Add Microsoft Defender Permissions
Add the Microsoft Defender data connector.
In this guide, you will set up a trusted relationship between Radiant and your Microsoft Defender account to allow Radiant to collect endpoint events, alerts, actions, and activity.
Grant the registered application the appropriate permissions
Log in to Azure Admin portal.
From the left side menu, click Microsoft Entra ID, then click App Registration.
Under All applications, search for
radiantsecurity-connectorand open the app.On the left side menu, click API Permissions.
Click + Add a permission.
From the pop-out menu, select APIs my organization uses.
Select WindowsDefenderATP and then select Application permissions.
Select the following permissions:
API
Permission name
Required for Data Ingestion?
Use Case
WindowsDefenderATP
AdvancedQuery.Read.All
Yes
Collect endpoint events
WindowsDefenderATP
Alert.Read.All
Yes
Collect endpoint alerts
WindowsDefenderATP
File.Read.All
Yes
Collect additional info on files
WindowsDefenderATP
Ip.Read.All
Yes
Endpoint activity—give the application permissions to collect additional info on IPs
WindowsDefenderATP
Machine.Isolate
No
Endpoint actions—allow the app to isolate compromised hosts (either automatically or through one-click)
WindowsDefenderATP
Machine.Read.All
Yes
Endpoint activity—give the application permissions to collect additional info on users involved
WindowsDefenderATP
Ti.ReadWrite, Ti.ReadWrite.All
No
Endpoint actions—allow the app to allow/deny IOCs (either automatically or through one-click)
WindowsDefenderATP
URL.Read.All
Yes
Endpoint activity—give the application permissions to collect additional info on domains
WindowsDefenderATP
User.Read.All
Yes
Endpoint activity—give the application permissions to collect additional info on users involved
Click Add permissions to save your changes.
Notice that the new permissions have been added. However, there is a warning message that admin consent is missing.
To resolve this, click Grant admin consent for the Defender API.
Click Yes in the confirmation pop-up window. The warnings have now been resolved.
Enable the data feed in Radiant Security
Log in to Radiant Security.
From the navigation menu, click Settings > Data Connectors.
Under the Data Connectors page, find Microsoft O365.
Hover over the connector and click Enable to enable data ingestion from Defender.
Last updated