Microsoft Defender
Configure Microsoft Defender for Endpoint integration with RAD Security for comprehensive endpoint security.
This guide walks you through integrating Microsoft Defender for Endpoint with RAD Security for unified endpoint detection and response, enabling you to correlate endpoint security events with runtime container and cloud activity.
Microsoft Defender for Endpoint provides advanced threat protection, detection, investigation, and response capabilities across your endpoints.
Prerequisites
Before you begin, ensure you have:
- Admin access to Azure Portal
- An Azure Active Directory (Entra ID) application created
- Microsoft Defender for Endpoint subscription
- Access to RAD Security workspace with integration permissions
Azure AD Application Required: You must have an Azure Active Directory application created before proceeding. Follow Microsoft's guide to create an app for Defender API access.
Step 1: Access App Registration
Log in to Azure Portal
Log in to the Azure Portal with administrative privileges
Navigate to App Registrations
- Go to Azure Active Directory
- Select App registrations
- Find and select the application you created for Microsoft Defender API access
Note Application Details
From the application's Overview page, copy the following values:
- Application (client) ID
- Directory (tenant) ID
Save these values securely for later configuration.
Step 2: Create Client Secret
Navigate to Certificates & Secrets
In your application, click Certificates & secrets in the left navigation
Create New Secret
- Click New client secret
- Add a description (e.g., "RAD Security Integration")
- Select an expiration period
- Click Add
Save Secret Value
Immediately copy the Secret value that appears
Copy this value now! You will not be able to see the secret value again. If you lose it, you'll need to create a new secret.
Step 3: Configure API Permissions
Microsoft Defender for Endpoint requires specific API permissions to access security data.
Navigate to API Permissions
In your application, click Manage > API permissions
Add Required Permissions
Click Add a permission and add all the permissions listed below from each API
Required Permissions
Grant Admin Consent
Review Permissions
After adding all permissions, review the list to ensure all required permissions are present
Grant Consent
Click Grant admin consent for [Your Organization]
Admin consent is required! The permissions will not be active until an administrator grants consent.
Verify Status
Verify all permissions show a green checkmark in the Status column
Step 4: Determine API Endpoint URL
Microsoft Defender for Endpoint uses different API endpoints based on your data center location.
Step 5: Configure in RAD Security
Navigate to your RAD Security workspace and configure the Microsoft Defender integration with the following parameters:
Required Parameters
| Parameter | Description | Example |
|---|---|---|
| Base URL | Base endpoint URL for your region (without /api/) | https://api-us3.securitycenter.microsoft.com |
| Client Id | Application (client) ID from Step 1 | 11111111-1111-1111-1111-111111111111 |
| Client Secret | Client secret value from Step 2 | your-secret-value-here |
| Tenant ID | Directory (tenant) ID from Step 1 | 00000000-0000-0000-0000-000000000000 |
Important: The URL must be the base endpoint without the /api/ path. Incorrect: https://api.securitycenter.microsoft.com/api/ - Correct: https://api.securitycenter.microsoft.com
Verify Integration
After completing the setup, verify your integration is working:
- Navigate to Data Sources > Integrations > EDR in RAD Security
- Locate your Microsoft Defender integration
- Check the connection status shows as Connected
- Verify security events are being synced
Your Microsoft Defender for Endpoint integration is now configured! RAD Security can now correlate endpoint security data with container and cloud runtime events.
What Data is Synced
Once configured, RAD Security will sync the following data from Microsoft Defender:
Use Cases
Unified Threat Detection Correlate endpoint threats with container and cloud runtime activity for comprehensive threat detection.
Cross-Platform Response Trigger coordinated response actions across endpoints and cloud workloads when threats are detected.
Container Escape Detection Identify when compromised containers attempt to affect or escape to the host system.
Lateral Movement Tracking Track attacker movement across endpoints and containerized infrastructure.
Troubleshooting
Security Best Practices
Rotate Secrets Regularly Set short expiration periods for client secrets and rotate before expiry to maintain security.
Least Privilege Access Only grant the minimum required permissions. Remove unused permissions to reduce attack surface.
Monitor API Usage Regularly review API calls and application sign-ins to detect anomalous activity.
Secure Credential Storage Store client secrets in a secure vault. Never commit credentials to version control.
Track Expiration Dates Set reminders for client secret expiration to prevent service disruptions.
Separate Applications Create dedicated applications for different integrations rather than reusing the same app.
Additional Resources
Create Defender API App
Microsoft's guide to creating an app for Defender API access
Defender API Endpoints
Complete list of regional API endpoints