> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zero-x.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoftdefender Account

# Connect Microsoftdefender Account

Follow these simple steps to complete the setup modal and securely integrate your Microsoftdefender environment for AI-driven analysis.

## 1. Basic Configuration Follow below steps

1. Once you logged in you will navigate to **Dashboard**.

2. Go to the integration and click on **Connect** button to add Microsoftdefender Datasource.

3. Enter **Account Name** (e.g., Production-Microsoftdefender).

4. **Environment**: Click the dropdown menu and select the environment type (e.g., Production, Staging, Development).

5. Enter **Tenant ID** .(Click on view guide to generate TenantId).

6. Enter **Client ID** .(Click on view guide to generate ClientId).

7. Enter **Client Secret** .(Click on view guide to generate ClientSecret).

8. Click On Verify Integration Button.

9. Click On Connect Button.

<Accordion title="📖 View Setup Guide">
  # Microsoft Defender Integration — Credential Setup Guide

  Zero-X connects to Microsoft Defender through a Microsoft Entra ID (Azure AD) App Registration using the OAuth 2.0 client credentials flow. This integration supports **Alerts, Inventory, and Vulnerability scanning**.

  You need three credentials to configure the datasource. All fields are required, and Zero-X verifies them before saving the datasource.

  ## Credential Details

  | Zero-X Field | API Field | Where to Find It |
  | - | - | - |
  | Tenant ID | `defenderTenantId` | App registration → Overview → Directory (tenant) ID |
  | Client ID | `defenderClientId` | App registration → Overview → Application (client) ID |
  | Client Secret | `defenderClientSecret` | App registration → Certificates & secrets → Client secret Value |

  ## Prerequisites

  Before configuring the integration, ensure the following requirements are met:

  * Microsoft Defender for Endpoint is licensed and devices are onboarded.
  * Defender Vulnerability Management is available if vulnerability data is required.
  * You have an account with permission to create app registrations.
  * You have an account authorized to grant admin consent, such as a Global Administrator, Privileged Role Administrator, or Cloud Application Administrator.

  ## Step 1: Register a Microsoft Entra ID Application

  1. Open the [Microsoft Entra admin center](https://entra.microsoft.com/).
  2. Navigate to **Identity → Applications → App registrations**.
  3. Click **+ New registration**.
  4. Enter an application name, for example, `ZeroX-Defender-Integration`.
  5. Select **Accounts in this organizational directory only (Single tenant)**.
  6. Leave the Redirect URI field empty.
  7. Click **Register**.

  After registration, the application's Overview page will open.

  ## Step 2: Copy the Application Credentials

  From the application's Overview page, copy the following values:

  * **Application (client) ID** — used as the Client ID.
  * **Directory (tenant) ID** — used as the Tenant ID.

  Keep these values available for the Zero-X datasource configuration.

  ## Step 3: Create a Client Secret

  1. Open the registered application.
  2. Navigate to **Certificates & secrets**.
  3. Under **Client secrets**, click **+ New client secret**.
  4. Enter a description and select an appropriate expiration period.
  5. Click **Add**.
  6. Copy the secret's **Value** immediately.

  **Important:** The client secret Value is displayed only once. Do not copy the Secret ID. Store the Value securely and never expose it in source code, logs, or public documentation.

  ## Step 4: Configure API Permissions

  Add the following **Application permissions** to the registered application.

  | Feature | API | Required Permission |
  | - | - | - |
  | Alerts | Microsoft Graph | `SecurityAlert.Read.All` |
  | Inventory and Vulnerability | WindowsDefenderATP | `Machine.Read.All` |
  | Inventory and Vulnerability | WindowsDefenderATP | `Software.Read.All` |
  | Vulnerability | WindowsDefenderATP | `Vulnerability.Read.All` |

  ### Add Microsoft Graph Permissions

  1. Navigate to **API permissions** in the application.
  2. Click **+ Add a permission**.
  3. Select **Microsoft Graph**.
  4. Choose **Application permissions**.
  5. Search for and select `SecurityAlert.Read.All`.
  6. Click **Add permissions**.

  ### Add WindowsDefenderATP Permissions

  1. Under **API permissions**, click **+ Add a permission**.
  2. Select **APIs my organization uses**.
  3. Search for and select **WindowsDefenderATP**.
  4. Choose **Application permissions**.
  5. Add the following permissions:
     * `Machine.Read.All`
     * `Software.Read.All`
     * `Vulnerability.Read.All`
  6. Click **Add permissions**.

  If WindowsDefenderATP does not appear, verify that Microsoft Defender for Endpoint is provisioned in the tenant. Open the [Microsoft Defender portal](https://security.microsoft.com/) as an administrator, then search for the API again.

  ### Optional Permission

  The following Microsoft Graph permission may be used as a fallback for connection verification if the alerts API call fails:

  * `DeviceManagementManagedDevices.Read.All`

  This permission is optional. It does not provide full alert ingestion by itself.

  ## Step 5: Grant Admin Consent

  1. Open the application's **API permissions** page.
  2. Click **Grant admin consent for \[Your Tenant]**.
  3. Confirm the consent request.
  4. Verify that each required permission displays **Granted**.

  Admin consent must be granted for the required application permissions before Zero-X can access the relevant APIs.

  Allow a few minutes for the permission changes to propagate.

  **Note:** The permissions listed in this guide are intended for read-only access to the specified data. Ensure that the final permission set matches your organization's security policies and integration requirements.
</Accordion>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.