Skip to main content
You need permission to register applications in Microsoft Entra ID, and a Global Administrator or Privileged Role Administrator must grant admin consent for the Microsoft Graph security permissions.

​
Registering an application

Register an application in Microsoft Entra ID so StackOne can sign users in with OAuth 2.0 and call the Microsoft Graph security API.

1

Sign in to Microsoft Entra

Sign in to your Microsoft Entra account.

  • Navigate to Entra ID > App registrations.
  • Click New registration.
App registrations page with the New registration button highlighted
2

Register the application

Complete the Register an application form.

  • Name: StackOne Integration
  • Under Supported account types, keep Single tenant only.
  • Under Redirect URI (optional), select Web and enter https://api.stackone.com/connect/oauth2/microsoftdefender/callback.
  • Click Register.
Register an application form with the Name, Supported account types, Redirect URI and Register button highlighted
3

Copy the client ID

On the app’s Overview page, copy the Application (client) ID. This is the public identifier of your app.

  • Paste it into the Client ID field in the StackOne Connector profile.
App Overview page with the Application (client) ID and Directory (tenant) ID fields highlighted and their values blurred

​
Creating a client secret

The client secret is the password StackOne uses to exchange authorization codes for tokens.

1

Open certificates and secrets

In the app’s left menu, click Certificates & secrets.

  • Open the Client secrets tab.
  • Click New client secret.
Certificates & secrets page with the Client secrets tab and New client secret button highlighted
2

Add the client secret

In the Add a client secret panel, enter a Description such as StackOne Integration.

  • Choose an Expires period. You will need to create a new secret before it expires.
  • Click Add.
Add a client secret panel with the Description, Expires and Add controls highlighted
3

Copy the secret value

In the Value column, click the copy icon to copy the secret, and store it securely for use later.

  • The secret Value is only displayed once and cannot be retrieved later. Copy the Value, not the Secret ID.
  • Paste it into the Client Secret field in the StackOne Connector profile.
Client secrets list with the new secret's value blurred and its copy icon highlighted

​
Configuring API permissions

Grant the Microsoft Graph delegated permissions that the connector’s actions use.

1

Open API permissions

In the app’s left menu, click API permissions, then click Add a permission.

API permissions page with the API permissions menu item and Add a permission button highlighted
2

Select Microsoft Graph

In the Request API permissions panel, under Commonly used Microsoft APIs, click Microsoft Graph.

Request API permissions panel with the Microsoft Graph tile highlighted
3

Choose delegated permissions

Click Delegated permissions. StackOne calls Microsoft Graph on behalf of the signed-in user.

Permission type selection with Delegated permissions highlighted
4

Select the permissions

Enables actions: Create Alert Comment, Create Audit Log Query, Create Email Threat Submission, Create Incident Comment, Create Threat Assessment Request, Get Alert, Get Audit Log Query, Get Email Threat Submission, Get Incident, Get Threat Assessment Request, List Alerts, List Audit Log Queries, List Audit Log Records, List Email Threat Submissions, List Incidents, List Threat Assessment Requests, Review Email Threat Submission, Run Hunting Query, Update Alert, Update Incident

Use Search permissions to find and check each permission your integration needs, then click Add permissions. Also add offline_access so StackOne can refresh tokens.

Delegated permission search with a selected permission and the Add permissions button highlighted
5

Grant admin consent

On the API permissions page, click Grant admin consent for your organization, then click Yes to confirm.

  • Every permission’s Status should show Granted for your organization.
  • Optionally, enter the scopes you granted, separated by spaces and including offline_access, in the Scopes field in the StackOne Connector profile. Leave it empty to use https://graph.microsoft.com/.default offline_access.
  • Users who connect also need a Microsoft Entra role such as Security Reader for read actions, or Security Operator for updates and comments.
API permissions page with the Grant admin consent button highlighted

​
Creating the StackOne Connector Profile

To create the Connector Profile in StackOne for Microsoft Defender:
1

Open the connector

Log in to StackOne, open Connectors, and select Microsoft Defender.
2

Choose actions and events

  • Click Add Profile.
  • If the connector offers more than one authentication method, set the Auth Method filter to OAuth 2.0.
  • Select the actions, and any events, to enable for this Connector Profile.
  • Click Continue.
3

Set up authentication

  • Select Authentication Type as OAuth 2.0.
  • Fill out the fields using details retrieved from your provider:
    • Client ID
    • Client Secret
    • Scopes (Optional)
  • Click Create Profile.
Congratulations! The new Connector Profile now shows up on the connector page. If you created it as a project member rather than an admin, it starts disabled until a project admin enables it. You can now continue to Link Accounts for Microsoft Defender.