Skip to main content

Microsoft Defender for Endpoint

Microsoft Defender for Endpoint

  • By SAFE Security
  • Published: Oct 14, 2026
  • Rating
    Average rating: 0 No reviews

Outline

Introduction

This document provides step-by-step instructions to configure the Microsoft Defender for Endpoint (Defender For Endpoint) integration in SAFE.

This integration ingests endpoint assets, installed software, OS details, CVE vulnerabilities, secure configuration assessments, CIS/Microsoft baseline benchmark results, device tags (static and dynamic), device type and subtype, and cloud placement metadata for cloud-hosted endpoints. SAFE admin can configure this integration from the "Microsoft Defender for Endpoint" card available on the SAFE Platform Integrations page.

How SAFE processes Defender For Endpoint data:

SAFE uses AI to aggregate, normalise and deduplicate the ingested data from Defender For Endpoint, along with information from your existing IT and cybersecurity tools. This creates a unified view of your entire asset inventory, including vulnerabilities and their operational and business context.

What SAFE Imports from Microsoft Defender for Endpoint

Assets Endpoints onboarded to Defender For Endpoint (workstations, laptops, servers, VMs) across Windows, macOS, and Linux.
Data Device names, IP/MAC addresses (multi-NIC), OS details, agent version, device type and subtype, static and dynamic tags, cloud placement metadata for cloud-hosted endpoints, software inventory (CPE and non-CPE), CVE vulnerabilities with affected software and fix IDs, secure configuration assessments, CIS/Microsoft baseline benchmark results.
Findings CVE vulnerabilities, secure configuration assessment results, and baseline benchmark compliance results. Defender For Endpoint alerts, incidents, and security recommendations are not ingested.

Prerequisites and Permissions

Before configuring the Microsoft Defender for Endpoint integration, ensure the following prerequisites are met:

  1. A Microsoft Entra ID tenant with Microsoft Defender for Endpoint Plan 2 or Microsoft 365 E5 Security licensing, with devices onboarded to Microsoft Defender for Endpoint.
  2. Permissions to create an app registration in Microsoft Entra ID and grant tenant-wide admin consent for the required WindowsDefenderATP application permissions.
  3. Outbound HTTPS connectivity from SAFE to the following endpoints:
    1. Microsoft Entra ID authentication endpoint: login.windows.net
    2. Microsoft Defender for Endpoint API endpoint for your tenant’s geographic region: api.securitycenter.microsoft.com
    3. Microsoft Defender XDR Advanced Hunting API endpoint: api.security.microsoft.com
    4. Azure Blob Storage endpoints used to serve bulk-export files

Additional Prerequisites for Baseline Benchmark Findings

Baseline compliance is a premium capability. All the following requirements must be met. If any requirement is missing, the benchmark export may return an HTTP 403 response or an empty response body. In this scenario, SAFE may report that the synchronization completed successfully but import no benchmark findings.

  1. Defender Vulnerability Management add-on

The tenant must have the Microsoft Defender Vulnerability Management add-on. Defender for Endpoint Plan 2 alone does not include security-baseline assessments. Defender for Endpoint Plan 1 does not satisfy this requirement.

  1. Defender for Endpoint Plan 2 license for the administrator

The administrator configuring the baseline profile must have a Defender for Endpoint Plan 2 license assigned to their user account, in addition to the Defender Vulnerability Management add-on. The account must also have a usage location configured. Without the underlying Plan 2 license, the Defender portal does not allow the administrator to create a baseline profile.

  1. Required application permission

The app registration must have the SecurityBaselinesAssessment.Read.All application permission, with tenant-wide admin consent granted. For configuration instructions, see Section 3.3.

  1. Active baseline profile and matching Windows device

An active baseline profile must exist in the Microsoft Defender portal, and at least one onboarded Windows device must match the profile.

Supported benchmarks include:
- CIS benchmarks for Windows 10, Windows 11, and Windows Server 2008 R2 or later
- STIG benchmarks for Windows 10 and Windows Server 2019

The selected compliance level must match the device role. For example, a standalone workgroup server must use the Member Server profile rather than the Domain Controller profile.

Generate Connection Details

To integrate SAFE with Defender for Endpoint, you need the following details:

  • Login URL (e.g. https://login.windows.net)
  • Tenant ID (Azure AD Directory ID)
  • Client ID (App Registration Application ID)
  • Client Secret
  • Resource (e.g. https://api.securitycenter.microsoft.com)

Below is a step-by-step guide to generate these details:

Register an application in Azure AD

  1. Log in to the Azure Portal as an administrator.
  2. Navigate to Microsoft Entra ID > App registrations > New registration.
  3. Enter a name (e.g. "SAFE Integration") and select Single tenant.
  4. Click Register.
  5. From the app Overview page, copy the Application (client) ID and the Directory (tenant) ID.

Create a client secret

  1. In the app registration, go to Certificates & secrets > New client secret.
  2. Enter a description and an expiry (recommended: 12 months).
  3. Click Add and copy the secret Value immediately. It is not shown again.

Grant API permissions

  1. In the app registration, go to API permissions > Add a permission.
  2. Select APIs my organization uses and search for WindowsDefenderATP.
  3. Select Application permissions and add:
    • Machine.Read.All
    • Software.Read.All
    • Vulnerability.Read.All
    • SecurityBaselinesAssessment.Read.All
    • AdvancedQuery.Read.All
  4. Click Grant admin consent for the tenant.

Add the permissions under the WindowsDefenderATP API.

Notes on permissions:

  • SecurityConfiguration.Read.All is not required, despite the name. The secure configuration assessment export is served under Vulnerability.Read.All.
  • Without AdvancedQuery.Read.All, the sync still succeeds. The Advanced Hunting call answers 403, SAFE logs it and continues. Those devices keep their static tags only, and carry no device type or subtype.
  • You can verify the granted permissions by decoding the roles claim of the access token. No API call is needed.

Get the Login URL and Resource

The Resource value must match your tenant's Defender geo. SAFE does not auto-detect it. Using the wrong host returns authentication errors or empty data.

Cloud / geo Login URL Resource
Commercial (default) https://login.windows.net https://api.securitycenter.microsoft.com
Commercial — US / EU / UK geo aliases https://login.windows.net https://api-us.securitycenter.microsoft.com, https://api-eu.securitycenter.microsoft.com, or https://api-uk.securitycenter.microsoft.com
US Government (GCC-High / DoD) The sovereign Azure AD login host for your cloud https://api-gov.securitycenter.microsoft.us or https://api-gcc.securitycenter.microsoft.us

Leaving either field blank applies the commercial default. SAFE derives the Advanced Hunting host from the Resource value, so a government tenant hunts inside its own cloud and its device IDs never reach the commercial endpoint.

Configure Defender for Endpoint Integration in SAFE

After completing the prerequisites, follow these steps to configure the connector in the SAFE Platform:

  1. Sign in to SAFE as an administrator and select Integrations from the left navigation menu.
  2. Select the + icon in the upper-right corner of the page.
  3. Search for and select Microsoft Defender for Endpoint.
  4. Enter a unique and descriptive Integration Name.
  5. Enter the following connection details:
    • Login URL
    • Client ID
    • Client Secret
    • *Resource *
    • Tenant ID
  6. Configure the optional settings as required:
    • API Filters: Enter an OData filter to control which devices are ingested into SAFE. For example: osPlatform eq 'Windows11'.
    • Asset Last Seen (Days): Enter the maximum number of days since an asset was last observed. Assets not seen within this period are excluded from ingestion.
    • Auto-Sync Frequency: Specify how often, in days, SAFE should automatically synchronize data from Microsoft Defender for Endpoint.
    • Ingest Vulnerabilities: Select this checkbox to ingest CVE findings.
    • Include All Software Inventory: Enable this option to ingest the complete software inventory, including software with and without CPE identifiers. When disabled, SAFE skips both software inventory exports and surfaces software information only through associated CVE findings.
  7. Select Test Connection to validate the credentials and confirm connectivity.
  8. After the connection is successfully verified, select Save.
  9. Select Sync Now to initiate an on-demand synchronization.

View Results

To view the assets and the assessment result:

  1. From the SAFE Integrations page, click on the Microsoft Defender for Endpoint card.
  2. A page with "Finding View" and "Asset View" tabs will open up.
  3. Finding View will contain all the CVE vulnerabilities, secure configuration assessments, and baseline benchmark findings pulled from Defender For Endpoint.
  4. Asset View will list all the endpoint assets pulled/updated from Defender For Endpoint.

API Details

The Defender For Endpoint connector uses REST APIs, async bulk export APIs, and one Advanced Hunting query. The five export APIs return SAS-signed Azure Blob URLs, not data. The bulk rows arrive as gzip NDJSON from a separate blob download.

API Method Endpoint
Machines GET /api/machines
Software Inventory Export (CPE) GET /api/machines/SoftwareInventoryExport
Software Inventory Export (non-CPE) GET /api/machines/SoftwareInventoryNonCpeExport
Vulnerabilities Export GET /api/machines/SoftwareVulnerabilitiesExport
Secure Configurations Export GET /api/machines/SecureConfigurationsAssessmentExport
Baseline Compliance Export GET /api/machines/BaselineComplianceAssessmentExport
Baseline Configurations GET /api/baselineConfigurations
Export Blob Download GET <sas blob url>
Advanced Hunting POST /api/advancedqueries/run on https://api.security.microsoft.com

Limitations

The following fields are available from the Defender For Endpoint APIs but are deliberately not mapped into SAFE today.

  • Device attributes: osBuild, riskScore, exposureLevel, deviceValue, lastExternalIpAddress, RbacGroupName.
  • Vulnerability attributes: per-CVE description, CVSS vector, published date, and EPSS score. These come from /api/vulnerabilities, which this connector does not call.
  • Assessment attributes: SecurityUpdateAvailable, NumberOfWeaknesses, EndOfSupportStatus, and the baseline RecommendedValue / CurrentValue pair.
  • Defender For Endpoint alerts, incidents, and security recommendations are not ingested at all.
  • IPv6 addresses are filtered out of the multi-NIC interface list. Only IPv4 addresses are stored.
  • Software install paths and usernames are mapped, but Defender For Endpoint rarely populates them. They are empty for non-Windows software.

FAQs

Q: How frequently does SAFE sync data from Defender For Endpoint?

A: Sync frequency depends on the Auto Sync configuration. Default is every 7 days. You can also trigger an on-demand sync at any time.

Q: Does the integration support incremental / delta sync?

A: No. Every run is a full fetch of devices and full exports of software, vulnerabilities, and controls.

Q: Test Connection fails with "no machines were returned"?

A: The tenant has no devices onboarded to Defender For Endpoint, or the app lacks Machine.Read.All. Onboard at least one device and grant admin consent, then retest.

Q: Test passes but fewer assets than expected after sync?

A: Test Connection does not apply your filters, so it can pass while the sync scope is empty. Check the Asset last seen days filter (default 30 days) and any custom API Filters. Only devices with onboardingStatus = Onboarded and healthStatus = Active inside the last-seen window are ingested, unless your own filter overrides those two clauses.

Q: Why does SAFE show fewer software entries than the Defender For Endpoint portal?

A: Include All Software Inventory is disabled by default. In that mode, software is surfaced only through CVE findings. Enable the toggle to ingest the full inventory.

Q: The sync reports success but there are no baseline benchmark findings.

A: Export lanes are isolated, so a missing baseline licence or permission does not fail the sync. Check all four baseline prerequisites listed in the Prerequisites section: the DVM add-on, a Plan 2 seat on the administrator's own account, SecurityBaselinesAssessment.Read.All with admin consent, and an active baseline profile with a matching Windows device. Note also that Defender For Endpoint builds the baseline export file roughly once a day. A newly created profile produces no rows until that batch runs, and SAFE cannot force it.

Q: Why are there no baseline findings for macOS or Linux endpoints?

A: Security baselines assessment is Windows-only in Defender For Endpoint. Non-Windows devices still contribute assets, software, CVEs, and secure configuration assessments.

Q: Secure configuration findings are far fewer than the rows Defender For Endpoint exports.

A: SAFE drops rows where Defender For Endpoint reports IsApplicable = false. Those controls do not apply to the device, so they carry no compliance signal.

Q: Dynamic (rule-based) tags are not appearing on assets?

A: Grant AdvancedQuery.Read.All to the Azure app and re-sync. Note that Advanced Hunting retains about 30 days of device data. Devices with no recent DeviceInfo record get static tags only.

Q: Assets have no device type or subtype.

A: Device type and subtype also come from Advanced Hunting, using the same call as dynamic tags. Grant AdvancedQuery.Read.All and re-sync. An empty subtype on a device that has a type is normal — Defender For Endpoint populates the subtype only when device discovery resolves it.

Q: Cloud fields are empty on some assets.

A: Cloud placement is read from the Defender For Endpoint vmMetadata field, which Defender For Endpoint returns only for cloud-hosted endpoints. It is null for on-premises and physical hosts, and every cloud field is then empty.

Q: How are duplicate assets handled?

A: Each device is keyed by its Defender For Endpoint machine GUID within the integration. Across integrations, SAFE matches assets on fqdn and assetName by default.

Q: How to reduce sync time?

A: Keep Include All Software Inventory off, disable Ingest Vulnerabilities if CVEs are not needed, and tighten the Asset last seen days filter. Note the export APIs always export data for all onboarded machines. Scoping applies at the device level.

Q: Can historical data be re-ingested?

A: Yes. Every sync performs a full fetch of devices and full exports of software, vulnerabilities, and controls. Simply trigger a new sync.

Q: Does the integration support sovereign clouds (GCC-High)?

A: Yes. Override the Login URL and Resource fields with the sovereign endpoints listed in section 3.4. SAFE derives the Advanced Hunting host from the Resource value, so device IDs stay inside the sovereign cloud.

Q: The sync fails with "Invalid Authorization payload" or Unauthorized part-way through.

A: Defender For Endpoint access tokens last one hour. This message, when it carries a Validity: range, is an expired token rather than a permissions problem. Check clock skew on the caller before re-investigating consent.

To check sync status and errors for this integration, see Integration History.

Did this article help?

Let us know by leaving a star rating at the top of this article.