# Microsoft Defender for Endpoint

The Defender for Endpoint connector brings the devices Defender for Endpoint
manages, and the security alerts it raises, into Mesh. It can also find the AI
tools running across those devices: you define advanced hunting searches, and
Mesh runs them on a schedule.

Each AI tool a search finds becomes an AI agent in your non-human identity
inventory. It is tied to the device it ran on and owned by the account that
ran it, so it is attributed to a person instead of sitting unattributed.

## What it collects

| What Mesh reads | What it includes | Becomes in Mesh |
| --- | --- | --- |
| **Machines** | Every device Defender for Endpoint manages: its name, last IP address, operating system and version, and health status | Devices |
| **Security alerts** | Each alert's title, severity and status | Entries of type **Device** in your non-human identity inventory, one per alert, carrying its severity and status |
| **Advanced hunting searches** | The results of the searches you define | AI agents, each tied to the device it was found on and owned by the account that ran it |

After the first collection, each run reads only the alerts that changed since
the run before.

Searches are optional. Leave them out and the connector still collects
machines and alerts.

> **note**
A search looks for the processes your devices actually ran, or the domains
they actually looked up. That is how it finds self-hosted tools, and tools
nobody registered, that no catalog lists. What a search finds depends on the
terms you give it and on the data Defender holds. See
[Define your searches](./set-up.md#step-5--define-your-searches).

## What you need before you start

| You need | Notes |
| --- | --- |
| An app registration in Microsoft Entra ID | Created by your Entra ID administrator, with the permissions below and a client secret |
| Your Entra ID tenant ID | A GUID, or your primary domain such as `contoso.onmicrosoft.com` |
| A Mesh administrator account | To add connectors |

### Permissions the app registration needs

Add these as **application** permissions, not delegated ones, then select
**Grant admin consent**.

| API | Permission | Needed for |
| --- | --- | --- |
| **WindowsDefenderATP** (under **APIs my organization uses**) | `Machine.Read.All` | Machines |
| **Microsoft Graph** | `SecurityAlert.Read.All` | Security alerts |
| **Microsoft Graph** | `ThreatHunting.Read.All` | Advanced hunting searches. Leave it out if you will not define searches |

Every permission above is read-only.

> **note**
Not every Defender for Endpoint plan includes advanced hunting. If you cannot
run advanced hunting queries in the Microsoft Defender portal, leave the
searches empty. The connector still collects machines and alerts.

> **tip**
Create an app registration for Mesh rather than reusing one that another tool
depends on. You can then rotate or revoke its secret without affecting
anything else.

## Set it up

| Step | What you do |
| --- | --- |
| **[Set up Defender for Endpoint](./set-up.md)** | Add the connector, enter your tenant ID and app registration, define any searches, and test the connection |

## How often it runs

The connector runs every hour by default.

## Government and sovereign clouds

The connector uses Microsoft's commercial cloud by default. If your tenant is
in a government or sovereign cloud, change the hosts under **Advanced** when
you set it up. See
[Government and sovereign clouds](./set-up.md#government-and-sovereign-clouds).