Elisity supports simple API connectivity to Microsoft Defender as a method to enrich IT device discovery and identity. This enables asset data from Microsoft Defender to be imported into IdentityGraph for all assets that appear on your Elisity-secured network. This enhances the precision and effectiveness of asset classification. The connector supports up to 10 endpoints, each connecting to a separate Microsoft Defender for Endpoint tenant.
Prerequisites
For each Microsoft tenant you connect:
- Microsoft Defender Tenant ID
Microsoft Defender App ID
Microsoft Defender App Secret
Steps to Connect Microsoft Defender
Step 1. Access the Enterprise Application Registration page in Microsoft Entra.
Step 2. Click on the New Registration button.
Step 3. Enter a name for the Application: Elisity CCC Defender API Access
Step 4. Select Accounts in this organization only
Step 5. Enter https://portal.azure.com as the Redirect URI. This is only used as a redirect for the application authorization for your Entra tenant. Click Register.
Step 6. After the application is created, navigate to the API Permissions link in the left panel and click on the Add Permission button.
Step 7. Click on the APIs My Organization Uses tab and search for "WindowsDefenderATP"
Step 8. Click on "WindowsDefenderATP" in the list. In the new panel, select Application Permissions then search for “Machine”
Step 9. Click the dropdown arrow beside “Machine” then click the checkbox beside “Machine.Read.All” as shown in the below image.
Step 10. After clicking the Add Permissions button, ensure you select the “Grant Admin Consent for {Organization}” to complete the permissions grant process
Step 11. Navigate to the Certificates & Secrets panel in the left side menu.
Step 12. Make sure the Client Secrets pane is selected then click on the +New client secret button
Step 13. Enter “Elisity CCC Defender Connector” as the description for the client secret and choose a suitable expiration interval based on your organizations policies for API credential rotation
Step 14. After the Client Credential is created be sure to copy the “Value” field as it will not be displayed after navigating from this page. An example of a successfully created credential screen is shown below.
Step 15. Navigate to the Overview page in the left side menu
Step 16. Note the “Application (client) ID” and “Directory (tenant) ID” as these will be used with the Client Secret from above to authenticate Elisity CCC for API access.
Step 17. Lastly the Application must be authorized in Entra. Navigate to the following URL while logged in as an Entra Administrator.
https://login.microsoftonline.com/common/oauth2/authorize?prompt=consent&client_id=00000000-0000-0000-0000-000000000000&response_type=code&sso_reload=true
where 00000000-0000-0000-0000-000000000000 is the Client ID from the overview page above.
Note: If connecting multiple Microsoft tenants, repeat Steps 1 through 17 in each tenant to create a separate app registration and client secret for each endpoint.
Steps in Cloud Control Center
Step 18. Log in to Cloud Control Center, navigate to IdentityGraph > Connectors, and select + Add Connector.
Step 19. A list of tiles slides out from the right side of the screen. Select Configure on the Microsoft Defender tile.
Step 20. Configure the first endpoint on the Required Configuration tab. Enter an Endpoint Name to identify this Microsoft tenant (for example, Corporate). Each endpoint name must be unique within the connector. Input the Tenant ID, the App ID and the App Secret. Select the Tenant Type - see the table below for details.
| Tenant Type | Details |
|---|---|
| Commercial | Connects to standard Microsoft Defender for Endpoint tenants in the commercial cloud. Select this for most Microsoft 365 and Azure environments. |
| GCC | Connects to Defender for Endpoint tenants hosted in the U.S. Government Community Cloud (GCC) using dedicated API endpoints. Select this if your Defender subscription is in GCC. |
| GCC High | Connects to Defender for Endpoint tenants hosted in the U.S. Government Community Cloud High (GCC High) using the corresponding API endpoints. Select this if your Defender subscription is in GCC High. |
Tenant Type is set per endpoint, so endpoints with different tenant types can run on the same connector.
Step 21 (optional). Configure the Advanced Settings tab for the endpoint, as described in Advanced Settings below.
Advanced Settings
Advanced settings control how Cloud Control Center queries the connector, how learned data is retained, and how the connector's data is used by IdentityGraph and Insights. These settings are configured at two levels.
Endpoint Advanced Settings
The Advanced Settings tab of each endpoint holds Query Exclusion Rules, which apply only to that endpoint, and the Enrichment Lookback Window, which applies to the whole connector: changing it on one endpoint changes it for every endpoint.
Global Settings
To open Global Settings, select the Actions (three-dot) menu on the Microsoft Defender connector row on the Connectors page, then select Global Settings. The Advanced Settings tab holds Connector Data Purging and Trusted Connector, and the Interval Settings tab holds Initial Delay. Global Settings apply to all endpoints.
The following chart provides details about each advanced setting.
| Setting | Scope | Description |
|---|---|---|
| Query Exclusion Rules | Endpoint | Limit the scope of Cloud Control Center queries by excluding specific Subnets or Virtual Edge Nodes, and by enabling or disabling the querying of devices with Random MAC addresses. |
| Enrichment Lookback Window | Connector (all endpoints) | Defines how far back IdentityGraph looks for device activity when determining a device's eligibility for enrichment from this connector. Devices whose last seen timestamp falls within the configured window are eligible for enrichment; devices outside the window are not. Increasing this value may improve enrichment coverage for environments with infrequently connected devices (servers, OT systems, remote assets) but can increase processing load. Available values: 1 hour, 1 day, 3 days (default), 7 days, 30 days, 90 days. |
| Connector Data Purging | Connector (all endpoints) | When enabled, Cloud Control Center purges all data learned about a device from this connector if the device is no longer found when querying the connected application. The time period between purge events is configurable from 1 to 90 days. The connector status will change from "Up to Date" to "Stale" if the device is no longer known by the connector but prior to the purge event. |
| Trusted Connector | Connector (all endpoints) | Sets enrichment from this source to Trusted for Policy Groups and designates this connector as an authoritative identity source for Insights. |
| Initial Delay | Connector (all endpoints) | The delay in seconds before Cloud Control Center initiates the first query to the connector after initially discovering a new device. Default is 0 seconds. |
Step 22. If all of the required connector values are correct, all checks will pass and the connector will be created.
Step 23 (optional). To connect another Microsoft tenant, select + Add Connector, select Configure on the Microsoft Defender tile again, and repeat Steps 20 through 22. Each submission adds an endpoint to the existing Microsoft Defender connector. Each endpoint is validated independently.
After successfully configuring the Microsoft Defender connector, you should begin to see newly discovered assets enriched with data from Microsoft Defender in IdentityGraph. Any devices learned by Elisity prior to the connector being configured will be automatically scheduled for enrichment based on their attachment timestamp. Alternatively, you can force a refresh by selecting the refresh button next to the Microsoft Defender name under the Trust Attributes section of IdentityGraph.
Managing Multiple Endpoints
Each endpoint of the Microsoft Defender connector connects a separate Microsoft Defender for Endpoint tenant with its own Endpoint Name, Tenant ID, App ID, App Secret, Tenant Type and status.
- The connector supports a maximum of 10 endpoints.
- Each endpoint authenticates with its own credentials and enriches only devices from its own tenant.
- To change an endpoint, for example to rotate its App Secret or change its Tenant Type, expand the Microsoft Defender row on the Connectors page, select the Actions (three-dot) menu on the endpoint row, and select Edit Endpoint. Changes apply only to that endpoint.
- A device known in more than one tenant is enriched from the endpoint listed first under the connector and keeps those values between refreshes. If that endpoint is deleted, the device is enriched from the next endpoint that knows it.
- Delete Endpoint removes only that endpoint. Select Delete Endpoint Data in the confirmation dialog to also remove the data that endpoint added to IdentityGraph. Data from other endpoints is not affected. Deleting the only endpoint also deletes the connector.
- The Known in Microsoft Defender trust attribute is set for a device known in the tenant of any endpoint.
Connector Status
On the Connectors page, each endpoint appears as a row under the expanded Microsoft Defender connector, with its own status and its own Created On and Modified On timestamps.
The Connector status reflects its health and availability based on recent query performance. To ensure accuracy and reduce false positives, the status is determined using a rolling 15-minute evaluation window.
Connector Status Levels:
- Active: Normal operation with minimal query failures.
- Degraded: Increased query failures detected, but the connector is still operational.
- Inactive: The connector is unresponsive due to persistent failures.
Failures are defined as unsuccessful query responses, and the platform continuously monitors performance to update the status accordingly. These status changes are visible in the UI, event logs, and notifications pane for better troubleshooting. Email alerts can also be configured for connector status changes.
If the connector has not been queried within the evaluation window, the last known status is retained. This approach ensures reliable status reporting and helps identify potential issues before they impact operations.
Leveraging Microsoft Defender with Elisity
When Elisity discovers a new asset on the network and the Microsoft Defender connector is active, Cloud Control Center queries the Microsoft Defender platform via API for additional device attributes in order to enrich IdentityGraph. This enriched data is displayed in the IdentityGraph tab of the device and can be leveraged in Policy Group definition.
If a device discovered by Elisity is also known in Microsoft Defender, the Trust Attribute flag for "Known in Microsoft Defender" will be set to Yes. You can then leverage this trust attribute as match criteria in Policy Group definition.
To learn more about how to leverage IdentityGraph Trust Attributes review the Leveraging Trust Attributes for Policy Group Definition article.