Microsoft Defender for Endpoint

Purpose

The Defender for Endpoint connector pulls device risk score, vulnerability, EDR alert and onboarding status via the Microsoft Graph Security API, feeding endpoint vulnerability and detection controls alongside the Microsoft 365 identity connector.

Requirements

• Microsoft Defender for Endpoint Plan 1 or 2 licensing
• An Entra ID app registration with Microsoft Graph Security API application permissions
• Global Administrator or Security Administrator to grant admin consent

Permissions

• SecurityEvents.Read.All — read alerts and secure score
• Machine.Read.All — read device inventory, risk score and onboarding status
• Vulnerability.Read.All — read discovered vulnerabilities per device
• TIIndicators.Read.All — optional, read threat intelligence indicators

Setup

1. 1
   Register or reuse the app

   Use the same Entra ID app registration as Microsoft 365, or create a dedicated one for Defender.
2. 2
   Add Defender API permissions

   Add the WindowsDefenderATP or Microsoft Graph Security application permissions listed above.
3. 3
   Grant admin consent

   Grant tenant-wide admin consent as a Global or Security Administrator.
4. 4
   Connect in AssurIQ

   In Integrations, connect Defender for Endpoint and select the tenant.
5. 5
   Confirm onboarding coverage

   Verify the connector reports which endpoints are onboarded versus unmanaged.

Verification

• Endpoint risk scores and onboarding status appear under Vulnerability Center
• EDR alerts populate alongside vulnerability findings
• Onboarding coverage gap report matches the known device fleet

Data collected

• Device risk score and exposure level
• Onboarding and health status per device
• Discovered vulnerabilities and missing patches per device
• EDR alerts and their severity and status

Security model

The connector uses application permissions scoped strictly to read access on security and device data; it cannot isolate devices, run response actions or change policy. Tokens are issued via OAuth 2.0 client credentials and refreshed automatically.

Common errors

• AIQ-INT-MS-003Microsoft permission missing
  The Entra ID app registration lacks a required Graph permission, so identity and MFA evidence is incomplete.
• AIQ-INT-001Integration disconnected
  The connector token expired or was revoked. Data from this system is stale.

Troubleshooting

• If onboarding status looks incomplete, confirm the app registration was granted Machine.Read.All specifically, not only SecurityEvents.Read.All.
• If vulnerability data lags, allow up to 24 hours for Defender's own vulnerability management engine to refresh.

Disconnect

1. Disconnect Defender for Endpoint from AssurIQ Integrations.
2. Remove the Defender API permissions from the app registration if it is not shared with Microsoft 365.
3. Endpoint detection controls move to EVIDENCE GAP on the next cycle.