Microsoft Defender for Cloud

Microsoft Defender for Cloud is a cloud-native security solution that provides threat protection and security posture management for cloud workloads and resources hosted on Azure.

Setup and Configure

1. Log on to Azure with a user account that has the Global Administrator role.

2. Navigate to Microsoft Entra ID > App registrations > New registration. The “Register an application” page window appears.

   

3. Enter the application's registration information:

   1. In the ‘Name’ section, enter a meaningful application name that will be displayed to users.

   2. For ‘Supported account types’, click the Accounts in any organizational directory option.

   3. Set the ‘Redirect URI’ to http://localhost.

   4. Click on Register to create the application.

      

4. On the app “Overview” page, copy the ‘Application (client) ID’ and ‘Directory (tenant) ID’ for later use.

   

   Add Endpoint Access

   Once the application is created, permissions should be provided to get data. The appropriate permissions for the application are needed to configure these endpoints. The following section details how to configure and add permissions to the three required endpoints.

   Endpoints needed for Microsoft Defender for Cloud

   • https://graph.microsoft.com/beta/security/alerts

   • https://graph.microsoft.com/beta/security/incidents

   Add Permissions

   To add permissions for the endpoints outlined above, from the Azure Active Directory portal:

5. Select the application whose logs are to be accessed (generally, the application registered earlier on this page).

6. Click API Permissions, and then click Add a Permission. The “Request API permissions” window appears.

   

7. Click on Microsoft Graph.

   

8. Click on Application Permissions.

   

9. The following permissions need to be granted for the endpoints to function properly:

   Endpoints	Permission
   /security/alerts	SecurityEvents.Read.All
   /security/incidents	SecurityIncident.Read.All

10. In the ‘Select permissions’ search bar, enter the two permissions shown above one by one, and check the box for each to include it.

    
    

11. Click the Add permissions button after selecting all required permissions.

12. On the “API permissions” page, click Grant Admin Consent for <tenant>.

    

13. Click the Yes button on the consent confirmation. The required permissions are now added for the endpoints.

    Create the Client ID and Client Secret

    The final step in configuring the Graph API is creating a Client ID and Client Secret. To create these items, from the Azure Portal:

14. Select the application created above.

15. Click Certificates & secrets, and then Client Secrets.

16. Click New client secret. The “Add a client secret” window appears.

    

17. Enter a ‘Description’ for this client secret.

18. Select the desired expiry period from the ‘Expires’ drop-list.

    

19. Click Add.

20. Copy the ‘Value’ field, which will be used to initialize the beat.