Search documentation

Purpose The Defender for Endpoint connector pulls device risk score, vulnerability, EDR alert and onboarding status via the Microsoft Graph Security API, feeding endpo…

…vileged account detection SecurityEvents.Read.All Identity Protection risk detections, where licensed Admin consent required These are application permissions, which require tena…

…lnerability exposure (Spotlight), where licensed Falcon-assigned host risk indicators Security model The API client is restricted to Read-only scopes and cannot trigger contain…