> For the complete documentation index, see [llms.txt](https://docs.cybaops.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybaops.com/getting-started/onboarding/connectors/microsoft-defender.md).
# Microsoft Defender
The Microsoft Defender connector works by syncronising data from your account to the MDR module in your CybaOps account.
It is one-way, and only takes information from Microsoft Defender to CybaOps. It does not push data from CybaOps to Defender.
## Guide
This guide walks you through collecting:
* Tenant ID
* Client ID
* Client Secret
And configuring the required API permissions:
* Incident.Read.All
### Step 1: Log into Azure
Go to the Microsoft Azure Portal
[https://portal.azure.com](https://portal.azure.com/)
Make sure you are logged in with an account that has admin access.
### Step 2: Get Your Tenant ID
1. Search for **Microsoft Entra ID**
2. Click into it
3. On the **Overview page**: Copy the **Tenant ID**
4. Paste to the relevant field in CybaOps
### Step 3: Register an Application (Client ID)
1. In **Microsoft Entra ID**
2. Go to:
* **App registrations**
3. Click:
* **New registration**
4. Name it something like:
* CybaOps Defender Connector
5. Click **Register**
Copy the **Application (Client) ID** and paste in the relevant field in CybaOps.
### Step 4: Create Client Secret
1. Inside the app:
* Go to **Certificates & secrets**
2. Click:
* **New client secret**
3. Add a description (e.g. CybaOps Defender Secret)
4. Choose expiry (24 months recommended)
5. Click **Add**
6. **Copy the Value immediately** (this is your Secret Token – you won’t see it again). Paste it into the relevant field in CybaOps.
{% hint style="info" %}
*Please note: when this secret expires, you will be required to generate a new one to ensure CybaOps can authenticate properly.*
{% endhint %}
### Step 5: Assign Required Permissions
This is the most important step.
1. Go to:
* **API permissions**
2. Click:
* **Add a permission**
3. Select:
* **APIs my organisation uses**
4. Choose:
* **Application permissions**
5. Search and add:
* Microsoft Threat Protection > Application permissions > Incident.Read.All > Add permissions
Repeat steps 1 and 2 then
6. Click on “Microsoft Graph”
7. Click on “Application permission” and look for the following permission:
* Security Alert > SecurityAlert.Read.All > Add permission
8. Repeat step 8, click on “Application permission” and look for the following permission:
* Security Incident > SecurityIncident.Read.All> add permission
* Users.Read.All and >Devices.Read.All
9. Click **Add Permissions**
10. Then click:
**Grant admin consent**
Once that’s all complete, click connect in CybaOps. This will trigger the data to start syncronising and a regular schedule will be created.
#### Data Synchronisation
The data is pulled every **5 minutes**. The same 5-minute cadence is used for normal operation and routine health checks. If there is **an authentication or authorisation error** (for example, an expired client secret), the connector backs off and retries every **30 minutes**.
#### Data Synchronised from Microsoft Sentinel
**Incidents**
* All Defender incidents are ingested into CybaOps.
* Each incident already contains its associated alert data
**Alerts**
* Alert details are included as part of the incident payload retrieved from Defender.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.cybaops.com/getting-started/onboarding/connectors/microsoft-defender.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.