How DSALTA integrates with Microsoft Defender for Endpoint — data collected, setup guide, and automated compliance checks.
Overview
How to connect
Automated checks
Useful links
DSALTA connects to Microsoft Defender for Endpoint using read-only API access to collect compliance evidence automatically. Data feeds into your Data Library modules.
Read-only access. DSALTA never modifies, creates, or deletes resources in your Microsoft Defender for Endpoint environment.
DSALTA collects this integration’s data when you connect it — you can refresh it at any time with Sync from integrations on the Integrations page. The compliance checks below re-run once a day at 02:00 America/New_York.
DSALTA reads the organization-wide vulnerability (CVE) list that Microsoft Defender Vulnerability Management produces, which appears on your Vulnerabilities page. Each row is one CVE affecting your organization, recorded against the integration as a whole — Defender’s /api/vulnerabilities response is a per-CVE summary and does not name the affected devices, so DSALTA cannot attribute a finding to an individual endpoint. This integration does not collect a user roster or a device roster.It calls these Microsoft Defender for Endpoint endpoints:
/api/vulnerabilities
Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Microsoft Defender for Endpoint environment.
There is no Reconnect button. Open Integrations → Connected, click Manage on the Microsoft Defender for Endpoint card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from Microsoft Defender for Endpoint. This usually happens when API tokens expire.
Data is not syncing
Verify the connected account still holds the permissions this integration requires. Then open Integrations in the DSALTA sidebar, stay on the Connected tab, and click Sync from integrations at the top right. That button refreshes every connected integration at once — there is no per-integration sync control.
Register an Azure AD app with Defender for Endpoint API permissions and paste its credentials.Before you begin
A Microsoft Entra role that can register applications — Microsoft names Application Administrator — plus a role that can grant tenant-wide admin consent. Because WindowsDefenderATP is not Microsoft Graph, Application Administrator, Cloud Application Administrator or Privileged Role Administrator can all grant consent for this app.
1
Start in DSALTA
Open Integrations in the DSALTA sidebar, find Microsoft Defender, and click Connect to open the connect panel. Leave it open — it lists every value you need, and you create those in the steps below.
2
Integrating Microsoft Defender means
DSALTA will read your Defender for Endpoint vulnerabilities for security compliance. Read-only.
3
Register an Azure AD app
Azure Portal → App registrations → New registration.
Name: any label (e.g. DSALTA Defender) — this is just a display name.
Supported account types:Single tenant (Accounts in this organizational directory only).
Redirect URI: leave it empty (app-only access, no user sign-in), then click Register.
Open API permissions → Add a permission → APIs my organization uses → WindowsDefenderATP → Application permissions, check Vulnerability.Read.All, then Add.
Click Grant admin consent for your tenant (the permission status must turn green).
Open Certificates & secrets → New client secret → copy the secret Value immediately (shown only once — not the Secret ID).
From the app Overview, copy the Directory (tenant) ID and Application (client) ID.
Your tenant needs Microsoft Defender Vulnerability Management for this data to exist: it ships as core capability in Defender for Endpoint Plan 2, or as the Defender Vulnerability Management add-on or standalone subscription. On Defender for Endpoint Plan 1 or Defender for Business there is no vulnerability data to read, and because DSALTA only verifies the token when you connect, the integration will still report Connected while the Vulnerabilities page stays empty.
Set the client secret’s expiration deliberately and put the renewal in your calendar. Every Entra client secret expires; when it does the Defender sync starts failing with an authentication error, and DSALTA has no Reconnect button — the only repair is Disconnect and connect again, which permanently deletes the vulnerability evidence and test results already collected from Defender.
4
Enter your credentials
Paste the tenant ID, client ID and secret, then click Connect.
DSALTA validates the credential when you click Connect. On success the integration moves to the Connected tab, and Manage → Status reads Connected and working properly. Checks begin reporting after the first sync.
If the connection is rejected. Invalid credentials — the tenant ID, client ID or client secret is wrong, or the secret has expired. DSALTA only tests the token exchange at this point, so a missing Vulnerability.Read.All permission or ungranted admin consent will not be rejected here; it shows up afterwards as an empty Vulnerabilities page.The on-screen message is generic — see Connection error messages.
These checks do not currently run. The Microsoft Defender integration collects vulnerability findings only — it does not execute automated compliance checks, and it does not read the device or user data the checks below would need. The checks are defined but produce no result while this is the case. Use the Vulnerabilities page for the evidence this integration does provide.
The checks below are defined for Microsoft Defender but are not currently executed. Click any check for step-by-step remediation guidance.
.png?fit=max&auto=format&n=tsMQJyneJ1xquFUo&q=85&s=4d401cc03b547d99b6f75a6bd170c334)