Critical risk level email received but none found on microsoft defender for cloud.

Hey Cedric, thanks for sharing the screenshots – I can see why it’s confusing to get a “Critical risk level” email and yet see 0 critical recommendations in the Defender for Cloud portal. Here’s what’s most likely happening:

1. Two different “risks”
   • Defender for Cloud has security recommendations (CSPM) on the Recommendations page (that’s why you see “Environment risk: 0 Critical recommendations”).
   • Separately, it surfaces attack paths (or high-severity alerts) under the Attack paths or Alerts blades in the portal. Those also drive email notifications when you’ve enabled them.
2. The email you’re getting is about a potential attack path (or high-severity alert), not a CSPM recommendation. By default Defender for Cloud will send a “Critical risk level” email when a critical attack path is found, even if you currently have no critical recommendations.
3. How to verify in the portal
   • Go to Threat management → Attack path analysis (or Alerts) in the portal and filter by Critical risk/High severity. You’ll see the same finding there that triggered the email.
   • If you want only CSPM recommendation emails (and not attack paths), head into Environment settings → [Your subscription] → Email notifications, then uncheck Attack paths or set the “Notify about attack paths” threshold higher.
4. Next steps
   • Review the “Attack paths” blade to see the details of that critical finding.
   • Adjust your email notification settings so that you only receive the categories you care about (recommendations vs. alerts vs. attack paths).

References

• Configure Microsoft Defender for Cloud email notifications for security alerts and attack paths https://learn.microsoft.com/azure/defender-for-cloud/configure-email-notifications
• Security recommendations and risk levels overview https://learn.microsoft.com/azure/defender-for-cloud/security-recommendations#risk-levels-and-calculation
• How to view and investigate attack paths https://learn.microsoft.com/en-gb/azure/defender-for-cloud/how-to-manage-attack-path