Microsoft Defender for Endpoint

The Defender for Endpoint connector brings the devices Defender for Endpoint manages, and the security alerts it raises, into Mesh. It can also find the AI tools running across those devices: you define advanced hunting searches, and Mesh runs them on a schedule.

Each AI tool a search finds becomes an AI agent in your non-human identity inventory. It is tied to the device it ran on and owned by the account that ran it, so it is attributed to a person instead of sitting unattributed.

What it collects

What Mesh reads	What it includes	Becomes in Mesh
Machines	Every device Defender for Endpoint manages: its name, last IP address, operating system and version, and health status	Devices
Security alerts	Each alert's title, severity and status	Entries of type Device in your non-human identity inventory, one per alert, carrying its severity and status
Advanced hunting searches	The results of the searches you define	AI agents, each tied to the device it was found on and owned by the account that ran it

After the first collection, each run reads only the alerts that changed since the run before.

Searches are optional. Leave them out and the connector still collects machines and alerts.

Searches find what is running, not what is catalogued

A search looks for the processes your devices actually ran, or the domains they actually looked up. That is how it finds self-hosted tools, and tools nobody registered, that no catalog lists. What a search finds depends on the terms you give it and on the data Defender holds. See Define your searches.

What you need before you start

You need	Notes
An app registration in Microsoft Entra ID	Created by your Entra ID administrator, with the permissions below and a client secret
Your Entra ID tenant ID	A GUID, or your primary domain such as contoso.onmicrosoft.com
A Mesh administrator account	To add connectors

Permissions the app registration needs

Add these as application permissions, not delegated ones, then select Grant admin consent.

API	Permission	Needed for
WindowsDefenderATP (under APIs my organization uses)	Machine.Read.All	Machines
Microsoft Graph	SecurityAlert.Read.All	Security alerts
Microsoft Graph	ThreatHunting.Read.All	Advanced hunting searches. Leave it out if you will not define searches

Every permission above is read-only.

Advanced hunting depends on your Defender plan

Not every Defender for Endpoint plan includes advanced hunting. If you cannot run advanced hunting queries in the Microsoft Defender portal, leave the searches empty. The connector still collects machines and alerts.

Use a dedicated app registration

Create an app registration for Mesh rather than reusing one that another tool depends on. You can then rotate or revoke its secret without affecting anything else.

Set it up

Step	What you do
Set up Defender for Endpoint	Add the connector, enter your tenant ID and app registration, define any searches, and test the connection

How often it runs

The connector runs every hour by default.

Government and sovereign clouds

The connector uses Microsoft's commercial cloud by default. If your tenant is in a government or sovereign cloud, change the hosts under Advanced when you set it up. See Government and sovereign clouds.