After releasing a Power BI dashboard to follow up on the evolution of your Azure Secure Score (see https://t.co/U1I15FSuBP), you can now get an email notification if your Secure Score is reducing.

The playbook is available for deployment in the Azure Security Center Github repository here https://github.com/Azure/Azure-Security-Center/tree/master/Secure%20Score/Secure%20Score%20Reduction%20Alerts

Connect to the above URL and use the Deploy to Azure button

Then you may be asked to authenticate against your Azure tenant.

Once authenticated, fill up the deployment details as below:

• Select the subscription where the playbook will be deployed
• As well as the resource group
• The region will be set automatically based on the above selection
• Provide the Log Analytics name, resource group and subscription ID
• Update (if needed) the frequency of reviewing the Secure Score and the percentage threshold reduction (meaning if the Secure Score reduces by x%)
• The notification email

Now you can complete the deployment

 

A Logic App called Send-SecureScoreReductionAlert with 2 API Connection called office365 and azuremonitorlogs been deployed.

You then need to grant Reader permission to the subscription(s) you want to get monitored for Secure Score reduction by accessing the Subscription Access Control blade

Then select the Reader role to be assigned to a Logic App and then select the Send-SecureScoreReductionAlert

Then go back to the resource group where the playbook has been deployed to edit the office365 API connection

Access the Edit API connection and then hit the blue ribbon to Authorize the connection; an authentication prompt may appear to ask you to sign in

You should then see a blue notification on top if the authorization has been successful; you can now save the modification

 

Repeat the same with the other API connection azuremonitorlogs

You can review above operations has been successful by accessing the Send-SecureScoreReductionAlert Logic app and then looking at the Run query and list results action available within the For Each loop using the Logic app designer blade; you should see the Connected to azuremonitorlogs information

 

Then you can force an initial run using the Run Trigger

Then if the reduction threshold is reached you will get the following type of notification