---
title: Microsoft Defender
slug: authentication-guides/microsoft-defender
docTags: 
createdAt: 2026-01-19T10:22:07.620Z
---

# Introduction

This guide explains how to authenticate the Microsoft Defender connector in Swimlane using OAuth 2.0 Client Credentials.

You will create an Azure application, assign required API permissions, collect necessary identifiers, and configure the connector in Swimlane.

# Azure Access Requirements

You must have Azure permissions to:

- Register applications in Azure AD
- Assign API permissions
- Grant admin consent
- Generate client secrets

# Required Credentials

During setup, you will collect:

- Client ID
- Client Secret
- Token URL
- Base Defender API URL
- Defender permissions scope

# Azure Setup

Take the following steps to register the application:

1. Navigate to Azure Portal > Azure Active Directory > App Registrations.
2. Click **New Registration**.
3. Enter an application name.
4. Choose **Accounts in this organizational directory only.**
5. Click **Register**.

Take the following steps to assign API permissions:

1. Open **API Permissions tab.**
2. Click **Add a permission.**
3. Select **APIs my organization uses.**
4. Search for **WindowsDefenderATP.**
5. Add the required Application permissions, such as:
   - Alert.Read.All
   - Alert.ReadWrite.All
   - Machine.Read.All
   - Machine.ReadWrite.All
   - AdvancedQuery.Read.All
6. Click **Add permissions.**
7. Click **grant admin consent.**

Take the following steps to generate a Client Secret:

1. Navigate to Certificates & Secrets.
2. Click **New client secret**.
3. Add description and expiration.
4. Copy and save the value. This saved value is Client Secret.

Take the following step to collect required Identifiers:

1. From **App Registration**>**Overview**, copy:
   - Client ID
   - Tenant ID

# Connector configuration in Swimlane

1. Log in to Turbine.
2. From the left-hand navigation pane, click **ORCHESTRATION** and click **Assets**.
   Asset homepage opens.
3. Click the **plus** icon to open the Configure your Connector Asset window.
4. Select **Microsoft Defender** from the Asset type list.
5. Fill in the **Asset Settings **and **Asset Input** as shown:

| **Field**      | **Description**                                                                                                                              | **Required** |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | ------------ |
| url            | Base Defender API URL                                                                                                                        | Required     |
| token\_url     | [https://login.microsoftonline.com/{tenant\_id}/oauth2/v2.0/token](https://login.microsoftonline.com/%7Btenant_id%7D/oauth2/v2.0/token) | Required     |
| client\_id     | Client ID from Azure                                                                                                                         | Required     |
| client\_secret | Client Secret from Azure                                                                                                                     | Required     |
| scope          | Defender permission scopes                                                                                                                   | Required     |
| verify\_ssl    | Enable/Disable SSL verification                                                                                                              | Optional     |
| http\_proxy    | Proxy configuration                                                                                                                          | Optional     |

:::hint{type="info"}
Fields with \* marks are required.
:::

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/IIwbiGObWqf1PzuYs9B5P_image.png)

6. Click **Create**.

# Troubleshooting

## If you encounter 403 Forbidden error,

- Ensure that admin consent is granted.
- Check for all the missing required API permissions.
- Check for incorrect permission type (Application vs Delegated).

## If you encounter 401 Unauthorized error,

- Check whether you have entered the correct Client Secret.
- Double check Tenant ID.
- Ensure the Token URL is formatted correctly.

## If you encounter API errors during action execution,

- Check if permission for that specific Defender API was added.
- Ensure the Token includes required scopes.

You have successfully authenticated the Microsoft Azure Sentinel Connector in Swimlane.