> ## Documentation Index
> Fetch the complete documentation index at: https://kb.mspprocess.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Defender for Endpoint

> Connect Microsoft Defender for Endpoint in your clients' tenants to Triggr with your own multitenant Microsoft Entra app registration.

Triggr works with custom indicators (allow, audit, warn and block), devices and alerts in each client's Defender for Endpoint. It uses its own app registration, separate from your [Microsoft Graph (GDAP)](https://kb.mspprocess.com/integrations/microsoft-graph/gdap-service-account.md) connection.

## Set up Microsoft Entra

Register one multitenant app in your own tenant (you need a role such as Application Administrator); every client uses it. See Microsoft's [Partner access through Microsoft Defender for Endpoint APIs](https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-create-app-partners).

**1. Register the app**

In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Entra ID > App registrations > New registration**, name it `Triggr Defender for Endpoint`, choose **Multiple Entra ID tenants** (or Accounts in any organizational directory), select Register and copy the Application (client) ID.

**2. Add the redirect URI**

In Authentication, select **Add Redirect URI** (or Add a platform), choose Web, enter `https://app.triggr-app.com/oauth/admin-consent-callback` and select Configure.

**3. Add the permissions**

In API permissions, select **Add a permission > APIs my organization uses**, type `WindowsDefenderATP`, choose Application permissions and tick what your workflows need.

| Triggr actions | Application permission |
| - | - |
| List Indicators, Submit or Update Indicator, Import Indicators, Delete Indicator, Batch Delete Indicators | `Ti.ReadWrite.All` |
| List Machines | `Machine.Read.All` or `Machine.ReadWrite.All` |
| Get Machine | `Machine.ReadWrite.All` |
| List Alerts | `Alert.ReadWrite.All` |

**4. Create a client secret**

In **Certificates & secrets > Client secrets**, select New client secret, choose an expiry (up to 24 months) and copy the Value, not the Secret ID.

## Connect it in Triggr

Each client needs Defender for Endpoint Plan 1 or 2, or Defender for Business, with devices onboarded. Per-client integrations never fall back to the Base Configuration when a workflow runs for a client.

**1. Open the integration**

Go to **Integrations > Microsoft Defender for Endpoint** and click Configure on the Base Configuration card.

![The Base Configuration card with Status Not Configured, Admin Consent Not Required and a Configure button.](https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/base-configuration.png?fit=max\&auto=format\&n=nyuVXZ1rouDTTEvu\&q=85\&s=bb81acb082055015f91beda7b4876f35)

**2. Enter your app**

Enter the Application (client) ID, the secret's Value as Client Secret and your own tenant ID as Microsoft Tenant ID (used only by runs without a client), then click Save Configuration. There's no Authorize step, and this card's Admin Consent can stay Not Granted unless you run Defender actions without a client.

![The Microsoft Defender for Endpoint configuration window with Application (client) ID, Client Secret and Microsoft Tenant ID fields, a Lookup By Domain link, an Allow insecure TLS switch under Advanced, and a Save Configuration button.](https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/microsoft-defender-endpoint/configure.png?fit=max\&auto=format\&n=nyuVXZ1rouDTTEvu\&q=85\&s=392f494005215f7a1b8832074ae36c8b)

**3. Add each client's tenant ID**

On the Per-Client Configuration card, click Configure on the client's row, enter its Microsoft Tenant ID (or use Lookup By Domain) and click Save Configuration. Triggr saves it as the client's `microsoftTenantId` variable; for clients that already have that variable, click Automap, then Approve All.

![The Per-Client Configuration card listing Acme Corp and Globex, each Not Configured with Admin Consent Not Required and a Configure button.](https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/per-client-configuration.png?fit=max\&auto=format\&n=nyuVXZ1rouDTTEvu\&q=85\&s=11464b4946bea0b580c73330d9114a41)

**4. Grant admin consent for each client**

Click **Admin Consent** on the client's row, sign in as a Global Administrator, Privileged Role Administrator, Cloud Application Administrator or Application Administrator of the client's tenant and select Accept. If you add a permission to the app later, grant consent again.

To rotate the secret, create a new one in Entra and replace Client Secret with Edit on the Base Configuration card. One change covers every client.

## Troubleshooting

> [accordion] no Microsoft Defender for Endpoint integration is configured for this client
>
> The client has no configuration. Add its tenant ID in the Per-Client Configuration card, then grant admin consent for it.

> [accordion] AADSTS50011 or AADSTS700016 during consent
>
> AADSTS50011: add the redirect URI above to the app exactly. AADSTS700016: the client hasn't consented yet, the app isn't multitenant, or Application (client) ID is wrong.

> [accordion] AADSTS650052 during consent
>
> The client's tenant has no Defender for Endpoint. Check it has a Defender for Endpoint or Defender for Business licence and is set up in the Defender portal, then try again.

> [accordion] AADSTS7000215, AADSTS7000222 or AADSTS90002
>
> The secret is the Secret ID instead of the Value (7000215) or has expired (7000222), or the client's Microsoft Tenant ID is wrong (90002).

> [accordion] A step returns 403 Forbidden
>
> The app lacks the Application permission the action needs, or you added it after the client consented: click Admin Consent again.

> [accordion] List Machines returns 404
>
> The tenant has no recently seen devices. Check devices are onboarded and reporting in the client's Defender portal. Get Machine returns 404 when no device matches the ID or computer name.

> [accordion] Indicators are created but nothing is blocked
>
> In the client's [Defender portal](https://security.microsoft.com), under Settings > Endpoints > General > Advanced features, turn on Custom network indicators (IP, URL and domain) or Allow or block file (file hashes). IP indicators take single public addresses, not ranges, and network indicators can take up to 48 hours to apply.

> [accordion] 429 Too Many Requests
>
> Defender limits most calls to 100 a minute and 1,500 an hour, and Import Indicators and Batch Delete Indicators to 30 a minute. Use the bulk actions and spread large jobs out.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.