Skip to main content

​
Connect Microsoftdefender Account

Follow these simple steps to complete the setup modal and securely integrate your Microsoftdefender environment for AI-driven analysis.

​
1. Basic Configuration Follow below steps

  1. Once you logged in you will navigate to Dashboard.
  2. Go to the integration and click on Connect button to add Microsoftdefender Datasource.
  3. Enter Account Name (e.g., Production-Microsoftdefender).
  4. Environment: Click the dropdown menu and select the environment type (e.g., Production, Staging, Development).
  5. Enter Tenant ID .(Click on view guide to generate TenantId).
  6. Enter Client ID .(Click on view guide to generate ClientId).
  7. Enter Client Secret .(Click on view guide to generate ClientSecret).
  8. Click On Verify Integration Button.
  9. Click On Connect Button.

​
Microsoft Defender Integration — Credential Setup Guide

Zero-X connects to Microsoft Defender through a Microsoft Entra ID (Azure AD) App Registration using the OAuth 2.0 client credentials flow. This integration supports Alerts, Inventory, and Vulnerability scanning.You need three credentials to configure the datasource. All fields are required, and Zero-X verifies them before saving the datasource.

​
Credential Details

​
Prerequisites

Before configuring the integration, ensure the following requirements are met:
  • Microsoft Defender for Endpoint is licensed and devices are onboarded.
  • Defender Vulnerability Management is available if vulnerability data is required.
  • You have an account with permission to create app registrations.
  • You have an account authorized to grant admin consent, such as a Global Administrator, Privileged Role Administrator, or Cloud Application Administrator.

​
Step 1: Register a Microsoft Entra ID Application

  1. Open the Microsoft Entra admin center.
  2. Navigate to Identity → Applications → App registrations.
  3. Click + New registration.
  4. Enter an application name, for example, ZeroX-Defender-Integration.
  5. Select Accounts in this organizational directory only (Single tenant).
  6. Leave the Redirect URI field empty.
  7. Click Register.
After registration, the application’s Overview page will open.

​
Step 2: Copy the Application Credentials

From the application’s Overview page, copy the following values:
  • Application (client) ID — used as the Client ID.
  • Directory (tenant) ID — used as the Tenant ID.
Keep these values available for the Zero-X datasource configuration.

​
Step 3: Create a Client Secret

  1. Open the registered application.
  2. Navigate to Certificates & secrets.
  3. Under Client secrets, click + New client secret.
  4. Enter a description and select an appropriate expiration period.
  5. Click Add.
  6. Copy the secret’s Value immediately.
Important: The client secret Value is displayed only once. Do not copy the Secret ID. Store the Value securely and never expose it in source code, logs, or public documentation.

​
Step 4: Configure API Permissions

Add the following Application permissions to the registered application.

​
Add Microsoft Graph Permissions

  1. Navigate to API permissions in the application.
  2. Click + Add a permission.
  3. Select Microsoft Graph.
  4. Choose Application permissions.
  5. Search for and select SecurityAlert.Read.All.
  6. Click Add permissions.

​
Add WindowsDefenderATP Permissions

  1. Under API permissions, click + Add a permission.
  2. Select APIs my organization uses.
  3. Search for and select WindowsDefenderATP.
  4. Choose Application permissions.
  5. Add the following permissions:
    • Machine.Read.All
    • Software.Read.All
    • Vulnerability.Read.All
  6. Click Add permissions.
If WindowsDefenderATP does not appear, verify that Microsoft Defender for Endpoint is provisioned in the tenant. Open the Microsoft Defender portal as an administrator, then search for the API again.

​
Optional Permission

The following Microsoft Graph permission may be used as a fallback for connection verification if the alerts API call fails:
  • DeviceManagementManagedDevices.Read.All
This permission is optional. It does not provide full alert ingestion by itself.
  1. Open the application’s API permissions page.
  2. Click Grant admin consent for [Your Tenant].
  3. Confirm the consent request.
  4. Verify that each required permission displays Granted.
Admin consent must be granted for the required application permissions before Zero-X can access the relevant APIs.Allow a few minutes for the permission changes to propagate.Note: The permissions listed in this guide are intended for read-only access to the specified data. Ensure that the final permission set matches your organization’s security policies and integration requirements.