> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tierzerocode.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Defender for Endpoint

> Configure Microsoft Defender for Endpoint Device Integration

The following steps will integrate Microsoft Defender for Endpoint by using an Enterprise Application / Application Registration with the below API permissions. Currently setup is limited to using a Service Principal Name (SPN) with a client id, client secret, tenant id, and domain.

## Required Permissions

| API                    | Permissions Name | Type        | Description               | Admin Consent Required |
| :--------------------- | :--------------- | :---------- | :------------------------ | :--------------------- |
| Microsoft Defender ATP | Machine.Read.All | Application | Read all machine profiles | Yes                    |

## Setting Up Microsoft Defender for Endpoint Device Integration

In Tier Zero Code, go to “Integrations” and click on the Microsoft Defender for Endpoint device integration then enable and configure integration.

<img src="https://mintcdn.com/awbtechllc/eoHr7eWM7PUIQlaL/images/image-3.png?fit=max&auto=format&n=eoHr7eWM7PUIQlaL&q=85&s=9cf7fd86189199ea673550e9d68bce68" alt="Image" width="1918" height="1003" data-path="images/image-3.png" />

In the Microsoft Defender for Endpoint Configuration, you'll need the following fields:

<ResponseField name="Client ID" type="string" required>
  The application (client) ID from the “Overview” section of your app registration
</ResponseField>

<ResponseField name="Client Secret" type="string" required>
  The client secret value from the “Certificates and secrets” section of your app registration
</ResponseField>

<ResponseField name="Tenant ID" type="string" required>
  The directory (tenant) ID from the “Overview” section of your app registration
</ResponseField>

<ResponseField name="Tenant Domain" type="string" required>
  The primary domain from the "Home" of your Microsoft Entra admin center.
</ResponseField>