Skip to main content

Microsoft Defender Integration with SMARTFENSE

  • Updated

This article explains the purpose of the Microsoft 365 Defender integration with SMARTFENSE and how to configure it. The integration allows SMARTFENSE to read security alerts from Microsoft 365 Defender via Microsoft Graph API, using an authenticated connection with Microsoft Entra ID.

The configuration is available at Configuration > Integrations > Microsoft 365 Defender.

Initial Setup in Microsoft Entra ID

  1. Log in to the Microsoft Entra ID portal: https://portal.azure.com/.

  2. In the left-hand menu, select Microsoft Entra ID.

  1. Copy the domain name and paste it into the SMARTFENSE platform, inside the Domain field.

Application Registration

  1. Return to the Microsoft Entra ID portal.

  2. Select the option Manage > App registrations.

  3. Click on New registration in the top menu.

  1. In the Name field, enter SMARTFENSE.

  2. Select the option Accounts in this organizational directory only (SMARTFENSE only: single tenant).

  3. Press the Register button.

Once registration is complete, copy the value from the Application (client) ID field and paste it into the SMARTFENSE platform, inside the Application ID field.

Assigning API Permissions

  1. In the left-hand menu, select API permissions.

  2. Press the + Add a permission button to open the Request API permissions menu.

  3. In the Request API permissions window, select Microsoft Graph.

  4. Assign the following permission to the application:

    • SecurityAlert.Read.All

  1. Click the Grant admin consent button to apply the permission.

Creating the Secret Key

  1. In the left-hand menu, select Certificates & secrets.

  2. Press + New client secret.

  1. In the side window Add a client secret, enter a description and define an expiration time.

  2. Click Add.

When the expiration date is reached, the connection will stop working. You will need to generate a new secret and verify the connection again.

  1. Copy the Generated Value. This value is shown only once and cannot be retrieved later. 

Connection with SMARTFENSE

  1. Paste the secret key value copied in the previous step into the SMARTFENSE platform, inside the Application secret key field.

  2. Click the Check connection button within SMARTFENSE to verify that the configuration is correct.

Ad-blocking extensions such as Ad-Block Plus can interfere with the connection test. It is recommended to disable them temporarily before running this check.

💡 Best practices

  • Keep a secure record of the Application ID, Domain, and Application secret key.

  • Confirm that the SecurityAlert.Read.All permission has been granted correctly before testing the connection.

  • Set up internal alerts to renew the client secret before its expiration date to avoid disruptions to the integration.

  • Disable any content-blocking extensions temporarily before running Check connection to prevent false errors.

  • Verify that the Nudges and Playbooks that depend on this integration are properly configured to process alerts received from Microsoft 365 Defender.

Related to

Related articles