Skip to main content

Microsoft Defender for Endpoint

Visualize Microsoft Defender for Endpoint resources, map Defender users to employees, and monitor changes through queries and alerts.

Installation​

To use this integration, you must have:

  • An Azure account with an App Registration that provides credentials for JupiterOne to authenticate with Microsoft Graph and Microsoft Defender for Endpoint APIs.
  • An Active Directory tenant to target for data ingestion. The tenant can be the same one that hosts the App Registration or a separate one.
  • A Microsoft Defender for Endpoint subscription that includes the devices and vulnerability data you want to ingest.

Configuration in Microsoft Defender for Endpoint​

In the Azure Portal — create the App Registration

  1. Navigate to App Registrations.
  2. Click New registration.
  3. Enter a name for the app (for example, JupiterOne).
  4. Select the supported account type for your organization.
  5. Click Register.

Add API permissions​

In your new app registration, go to API permissions under Manage in the left panel.

  1. If the app already has the User.Read permission, remove it — it is not needed for this integration.
  2. Click Add a permission > Microsoft Graph.
  3. Select Application permissions and add:
    • Organization.Read.All
    • Directory.Read.All
  4. Click Add permissions.
  5. Click Add a permission again.
  6. Under APIs my organization uses, search for WindowsDefenderATP and click the result.
  7. Select Application permissions and add:
    • Machine.Read.All
    • User.Read.All
    • Vulnerability.Read.All
  8. Click Add permissions.
  9. Click Grant admin consent and confirm.

Create a client secret

  1. In your app registration, click Certificates & secrets.
  2. Under Client secrets, click New client secret.
  3. Add a description and choose an expiration that fits your secret-rotation policy.
  4. Click Add.
  5. Copy the Value immediately using the copy icon — the full value is not shown again after you navigate away.
API permissions reference​

Microsoft Graph

PermissionPurpose
Organization.Read.AllRead organization information; required to create the Account entity
Directory.Read.AllRead directory data; required to create User entities

WindowsDefenderATP

PermissionPurpose
Machine.Read.AllRead device information; required to create Device and Endpoint entities
User.Read.AllRead user profiles; required to create logon-user entities
Vulnerability.Read.AllRead Threat and Vulnerability Management data; required to create Vulnerability and Finding entities

Configuration in JupiterOne​

Navigate to the Integrations tab, select Microsoft Defender for Endpoint, and click New Instance.

Creating an instance requires the following credentials from your Azure App Registration:

  • Application (client) ID — The application client ID created for JupiterOne, used to authenticate with Azure. Find this on your App Registration's Overview tab.

  • Directory (tenant) ID — The tenant ID of the Active Directory to target in Azure API requests. Also found on your App Registration's Overview tab.

  • Application (client) Secret — The client secret value you copied in the previous step. This field is masked after entry; paste the value before closing the Azure Portal tab.

Click Create to finish.

Next steps​

Once configured, the integration will run on the polling interval you set, populating data in JupiterOne. See the Instance management guide for more on managing integration instances.