metrics alert show --resource-group <resource_group_name> --name <alert_rule_name>
        ```

        Step 7: Once you have verified the update, the misconfiguration "Sending Email to Administrators on Alert Is Off" would have been remediated.

        Note: In Step 5, replace `<resource_group_name>` with the name of the resource group in which the alert rule is created, `<alert_rule_name>` with the name of the alert rule for which the misconfiguration exists, and `true` with `false` to disable sending email to administrators on alert.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Sending Email to Administrators on Alert Is Off" for Azure using Python, you can follow the below steps:

        Step 1: Import necessary libraries and authenticate to Azure.

        ```python theme={null}
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.monitor import MonitorManagementClient
        from azure.mgmt.monitor.models import ActionGroupPatchBody, EmailReceiver

        subscription_id = '<Subscription ID>'
        client_id = '<Client ID>'
        secret = '<Client Secret>'
        tenant = '<Tenant ID>'

        credentials = ServicePrincipalCredentials(
            client_id=client_id,
            secret=secret,
            tenant=tenant
        )

        monitor_client = MonitorManagementClient(credentials, subscription_id)
        ```

        Step 2: Get the action groups and check if the email receiver is enabled or not.

        ```python theme={null}
        action_groups = monitor_client.action_groups.list()
        for action_group in action_groups:
            if action_group.email_receivers is not None:
                for email_receiver in action_group.email_receivers:
                    if email_receiver.name == 'Administrators':
                        if email_receiver.enabled is False:
                            print('Email receiver for Administrators is disabled')
        ```

        Step 3: Enable the email receiver for the Administrators group.

        ```python theme={null}
        action_group_patch = ActionGroupPatchBody(
            email_receivers=[
                EmailReceiver(
                    name='Administrators',
                    email_address='<Email Address>',
                    use_common_alert_schema=True,
                    enabled=True
                )
            ]
        )

        monitor_client.action_groups.update(
            resource_group_name='<Resource Group Name>',
            action_group_name='<Action Group Name>',
            parameters=action_group_patch
        )
        ```

        Replace the placeholders `<Subscription ID>`, `<Client ID>`, `<Client Secret>`, `<Tenant ID>`, `<Email Address>`, `<Resource Group Name>`, and `<Action Group Name>` with the appropriate values.

        Note: This solution assumes that the action group and email receiver for the Administrators group already exist. If they don't exist, you can create them using the Azure Portal or the Azure SDK for Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_security_center_contact" "security_contact" {
          name  = "CONTACT_NAME"          # e.g. "default1"
          email = "SECURITY_CONTACT_EMAIL" # e.g. "secops@example.com"
          phone = "CONTACT_PHONE_NUMBER"   # optional but recommended

          alert_notifications {
            state           = "On"          # keep as-is if already configured correctly
            minimal_severity = "Minimal"    # set per your policy: "Low" | "Medium" | "High" | "Critical" | "Minimal"
          }

          alerts_to_admins {
            state = "On"                    # THIS enables “Send me email about alerts”
          }
        }
        ```

        This change does not force replacement of the contact; `terraform plan` should show an in-place update changing `alerts_to_admins.state` from `"Off"` to `"On"` (or adding the block if it was missing).
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>