---
title: "Microsoft Defender Connector Guide"
slug: "microsoft-defender-v2"
updated: 2026-10-22T15:02:22Z
published: 2026-10-22T15:02:22Z
canonical: "docs.safe.security/microsoft-defender-v2"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safe.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Defender Connector Guide

Microsoft Defender (formerly Microsoft Defender ATP) enables enterprises to prevent, detect, investigate, and respond to advanced threats. The **Balbix integration with Microsoft Defender** ingests assets and associated vulnerabilities discovered by Microsoft Defender.

Balbix leverages AI to aggregate, normalize, and deduplicate ingested data, along with information integrated from your existing IT and cybersecurity tools. This creates a unified view of your entire asset inventory, including vulnerabilities and their business and operational context. Balbix’s AI models then analyze this data to provide insights such as deployment gap analysis, risk-based vulnerability prioritization (with detailed ranking and scoring), and risk quantification. This process delivers a comprehensive assessment of risk, whether for a single asset, groups of assets, or your entire enterprise, enabling more informed and effective security decisions.

## Integration summary

This table provides a summary of the Balbix integration for the Microsoft Defender connector.

| **Integration Type** | **Fetch**: An inbound API integration used to retrieve IT infrastructure assets and associated vulnerabilities discovered by MS Defender. |
| --- | --- |
| **Types of Assets Fetched** | Host devices, including servers, virtual machines, desktops, and laptops. |
| **Types of Data Fetched** | Asset names, hardware information, interface information (IP address), software information, vulnerabilities information, all relevant timestamps such as *first observed* and *last observed*. Secure Configuration Assessments – current control status (passed or failed) and last observed timestamp for each assessment. |

## Prerequisites

To configure the Balbix connector, you must first create Microsoft Defender API credentials with the appropriate permissions. These credentials are required for completing the configuration process. `

1. **Register an app**: Set up an application in Microsoft Azure for connector integration.
2. **Add API permissions**: Specify the APIs the app can access.
3. **Add auth permissions and assign roles**: Ensure the app has the appropriate roles for data access.
4. **Create an API key**: Generate an API key to authenticate the app with Balbix.

### **Register an app**

To create an app registration:

1. Log in to the MS Azure portal and select **Microsoft Entra ID** from the left navigation panel.
2. On the Overview page, click **+ Add** and select **App Registration**.
3. Enter the registration information for your application.
  - **Name**: Balbix
  - **Supported account types**: Accounts in any organizational directory (Any Microsoft Entra ID tenant – Multitenant)
  - (Optional) **Redirect URI**: Specify if desired
4. Click **Register** to create the registration application.
5. On the Overview page, copy the **application ID** and the **directory ID** and save them in a safe place to use later when configuring the Balbix connector.

### **Add API permissions**

Add API permissions after you have registered the Balbix app:

1. Under **Manage** on the Balbix App Registration page, select **API Permissions** then click **+ Add a permission**.
2. On the Request API permissions page, select the **APIs my organization uses** tab.
3. You must add permissions from two applications: **WindowsDefenderATP** and **Microsoft Graph**.
  - Select **WindowsDefenderATP** and add permissions:

| Type | Permission Name |
| --- | --- |
| Application | Machine.Read.All |
| Vulnerability.Read.All |
| Software.Read.All |
| User.Read.All |
| AdvancedQuery.Read.All |
| SecurityRecommendation.Read.All |
| Delegated | AdvancedQuery.Read |
4. Click **All APIs** to return to the Request API Permissions page.
  - Select **Microsoft Graph** and add permissions:

| Type | Permission Name |
| --- | --- |
| Application | Directory.Read.All |
5. Click **Grant admin consent** **for Default Directory** to apply the permissions.

### **Add auth permissions and roles**

To generate an API key, ensure that roles are assigned and the necessary permissions are added.

1. In the MS Azure portal, go to **Subscriptions**.
2. Choose the subscription where you want to create the custom role.
3. Go to the **Access Control (IAM)** tab and select **Roles**.
4. Click **Add > Add Custom Role**.
5. Enter a custom role name and description.
6. Click the **Permissions** tab, then click **+ Add Permissions** to open the Add permissions panel.
7. In the **Search for a permission** field, search for the permissions listed below:
  - Microsoft.AppConfiguration/configurationStores/ListKeyValue/action
  - Microsoft.Web/sites/config/list/Action
  - Microsoft.Storage/storageAccounts/queueServices/queues/read
  - Microsoft.Network/networkWatchers/queryFlowLogStatus/action
  - Microsoft.ContainerService/managedClusters/listClusterUserCredential/action
  - Microsoft.ContainerService/managedClusters/listClusterMonitoringUserCredential/action
8. Click the permission card that displays after your search, then click the checkboxes for the individual permissions as they are listed.
9. Click **Review + create**.
10. In the Access control (IAM) page, click the **Role assignments** tab to view the role assignments.
11. Click **Add > Add role assignment**.
12. In the **Role** tab, assign both your newly created **custom IAM role** and **Reader** role for the registered Balbix app service.

### **Create a Client Secret**

To generate a client secret from Microsoft Defender:

1. Go to Microsoft Entra ID, click **App registrations** and select the **Balbix** application.
2. Select **Certificates & secrets > Client secrets > New client secret**.
3. Provide a description for your client secret and set an expiration date or specify a custom duration.
4. Click **Add**.
5. Copy the client secret and save to a safe place for use later when configuring Microsoft Defender in Balbix.

> [!WARNING]
> **Caution:** Be sure to copy and save the client secret—it will no longer be visible after you leave the page.

## Set up your MS Defender connector

After you have completed the prerequisites, follow these steps to create and configure your Balbix connector for MS Defender.

[Embedded content](https://scribehow.com/embed/Microsoft_Defender_Connector_Guide__96Mdt1MESoCTdiZON6_TqQ?as=scrollable)

### Controls Information

In addition to ingesting asset and vulnerability data from Microsoft Defender, the integration now supports retrieving secure configuration assessments on a per-device basis. The connector will pull controls information that includes the current assessment status—indicating whether each control has passed or failed—and the last observed timestamp when the assessment was updated. This enhancement provides a real-time view of each device’s secure configuration compliance, enabling a more comprehensive security posture assessment and helping organizations quickly identify and remediate configuration issues.

## API reference documentation

To learn more about the Microsoft Defender API, see the references listed below:

- [Microsoft 365 Defender XDR Incidents API](https://learn.microsoft.com/en-us/microsoft-365/security/defender/api-incident?view=o365-worldwide)
- [Access the Microsoft Defender for Endpoint APIs](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api/apis-intro?view=o365-worldwide)