Microsoft Defender for Endpoint

Overview
How to connect
Automated checks
Useful links

DSALTA connects to Microsoft Defender for Endpoint using read-only API access to collect compliance evidence automatically. Data feeds into your Vulnerabilities page.

Read-only access. DSALTA never modifies, creates, or deletes resources in your Microsoft Defender for Endpoint environment.

DSALTA collects this integration’s data when you connect it — you can refresh it at any time with Sync from integrations on the Integrations page. The compliance checks below re-run once a day at 02:00 America/New_York.

What DSALTA reads

DSALTA reads the organization-wide vulnerability (CVE) list that Microsoft Defender Vulnerability Management produces, which appears on your Vulnerabilities page. Each row is one CVE affecting your organization, recorded against the integration as a whole — Defender’s /api/vulnerabilities response is a per-CVE summary and does not name the affected devices, so DSALTA cannot attribute a finding to an individual endpoint. This integration does not collect a user roster or a device roster.It calls these Microsoft Defender for Endpoint endpoints:

/api/vulnerabilities

Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Microsoft Defender for Endpoint environment.

Troubleshooting

Integration shows Disconnected

There is no Reconnect button. Open Integrations → Connected, click Manage on the Microsoft Defender for Endpoint card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from Microsoft Defender for Endpoint. This usually happens when API tokens expire.

Data is not syncing

Verify the connected account still holds the permissions this integration requires. Then open Integrations in the DSALTA sidebar, stay on the Connected tab, and click Sync from integrations at the top right. That button refreshes every connected integration at once — there is no per-integration sync control.

A Microsoft Entra role that can register applications — Microsoft names Application Administrator — plus a role that can grant tenant-wide admin consent. Because WindowsDefenderATP is not Microsoft Graph, Application Administrator, Cloud Application Administrator or Privileged Role Administrator can all grant consent for this app.

Start in DSALTA

Open Integrations in the DSALTA sidebar, find Microsoft Defender, and click Connect to open the connect panel. Leave it open — it lists every value you need, and you create those in the steps below.

Integrating Microsoft Defender means

DSALTA will read your Defender for Endpoint vulnerabilities for security compliance. Read-only.

Azure Portal → App registrations → New registration.
Name: any label (e.g. DSALTA Defender) — this is just a display name.
Supported account types: Single tenant (Accounts in this organizational directory only).
Redirect URI: leave it empty (app-only access, no user sign-in), then click Register.
Open API permissions → Add a permission → APIs my organization uses → WindowsDefenderATP → Application permissions, check Vulnerability.Read.All, then Add.
Click Grant admin consent for your tenant (the permission status must turn green).
Open Certificates & secrets → New client secret → copy the secret Value immediately (shown only once — not the Secret ID).
From the app Overview, copy the Directory (tenant) ID and Application (client) ID.

Your tenant needs Microsoft Defender Vulnerability Management for this data to exist: it ships as core capability in Defender for Endpoint Plan 2, or as the Defender Vulnerability Management add-on or standalone subscription. On Defender for Endpoint Plan 1 or Defender for Business there is no vulnerability data to read, and because DSALTA only verifies the token when you connect, the integration will still report Connected while the Vulnerabilities page stays empty.

Set the client secret’s expiration deliberately and put the renewal in your calendar. Every Entra client secret expires; when it does the Defender sync starts failing with an authentication error, and DSALTA has no Reconnect button — the only repair is Disconnect and connect again, which permanently deletes the vulnerability evidence and test results already collected from Defender.

Enter your credentials

Paste the tenant ID, client ID and secret, then click Connect.

DSALTA validates the credential when you click Connect. On success the integration moves to the Connected tab, and Manage → Status reads Connected and working properly. Checks begin reporting after the first sync.

If the connection is rejected. Invalid credentials — the tenant ID, client ID or client secret is wrong, or the secret has expired. DSALTA only tests the token exchange at this point, so a missing Vulnerability.Read.All permission or ungranted admin consent will not be rejected here; it shows up afterwards as an empty Vulnerabilities page.The on-screen message is generic — see Connection error messages.

These checks do not currently run. The Microsoft Defender integration collects vulnerability findings only — it does not execute automated compliance checks, and it does not read the device or user data the checks below would need. The checks are defined but produce no result while this is the case. Use the Vulnerabilities page for the evidence this integration does provide.

The checks below are defined for Microsoft Defender but are not currently executed. Click any check for step-by-step remediation guidance.

Check	Severity	What it verifies
Device encryption should be enabled	Medium	Checks that disk encryption is enabled on all devices managed by Microsoft Defender.
Screen lock should be enabled on devices	Medium	Checks that screen lock is enabled on all devices managed by Microsoft Defender.
OS should be up to date	Medium	Checks that the OS is up to date on all Defender-managed devices.
User access to Critical System should be valid	Info	Checks that users with access to critical systems are authorized in Microsoft Defender.

Topic	Link
Setup	Microsoft — Create an app to access Defender for Endpoint without a user
Setup	Microsoft — Get all vulnerabilities (API reference)
General	Microsoft Defender website
DSALTA	Connection error messages

Getting Connected

Identity Providers

Cloud Infrastructure

Code Repositories

Security & Monitoring

Databases

SaaS & Productivity

What DSALTA reads

Troubleshooting

​What DSALTA reads

​Troubleshooting

What DSALTA reads

Troubleshooting