Skip to main content

Microsoft Defender for Endpoint - User Guide

In this article, you will understand step by step how to easily integrate with Microsoft Defender for Endpoint

Microsoft Defender for Endpoint is Microsoft's enterprise endpoint detection and response platform. It inventories managed machines, raises security alerts, and surfaces software vulnerabilities across your endpoint fleet.

Microsoft 365 and Microsoft Defender users can connect using Azure AD

Required Permissions

  • Machine.Read.All

  • Alert.Read.All

  • Vulnerability.Read.All

Scytale follows the least-privilege principle, limiting permission scopes strictly to what's required for reliable audit evidence collection.

How to Connect

  1. In Scytale, go to 'Integrations'.

  2. Search for Microsoft Defender and select 'Connect'.

  3. Paste your directory (tenant) ID, application (client) ID & client secret value.

  4. Add a connection name — this will be used to differentiate between your connections — and then select 'Connect'.

    Note: No Subscription ID is required — Defender is tenant-scoped.

You have now successfully connected to Microsoft Defender.

How to Generate Credentials in Microsoft Defender

  1. Log in to the Azure portal and go to Microsoft Entra ID.

  2. In the left menu, select 'App registrations' and then 'New registration'.

  3. Enter a name for the application — for example, scytale-defender — set the supported account types to 'Accounts in this organizational directory only (Single tenant)', and then select 'Register'.

  4. On the application's 'Overview' page, copy the application (client) ID and the directory (tenant) ID.

  5. In the application, go to 'Certificates & secrets' and select 'New client secret'.

  6. Enter a description, set an expiry — 24 months is recommended — and then select 'Add'.

  7. Copy the secret 'Value', not the 'Secret ID'.

    Note: The secret value is displayed only once. Be sure to copy it before leaving the page.

  8. Go to 'API permissions', select 'Add a permission', open the 'APIs my organization uses' tab, and choose 'WindowsDefenderATP'.

  9. Select 'Application permissions' and add the three permissions listed under Required Permissions above.

  10. Select 'Grant admin consent' for your directory.

    Note: Without admin consent, the integration fails validation with 403, or with a 200-and-empty-list that Scytale also treats as install-blocking.

Related Articles
Did this answer your question?