What this check looks at
Checks that Microsoft has current addresses to notify when a security or compliance issue affects the tenant.
Every Microsoft 365 tenant has two sets of contact addresses on its organisation object in Microsoft Entra ID: the technical notification addresses, which Microsoft uses for service and technical notices about the tenant, and the security and compliance notification addresses, which Microsoft uses when it needs to tell the organisation about a security or compliance issue affecting it. Both are set when the tenant is created, usually to whoever signed up, and are rarely looked at again.
The check passes when both the technical contacts and the security and compliance notification addresses are filled in. It warns when only one of the two is set, and fails when neither is, because Microsoft then has nowhere to send a security notice. It cannot tell whether an address is still read; that needs a person to check.
When the address belongs to someone who has left, a former reseller or a mailbox nobody opens, notices about a compromised account, an incident on Microsoft’s side that touched the tenant’s data, or a change needing action go unread. Nobody exploits this directly, but it lengthens the time between something going wrong and anyone at the organisation knowing.
Why it matters
Microsoft sends breach and service-security notices to these addresses. If they point at a departed administrator, the organisation finds out about an incident from somebody else.
When Microsoft needs to tell a customer about a security incident affecting its tenant, it uses these contacts as well as the Microsoft 365 admin centre. A small business whose contact is a departed IT manager’s address finds out from a customer or a news story weeks later, after the window to act has passed.
Every day between an issue and anyone knowing adds to the cost: more mail read, more fraudulent messages sent, and less of the UK GDPR 72-hour window left for reporting a personal data breach to the ICO. Fixing the contacts takes minutes and costs nothing.
CIS Controls v8 17.2 asks organisations to establish and maintain contact information for reporting security incidents, and ISO 27001 A.5.5 (contact with authorities) and A.5.24 (incident management planning and preparation) expect clear routes for security information to reach the right people. NIST CSF 2.0 RS.CO-02 and NCSC CAF D1.a (response plan) make the same point from the response side.
How to fix it
Where: Microsoft 365 admin centre → Settings → Org settings → Organization profile
Before you start
- Create or choose a monitored shared mailbox or distribution list for security notices.
Step by step
- Choose a monitored mailbox that accepts external mail. Create or pick a shared mailbox or distribution list that at least two people read, such as security@ on the client’s domain, or your own monitored address if you run their security. If it is a distribution list, in the Microsoft 365 admin centre open Teams & groups > Active teams & groups, select the list and, on its Settings tab, allow people outside the organisation to email it, because Microsoft’s notices come from outside.
- Set the technical contact in Microsoft Entra ID. In the Microsoft Entra admin centre, go to Entra ID > Overview > Properties (Identity > Overview > Properties in older menus). Enter the monitored address in Technical contact, check Global privacy contact and Privacy statement URL are current, and select Save. The same technical contact appears in the Microsoft 365 admin centre under Settings > Org settings > Organisation profile.
- Set the security and compliance addresses in PowerShell. The security and compliance notification addresses are easiest to set with Microsoft Graph PowerShell. Run Connect-MgGraph -Scopes Organization.ReadWrite.All, then $org = Get-MgOrganization, then Update-MgOrganization -OrganizationId $org.Id -SecurityComplianceNotificationMails @("security@contoso.com") -TechnicalNotificationMails @("security@contoso.com"), using the client’s real address.
- Send service notices to the same place. While in the Microsoft 365 admin centre, add the same address under Health > Service health > Customise > Email, and under Health > Message centre > Preferences > Email, so outage and change notices reach it too. These are not part of this check, but they are the other half of the same problem.
- Confirm the contacts and test the mailbox. Run Get-MgOrganization | Format-List TechnicalNotificationMails, SecurityComplianceNotificationMails and check both show the monitored address. Send a message to it from an external mailbox to prove it arrives and someone reads it. The next assessment passes when both fields are set.
What users will notice
None.
How to confirm it worked
Microsoft 365 admin centre, Settings, Org settings, Organization profile: technical and security contacts point to the list.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | D1.a Response plan |
| DSPT | Standard 6: Responding to incidents |
| DORA | Art. 17 ICT-related incident management process |
| NIS2 | Art. 21(2)(b) Incident handling |
| Microsoft Cloud Security Benchmark | IR-2 Preparation: set up incident notification |
| SOC 2 | CC7.4 Responding to security incidents |
| PCI DSS 4.0.1 | 12.10.1 An incident response plan exists and is ready to be activated |
| NIST SP 800-171 | 3.6.1 Establish an operational incident-handling capability |
| CMMC Level 2 | IR.L2-3.6.1 Incident Handling |
| ISO 27001:2022 | A.5.5 Contact with authoritiesA.5.24 Information security incident management planning and preparation |
| CIS Controls v8.1 | 17.2 Establish and maintain contact information for reporting security incidents (IG1) |
| NIST CSF 2.0 | RS.CO-02: Internal and external stakeholders are notified of incidents |
| NCSC 10 Steps | Incident management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Organization profile (Microsoft Learn)