> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Defender OAuth 2.0 connector profile – StackOne setup guide

> Set up the OAuth 2.0 connector profile for Microsoft Defender in StackOne. One-time admin setup required before your users can link Microsoft Defender accounts via Hub.

> [!WARNING]
>
> You need permission to register applications in Microsoft Entra ID, and a Global Administrator or Privileged Role Administrator must grant admin consent for the Microsoft Graph security permissions.

Select Actions to adjust the guideSome actions may require additional configuration in the provider to be accessible. Choose the actions you need and the guide will be updated.

Select all
Clear

ActionScope(s)

Loading actions...No actions match your search.

Dynamic Guide URL

Copy URL

Scopes Selected

<pre role="textbox" aria-readonly="true" tabIndex="0" />

Separator

Copy scopes

## Registering an application

Register an application in Microsoft Entra ID so StackOne can sign users in with OAuth 2.0 and call the Microsoft Graph security API.

**1. Sign in to Microsoft Entra**

Sign in to your [Microsoft Entra account](https://entra.microsoft.com).

<ul>
  <li>Navigate to **Entra ID** > **App registrations**.</li>
  <li>Click **New registration**.</li>
</ul>

![App registrations page with the New registration button highlighted](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2-setup-new-registration.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=445ae7396ee1335552a609bd37f034b9)

**2. Register the application**

Complete the **Register an application** form.

<ul>
  <li>**Name**: `StackOne Integration`</li>
  <li>Under **Supported account types**, keep **Single tenant only**.</li>
  <li>Under **Redirect URI (optional)**, select **Web** and enter `https://api.stackone.com/connect/oauth2/microsoftdefender/callback`.</li>
  <li>Click **Register**.</li>
</ul>

![Register an application form with the Name, Supported account types, Redirect URI and Register button highlighted](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2-setup-register-application.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=0537023468e275e2b7874fb314d9c20d)

**3. Copy the client ID**

On the app's **Overview** page, copy the **Application (client) ID**. This is the public identifier of your app.

<ul>
  <li>Paste it into the **Client ID** field in the StackOne Connector profile.</li>
</ul>

![App Overview page with the Application (client) ID and Directory (tenant) ID fields highlighted and their values blurred](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2-setup-client-id.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=02d7db0b7fc53516500615b71ec918e8)

## Creating a client secret

The client secret is the password StackOne uses to exchange authorization codes for tokens.

**1. Open certificates and secrets**

In the app's left menu, click **Certificates & secrets**.

<ul>
  <li>Open the **Client secrets** tab.</li>
  <li>Click **New client secret**.</li>
</ul>

![Certificates & secrets page with the Client secrets tab and New client secret button highlighted](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2-setup-new-client-secret.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=fd51084dcf5178ea723cfd889c8141ff)

**2. Add the client secret**

In the **Add a client secret** panel, enter a **Description** such as `StackOne Integration`.

<ul>
  <li>Choose an **Expires** period. You will need to create a new secret before it expires.</li>
  <li>Click **Add**.</li>
</ul>

![Add a client secret panel with the Description, Expires and Add controls highlighted](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2-setup-add-client-secret.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=f74657f41a5a707575cd96743d89219d)

**3. Copy the secret value**

In the **Value** column, click the copy icon to copy the secret, and store it securely for use later.

<ul>
  <li>The secret **Value** is only displayed once and cannot be retrieved later. Copy the **Value**, not the **Secret ID**.</li>
  <li>Paste it into the **Client Secret** field in the StackOne Connector profile.</li>
</ul>

![Client secrets list with the new secret's value blurred and its copy icon highlighted](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2-setup-copy-client-secret.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=3b8aa59c196e472917f93e0fd87c3dcf)

## Configuring API permissions

Grant the Microsoft Graph delegated permissions that the connector's actions use.

**1. Open API permissions**

In the app's left menu, click **API permissions**, then click **Add a permission**.

![API permissions page with the API permissions menu item and Add a permission button highlighted](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2-setup-add-a-permission.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=414afd64590708c7cf6e1320a2f03e49)

**2. Select Microsoft Graph**

In the **Request API permissions** panel, under **Commonly used Microsoft APIs**, click **Microsoft Graph**.

![Request API permissions panel with the Microsoft Graph tile highlighted](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2-setup-microsoft-graph.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=057aaa34dc9b7ddec27fa764ee9ee8b2)

**3. Choose delegated permissions**

Click **Delegated permissions**. StackOne calls Microsoft Graph on behalf of the signed-in user.

![Permission type selection with Delegated permissions highlighted](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2-setup-delegated-permissions.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=20022035261db4f32557b2d64631e82a)

**4. Select the permissions**

Enables actions: Create Alert Comment, Create Audit Log Query, Create Email Threat Submission, Create Incident Comment, Create Threat Assessment Request, Get Alert, Get Audit Log Query, Get Email Threat Submission, Get Incident, Get Threat Assessment Request, List Alerts, List Audit Log Queries, List Audit Log Records, List Email Threat Submissions, List Incidents, List Threat Assessment Requests, Review Email Threat Submission, Run Hunting Query, Update Alert, Update Incident

Use **Search permissions** to find and check each permission your integration needs, then click **Add permissions**. Also add `offline_access` so StackOne can refresh tokens.

![Delegated permission search with a selected permission and the Add permissions button highlighted](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2-setup-select-permissions.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=1df7e431bb1e63fb03ce0a923d280ac9)

<ul>
  <li>
    ThreatHunting.Read.All
  </li>

  <li>
    SecurityAlert.Read.All
  </li>

  <li>
    SecurityAlert.ReadWrite.All
  </li>

  <li>
    SecurityIncident.Read.All
  </li>

  <li>
    SecurityIncident.ReadWrite.All
  </li>

  <li>
    ThreatSubmission.Read
  </li>

  <li>
    ThreatSubmission.ReadWrite
  </li>

  <li>
    ThreatSubmission.ReadWrite.All
  </li>

  <li>
    ThreatAssessment.ReadWrite.All
  </li>

  <li>
    AuditLogsQuery.Read.All
  </li>
</ul>

**5. Grant admin consent**

On the **API permissions** page, click **Grant admin consent for** your organization, then click **Yes** to confirm.

<ul>
  <li>Every permission's **Status** should show **Granted for** your organization.</li>
  <li>Optionally, enter the scopes you granted, separated by spaces and including `offline_access`, in the **Scopes** field in the StackOne Connector profile. Leave it empty to use `https://graph.microsoft.com/.default offline_access`.</li>
  <li>Users who connect also need a Microsoft Entra role such as Security Reader for read actions, or Security Operator for updates and comments.</li>
</ul>

![API permissions page with the Grant admin consent button highlighted](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2-setup-grant-admin-consent.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=573a6e16aae24dab09e20f70fe07a524)

## Creating the StackOne Connector Profile

To create the Connector Profile in StackOne for **Microsoft Defender**:

**1. Open the connector**

Log in to StackOne, open [Connectors](https://app.stackone.com/connectors), and select **Microsoft Defender**.

**2. Choose actions and events**

<ul>
  <li>Click **Add Profile**.</li>
  <li>If the connector offers more than one authentication method, set the **Auth Method** filter to **OAuth 2.0**.</li>
  <li>Select the actions, and any events, to enable for this Connector Profile.</li>
  <li>Click **Continue**.</li>
</ul>

**3. Set up authentication**

<ul>
  <li>Select **Authentication Type** as **OAuth 2.0**.</li>

  <li>
    Fill out the fields using details retrieved from your provider:

    <ul>
      <li>**Client ID**</li>
      <li>**Client Secret**</li>
      <li>**Scopes** (Optional)</li>
    </ul>
  </li>

  <li>Click **Create Profile**.</li>
</ul>

Congratulations! The new Connector Profile now shows up on the connector page. If you created it as a project member rather than an admin, it starts disabled until a project admin enables it. You can now continue to [Link Accounts](https://docs.stackone.com/connect/managing-connectors/linking-accounts.md) for **Microsoft Defender**.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.