Skip to main content

​
Pre-requisites

User organization must have an eligible Defender for Endpoint license.

​
Set Up App Registrations in the Azure Portal

App registrations in Microsoft Entra ID (Azure AD) allow applications to authenticate and access Microsoft resources securely.
1

Access Azure Portal

  1. Log in to your Azure Portal.
  2. Go to Microsoft Entra ID (formerly Azure AD).
  3. In the left menu, click Manage → App registrations.
2

Register a New Application

  1. Click + New registration.
  2. Provide the mandatory details:
    • (Name: Enter a name for your app (e.g., airmdr-defender-atp).
    • Supported Account Types: Select “Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant)” option).
  3. Click Register.
Redirect URI (Optional): If your app uses authentication, enter a URL (e.g., https://myapp.com/auth).
3

Get Application (Client) ID and Tenant ID

  1. After successful registration, you will see the App Overview page.
Copy Application (Client) ID – Identifies your app.
Copy Directory (Tenant) ID – Identifies your Azure AD tenant.
4

Configure API Permissions

  1. In the application Overview page left navigation pane, select Manage dropdown.
  2. Click API Permissions.
  3. Click + Add a permission
  4. Select APIs my organization uses tab.
  5. Search and select the API “WindowsDefenderATP”.
  6. Click on Application permissions.
  7. Select the required permissions (Alert.Read.All, File.Read.All,IP.Read.All,Machine.Read.All,SecurityRecommendation.Read.All,Software.Read.All,URL.Read.All,User.Read.All,Vulnerability.Read.All,Alert.ReadWrite.All,Machine.ReadWrite.All).
  8. Click Add permissions at the bottom of the page.
  9. Click API permissions, select Yes for Grant admin consent confirmation to allow access.
5

Create a Client Secret (For Authentication)

  1. In the application Overview page left navigation pane, select Manage dropdown.
  2. Click Certificates & secrets.
  3. Click + New client secret. MDE6 Pn
  4. Enter a description (e.g., MySecretKey) and set expiration.
  5. Click Add.
Copy and secure the Value (Client Secret) immediately – (It won’t be shown again!)
Email the Tenant ID, Client ID and the Client Secret Value to AirMDR or self Configure MDE in AirMDR Integrations Dashboard.

​
Configure Microsoft Defender for Endpoint in AirMDR Integrations Dashboard

  1. Navigate to AirMDR, provide the credentials and click Login.
  2. Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select Integrations.
  3. Use the search option, enter the keyword “Microsoft Defender for Endpoint”, select the Connections tab, and click the + Create icon.
  4. Enter the generated Tenant ID, Client ID and the Client Secret in the Authentication Details field params, and click Create.

​
Evaluate Microsoft Defender for Endpoint (MDE)

​
Pre-requisites

Azure App Registration with API permissions for Defender for Endpoint.
Client ID, Tenant ID, and Client Secret.
1

Obtain an Access Token

Open cURL and run the following command to check if your API Access is working:MDE uses OAuth 2.0 authentication. First, request an access token from Microsoft Entra ID (Azure AD):

curl -X POST "https://login.microsoftonline.com/<tenant_id>/oauth2/v2.0/token" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "client_id=<client_id>" \
     -d "client_secret=<client_secret>" \
     -d "grant_type=client_credentials" \
     -d "scope=https://api.security.microsoft.com/.default"
Replace:
  • <tenant_id> – Your Azure Directory (Tenant) ID.
  • <client_id> – Your App Registration Client ID.
  • <client_secret> – Your App Registration Client Secret.
Expected Response (Success):

{
  "token_type": "Bearer",
  "expires_in": 3599,
  "access_token": "eyJ0eXAiOiJKV1QiLCJhb..."
}
  • This verifies if the user can retrieve device information based on the assigned scope.
2

Test API Access with MDE

Once you have the access_token, use it in API calls.
  • To Get Device List

curl -X GET "https://api.security.microsoft.com/api/machines" \
     -H "Authorization: Bearer <access_token>" \
     -H "Content-Type: application/json"
Expected Response: A JSON list of devices onboarded to Defender for Endpoint.
  • To Get Alerts

curl -X GET "https://api.security.microsoft.com/api/alerts" \
     -H "Authorization: Bearer <access_token>" \
     -H "Content-Type: application/json"
Expected Response:A list of security alerts detected by Microsoft Defender.Troubleshooting Authentication Issues
Error CodePossible IssueSolution
401 UnauthorizedInvalid tokenRegenerate token, check credentials
403 ForbiddenInsufficient API permissionsGrant admin consent in Azure Portal
400 Bad RequestIncorrect request formatVerify API endpoint and headers
500 Internal Server ErrorService issueRetry later, check the Defender status