Microsoft Defender Integration Setup

This guide walks you through integrating Microsoft Defender for Endpoint with RAD Security for unified endpoint detection and response, enabling you to correlate endpoint security events with runtime container and cloud activity. Microsoft Defender for Endpoint provides advanced threat protection, detection, investigation, and response capabilities across your endpoints.

Prerequisites

Before you begin, ensure you have:

Admin access to Azure Portal
An Azure Active Directory (Entra ID) application created
Microsoft Defender for Endpoint subscription
Access to RAD Security workspace with integration permissions

Azure AD Application Required: You must have an Azure Active Directory application created before proceeding. Follow Microsoft’s guide to create an app for Defender API access.

Step 1: Access App Registration

Navigate to App Registrations

Go to Azure Active Directory
Select App registrations
Find and select the application you created for Microsoft Defender API access

Note Application Details

From the application’s Overview page, copy the following values:

Application (client) ID
Directory (tenant) ID

Save these values securely for later configuration.

Step 2: Create Client Secret

Navigate to Certificates & Secrets

In your application, click Certificates & secrets in the left navigation

Create New Secret

Click New client secret
Add a description (e.g., “RAD Security Integration”)
Select an expiration period
Click Add

Save Secret Value

Immediately copy the Secret value that appears

Copy this value now! You will not be able to see the secret value again. If you lose it, you’ll need to create a new secret.

Step 3: Configure API Permissions

Microsoft Defender for Endpoint requires specific API permissions to access security data.

Navigate to API Permissions

In your application, click Manage > API permissions

Add Required Permissions

Click Add a permission and add all the permissions listed below from each API

Required Permissions

Microsoft Threat Protection

API: Microsoft Threat ProtectionPermissions:

Incident.Read - Read incident data
Incident.Read.All - Read all incident data

These permissions allow reading incident and threat information across Microsoft 365 Defender.

WindowsDefenderATP

API: WindowsDefenderATP (Microsoft Defender for Endpoint)Permissions:

AdvancedQuery.Read.All - Run advanced queries
Alert.Read.All - Read all alerts
Machine.Isolate - Isolate machines from network
Machine.Read.All - Read all machine information
Score.Read.All - Read threat and vulnerability scores
Software.Read.All - Read software inventory

These are the core permissions for accessing Defender for Endpoint data including alerts, machines, and threat intelligence.

Application Insights API

API: Application Insights APIPermissions:

Data.Read - Read Application Insights data

Allows reading telemetry and performance data from Application Insights.

Azure Service Management

API: Azure Service ManagementPermissions:

user_impersonation - Access Azure Service Management as organization users

This permission is required for certain administrative operations.

Microsoft Graph

API: Microsoft.GraphPermissions:

Application.Read.All - Read all applications
Device.Read.All - Read all devices

These Graph API permissions provide access to device and application information across Azure AD.

Review Permissions

After adding all permissions, review the list to ensure all required permissions are present

Grant Consent

Click Grant admin consent for [Your Organization]

Admin consent is required! The permissions will not be active until an administrator grants consent.

Verify Status

Verify all permissions show a green checkmark in the Status column

Step 4: Determine API Endpoint URL

Microsoft Defender for Endpoint uses different API endpoints based on your data center location.

Finding Your API Endpoint

Refer to Microsoft’s API endpoint documentation to find the correct endpoint for your region.Common Endpoints:

Region	API Endpoint
United States	`https://api.securitycenter.microsoft.com`
United States 2	`https://api-us2.securitycenter.microsoft.com`
United States 3	`https://api-us3.securitycenter.microsoft.com`
Europe	`https://api-eu.securitycenter.microsoft.com`
United Kingdom	`https://api-uk.securitycenter.microsoft.com`
Australia	`https://api-au.securitycenter.microsoft.com`
US GCC	`https://api-gcc.securitycenter.microsoft.us`
US GCC High	`https://api-gov.securitycenter.microsoft.us`

Use the base endpoint URL without the /api/ path. For example: https://api-us3.securitycenter.microsoft.com

Step 5: Configure in RAD Security

Navigate to your RAD Security workspace and configure the Microsoft Defender integration with the following parameters:

Required Parameters

Parameter	Description	Example
Base URL	Base endpoint URL for your region (without `/api/`)	`https://api-us3.securitycenter.microsoft.com`
Client Id	Application (client) ID from Step 1	`11111111-1111-1111-1111-111111111111`
Client Secret	Client secret value from Step 2	`your-secret-value-here`
Tenant ID	Directory (tenant) ID from Step 1	`00000000-0000-0000-0000-000000000000`

Important: The URL must be the base endpoint without the /api/ path. Incorrect: https://api.securitycenter.microsoft.com/api/ - Correct: https://api.securitycenter.microsoft.com

Verify Integration

After completing the setup, verify your integration is working:

Navigate to Data Sources > Integrations > EDR in RAD Security
Locate your Microsoft Defender integration
Check the connection status shows as Connected
Verify security events are being synced

Your Microsoft Defender for Endpoint integration is now configured! RAD Security can now correlate endpoint security data with container and cloud runtime events.

What Data is Synced

Once configured, RAD Security will sync the following data from Microsoft Defender:

Alerts & Incidents

Security alerts and detections
Incident data and timeline
Alert severity and status
Investigation states
Automated investigation results

Endpoint Information

Machine inventory
Device health status
Operating system details
Network information
Onboarding status
Risk scores

Threat Intelligence

Threat and vulnerability scores
Exposure scores
Software vulnerabilities
Security recommendations
Attack surface reduction data

Software Inventory

Installed software
Software versions
Vulnerability associations
End-of-life software detection

Advanced Hunting

Custom query results
Historical security data
Behavioral analytics
Threat hunting insights

Use Cases

Unified Threat Detection

Correlate endpoint threats with container and cloud runtime activity for comprehensive threat detection.

Cross-Platform Response

Trigger coordinated response actions across endpoints and cloud workloads when threats are detected.

Container Escape Detection

Identify when compromised containers attempt to affect or escape to the host system.

Lateral Movement Tracking

Track attacker movement across endpoints and containerized infrastructure.

Troubleshooting

Authentication Failed

Possible causes:

Client ID, Tenant ID, or Client Secret is incorrect
Client secret has expired
Application registration was deleted

Solution:

Verify all credentials are copied correctly
Check client secret expiration date
Ensure the Azure AD application still exists
Verify Tenant ID matches your Azure directory

Insufficient Permissions

Possible causes:

Required API permissions not granted
Admin consent not provided
Missing permissions from one or more APIs

Solution:

Review all 5 API sections and verify all permissions are present
Ensure permissions are Application type, not Delegated
Click “Grant admin consent” if any permissions show “Not granted”
Wait a few minutes for permissions to propagate after granting consent

Wrong API Endpoint

Possible causes:

Using incorrect regional endpoint
Including /api/ in the URL
Typo in the endpoint URL

Solution:

Verify your Defender data center location
Check Microsoft’s endpoint documentation
Ensure URL does NOT end with /api/
Common mistake: https://api.securitycenter.microsoft.com/api/ (wrong) vs https://api.securitycenter.microsoft.com (correct)

No Data Syncing

Possible causes:

No devices onboarded to Defender
Defender subscription not active
Initial sync still in progress
Regional endpoint mismatch

Solution:

Verify devices are onboarded to Microsoft Defender for Endpoint
Check Defender subscription status
Allow up to 15 minutes for initial data sync
Confirm you’re using the correct regional API endpoint
Review integration logs in RAD Security for specific errors

Permission Scope Issues

Possible causes:

Application permissions instead of delegated (or vice versa)
Permissions granted but consent not admin-approved
Cached permission state

Solution:

Verify permissions are Application type for service-to-service
Ensure admin consent is granted (not just added)
Try revoking and re-granting admin consent
Clear browser cache or try in incognito mode

Security Best Practices

Rotate Secrets Regularly

Set short expiration periods for client secrets and rotate before expiry to maintain security.

Least Privilege Access

Only grant the minimum required permissions. Remove unused permissions to reduce attack surface.

Monitor API Usage

Regularly review API calls and application sign-ins to detect anomalous activity.

Secure Credential Storage

Store client secrets in a secure vault. Never commit credentials to version control.

Track Expiration Dates

Set reminders for client secret expiration to prevent service disruptions.

Separate Applications

Create dedicated applications for different integrations rather than reusing the same app.

Getting Started

Platform

Data Sources

Security & Compliance

Resources

Microsoft Defender

Microsoft Defender Integration Setup

Prerequisites

Step 1: Access App Registration

Step 2: Create Client Secret

Step 3: Configure API Permissions

Required Permissions

Step 4: Determine API Endpoint URL

Step 5: Configure in RAD Security

Required Parameters

Verify Integration

What Data is Synced

Use Cases

Unified Threat Detection

Cross-Platform Response

Container Escape Detection

Lateral Movement Tracking

Troubleshooting

Security Best Practices

Rotate Secrets Regularly

Least Privilege Access

Monitor API Usage

Secure Credential Storage

Track Expiration Dates

Separate Applications

Additional Resources

Create Defender API App

Defender API Endpoints

Next Steps

EDR Integrations Overview

Runtime Security

Alerts & Incidents

Microsoft Entra ID

Getting Started

Platform

Data Sources

Security & Compliance

Resources

​Microsoft Defender Integration Setup

​Prerequisites

​Step 1: Access App Registration

​Step 2: Create Client Secret

​Step 3: Configure API Permissions

​Required Permissions

​Grant Admin Consent

​Step 4: Determine API Endpoint URL

​Step 5: Configure in RAD Security

​Required Parameters

​Verify Integration

​What Data is Synced

​Use Cases

Unified Threat Detection

Cross-Platform Response

Container Escape Detection

Lateral Movement Tracking

​Troubleshooting

​Security Best Practices

Rotate Secrets Regularly

Least Privilege Access

Monitor API Usage

Secure Credential Storage

Track Expiration Dates

Separate Applications

​Additional Resources

Create Defender API App

Defender API Endpoints

​Next Steps

EDR Integrations Overview

Runtime Security

Alerts & Incidents

Microsoft Entra ID

Microsoft Defender Integration Setup

Prerequisites

Step 1: Access App Registration

Step 2: Create Client Secret

Step 3: Configure API Permissions

Required Permissions

Grant Admin Consent

Step 4: Determine API Endpoint URL

Step 5: Configure in RAD Security

Required Parameters

Verify Integration

What Data is Synced

Use Cases

Troubleshooting

Security Best Practices

Additional Resources

Next Steps