SupportLog InSign Up
DocumentationAPIs & IntegrationsChangelog

Microsoft Defender (Client Credentials)

Integrate your application with the Microsoft Defender for Endpoint API using Client Credentials

🚀 Quickstart

Connect to Microsoft Defender (Client Credentials) with Tenklo and see data flow in 2 minutes.

Create the integration

In Tenklo (free signup), go to Integrations -> Configure New Integration -> Microsoft Defender (Client Credentials).

Authorize Microsoft Defender for Endpoint

Go to Connections -> Add Test Connection -> Authorize, then enter your Tenant ID, Client ID, and Client Secret. Later, you'll let your users do the same directly from your app.

Call the Microsoft Defender for Endpoint API

Let's make your first request to the Microsoft Defender for Endpoint API to list alerts. Your app needs the Alert.Read.All application permission for this request. Replace the placeholders below with your Environment API key, integration ID, and connection ID:

curl "https://api.tenklo.dev/proxy/api/alerts?\$top=10" \
  -H "Authorization: Bearer <NANGO-API-KEY>" \
  -H "Provider-Config-Key: <INTEGRATION-ID>" \
  -H "Connection-Id: <CONNECTION-ID>"

Or fetch credentials with the Node SDK or API.

✅ You're connected! Check the Logs tab in Tenklo to inspect requests.

Implement Tenklo in your app

Follow our quickstart to integrate Tenklo in your app.

📚 Microsoft Defender (Client Credentials) integration guides

Official docs: Microsoft Defender for Endpoint API

🧩 Pre-built syncs & actions for Microsoft Defender (Client Credentials)

Enable them in your dashboard. Extend and customize to fit your needs.

No pre-built syncs or actions available yet.

Not seeing the integration you need? Build your own independently.

API gotchas

  • Integrations default to the https://api.securitycenter.microsoft.com/.default scope, which you can change in the integration's Settings. The client credentials flow only accepts a /.default scope, and Microsoft requires this audience for the Defender for Endpoint APIs, even though requests go to https://api.security.microsoft.com.
  • The scope doesn't grant individual permissions. The token includes the application permissions an admin has consented to on the app registration.
  • Each endpoint needs its own application permission on the WindowsDefenderATP API, such as Alert.Read.All or Machine.Read.All. A missing permission returns 403 Forbidden. Check the Permissions section of each endpoint in the API reference.

Microsoft Dataverse (Dynamics 365 CRM)

Previous Page

Microsoft Dynamics 365 Finance and Operations

Next Page

On this page

🚀 Quickstart📚 Microsoft Defender (Client Credentials) integration guides🧩 Pre-built syncs & actions for Microsoft Defender (Client Credentials)API gotchas