# Add Microsoft Defender Permissions

In this guide, you will set up a trusted relationship between Radiant and your Microsoft Defender account to allow Radiant to collect endpoint events, alerts, actions, and activity.

### Prerequisites

* [ ] Admin access to Azure

### **Grant the registered application the appropriate permissions**

1. Log in to [Azure Admin](https://portal.azure.com/#home) portal.
2. From the left side menu, click **Microsoft Entra ID,** then click **App Registration**. 
3. Under **All applications**, search for `radiantsecurity-connector` and open the app.
4. On the left side menu, click **API Permissions**.
5. Click + **Add a permission**.
6. From the pop-out menu, select **APIs my organization uses**. 

   <div align="left"><figure><img src="/files/rHb259GumiVTDnHbvDCi" alt="" width="375"><figcaption></figcaption></figure></div>
7. Select **WindowsDefenderATP** and then select **Application permissions**.&#x20;

   <div align="left"><figure><img src="/files/GJgQo8bUVi9YylyK3n0m" alt="" width="516"><figcaption></figcaption></figure></div>
8. Select the following permissions:

| **API**            | **Permission name**                      | **Required for Data Ingestion?** | **Use Case**                                                                                            |
| ------------------ | ---------------------------------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------- |
| WindowsDefenderATP | AdvancedQuery.Read.All                   | Yes                              | Collect endpoint events                                                                                 |
| WindowsDefenderATP | Alert.Read.All                           | Yes                              | Collect endpoint alerts                                                                                 |
| WindowsDefenderATP | File.Read.All                            | Yes                              | Collect additional info on files                                                                        |
| WindowsDefenderATP | Ip.Read.All                              | Yes                              | Endpoint activity—give the application permissions to collect additional info on IPs                    |
| WindowsDefenderATP | Machine.Isolate                          | No                               | Endpoint actions—allow the app to isolate compromised hosts (either automatically or through one-click) |
| WindowsDefenderATP | Machine.Read.All                         | Yes                              | Endpoint activity—give the application permissions to collect additional info on users involved         |
| WindowsDefenderATP | <p>Ti.ReadWrite,<br>Ti.ReadWrite.All</p> | No                               | Endpoint actions—allow the app to allow/deny IOCs (either automatically or through one-click)           |
| WindowsDefenderATP | URL.Read.All                             | Yes                              | Endpoint activity—give the application permissions to collect additional info on domains                |
| WindowsDefenderATP | User.Read.All                            | Yes                              | Endpoint activity—give the application permissions to collect additional info on users involved         |

9. Click **Add permissions** to save your changes.
10. Notice that the new permissions have been added. However, there is a warning message that admin consent is missing. <br>

    <div align="left"><figure><img src="/files/oPBDh7z1UJOwvENFYprZ" alt=""><figcaption></figcaption></figure></div>
11. To resolve this, click **Grant admin consent** **for the Defender API.**&#x20;

    <div align="left"><figure><img src="/files/QPHkS0BWAxQDz9ZupkfT" alt=""><figcaption></figcaption></figure></div>
12. Click **Yes** in the confirmation pop-up window. The warnings have now been resolved.&#x20;

    <div align="left"><figure><img src="/files/UbNzl9GemeYBoSC3Yi8l" alt=""><figcaption></figcaption></figure></div>

### Enable the data feed in Radiant Security

1. Log in to [Radiant Security.](https://app.radiantsecurity.ai/)
2. From the navigation menu, click **Settings** > **Data Connectors**.
3. Under the **Data Connectors** page, find **Microsoft O365**.
4. Hover over the connector and click **Enable** to enable data ingestion from Defender.&#x20;


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://help.radiantsecurity.ai/radiant-connectors/data-connectors/defender-for-endpoint-via-event-hub/add-microsoft-defender-permissions.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.