Microsoft Defender for Endpoint

Connect Microsoft Defender for Endpoint to collect endpoint detection & response evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Microsoft Defender for Endpoint:

   1. Sign in to the Azure portal with a Microsoft Entra role that can register apps, such as Application Administrator.
   2. Search for App registrations and open it, then select New registration.
   3. Enter a name such as Safeguard and select Register.
   4. From the application page, select Certificates & secrets › New client secret.
   5. In the Add a client secret pane, add a description and expiration date, then select Add.
   6. Copy the secret's Value now; it cannot be retrieved after you leave the page.
   7. On the application page, go to Manage › API permissions › Add permission › APIs my organization uses.
   8. On the Request API permissions page, search for WindowsDefenderATP and select it.
   9. Choose Application permissions (access the API as a service).
   10. Select the appropriate permissions for your app (check the Permissions section of each API you call), then select Add permission.
   11. Have an administrator grant admin consent for these application permissions so they take effect.

   Where to find the other values:

   • Client ID: The app's Overview page shows the Application (client) ID.
   • Tenant ID: The app's Overview page shows the Directory (tenant) ID.

   Microsoft Defender for Endpoint shows the secret only once, so copy it before you leave the page.

   Microsoft Defender for Endpoint's public documentation does not cover every step.

   Applies to Microsoft Defender for Business and Defender for Endpoint Plans 1 and 2. The fetched page does not spell out the admin-consent button label; Microsoft requires application permissions to be consented by an admin before they take effect. The permission names come from the connector's grant list (the WindowsDefenderATP API's application permissions). Verification removed the permission names Machine.Read.All, Alert.Read.All and Vulnerability.Read.All from the steps because the fetched page does not list them.

   Source: learn.microsoft.com, checked 2026-10-07.

   The permissions Safeguard needs: Machine.Read.All, Alert.Read.All, Vulnerability.Read.All.

2. On Compliance › Connectors, open Microsoft Defender for Endpoint, click Connect, choose API token and fill in:

   Field	What to enter
   Tenant ID	Required.
   Client ID	Required.
   Client secret	Required. Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Microsoft Defender for Endpoint and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Endpoint Detection & Response connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks