> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Microsoft Defender with OAuth 2.0 (Client Credentials) – StackOne Hub

> Link a Microsoft Defender account in the StackOne Hub using OAuth 2.0 (Client Credentials). End-user guide to authorize the integration and start using Microsoft Defender actions.

> [!WARNING]
>
> You need permission to register applications in Microsoft Entra ID, and a Global Administrator or Privileged Role Administrator must grant admin consent for the Microsoft Graph application permissions.

Select Actions to adjust the guideSome actions may require additional configuration in the provider to be accessible. Choose the actions you need and the guide will be updated.

Select all
Clear

ActionScope(s)

Loading actions...No actions match your search.

Dynamic Guide URL

Copy URL

Scopes Selected

<pre role="textbox" aria-readonly="true" tabIndex="0" />

Separator

Copy scopes

## Registering an application

Register an application in Microsoft Entra ID so StackOne can call the Microsoft Graph security API without a signed-in user.

**1. Sign in to Microsoft Entra**

Sign in to your [Microsoft Entra account](https://entra.microsoft.com).

<ul>
  <li>Navigate to **Entra ID** > **App registrations**.</li>
  <li>Click **New registration**.</li>
</ul>

![App registrations page with the New registration button highlighted](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2_client_credentials-config-new-registration.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=5e52b76b56dc8155d7556514f3d6e664)

**2. Register the application**

Complete the **Register an application** form.

<ul>
  <li>**Name**: `StackOne Integration`</li>
  <li>Under **Supported account types**, keep **Single tenant only**.</li>
  <li>Leave **Redirect URI (optional)** empty. Client credentials don't use a redirect.</li>
  <li>Click **Register**.</li>
</ul>

![Register an application form with the Name, Supported account types and Register button highlighted](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2_client_credentials-config-register-application.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=88d3647c41f6bf02804bf519d3bfc8e8)

**3. Copy the client and tenant IDs**

On the app's **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID**.

<ul>
  <li>Paste the **Application (client) ID** into the **Client ID** field in StackOne Hub.</li>
  <li>Paste the **Directory (tenant) ID** into the **Tenant ID** field in StackOne Hub.</li>
  <li>Format: both are GUIDs such as `00000000-0000-0000-0000-000000000000`</li>
</ul>

![App Overview page with the Application (client) ID and Directory (tenant) ID fields highlighted and their values blurred](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2_client_credentials-config-client-and-tenant-id.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=0f40a775773db49f157dc943d5764d10)

## Creating a client secret

The client secret is the password StackOne uses to request access tokens for the app.

**1. Open certificates and secrets**

In the app's left menu, click **Certificates & secrets**.

<ul>
  <li>Open the **Client secrets** tab.</li>
  <li>Click **New client secret**.</li>
</ul>

![Certificates & secrets page with the Client secrets tab and New client secret button highlighted](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2_client_credentials-config-new-client-secret.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=eb510ac851e147274eea9f283f7972e4)

**2. Add the client secret**

In the **Add a client secret** panel, enter a **Description** such as `StackOne Integration`.

<ul>
  <li>Choose an **Expires** period. You will need to create a new secret before it expires.</li>
  <li>Click **Add**.</li>
</ul>

![Add a client secret panel with the Description, Expires and Add controls highlighted](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2_client_credentials-config-add-client-secret.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=b6c1f673c18e8b9baa72fad3b1f31e19)

**3. Copy the secret value**

In the **Value** column, click the copy icon to copy the secret, and store it securely for use later.

<ul>
  <li>The secret **Value** is only displayed once and cannot be retrieved later. Copy the **Value**, not the **Secret ID**.</li>
  <li>Paste it into the **Client Secret** field in StackOne Hub.</li>
</ul>

![Client secrets list with the new secret's value blurred and its copy icon highlighted](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2_client_credentials-config-copy-client-secret.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=a7054b823430941f9852fe32eaef2cc8)

## Configuring API permissions

Grant the Microsoft Graph application permissions that the connector's actions use.

**1. Open API permissions**

In the app's left menu, click **API permissions**, then click **Add a permission**.

![API permissions page with the API permissions menu item and Add a permission button highlighted](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2_client_credentials-config-add-a-permission.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=1875e4e8542b2b117c3bfd14f4d3f352)

**2. Choose application permissions**

In the **Request API permissions** panel, click **Microsoft Graph**, then click **Application permissions**.

![Permission type selection with Application permissions highlighted](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2_client_credentials-config-application-permissions.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=140e890e8a5abcc2021e9ff87cce69ae)

**3. Select the permissions**

Enables actions: Create Alert Comment, Create Audit Log Query, Create Email Threat Submission, Create Incident Comment, Get Alert, Get Analyzed Email, Get Audit Log Query, Get Email Threat Submission, Get Incident, Get Threat Assessment Request, List Alerts, List Analyzed Emails, List Audit Log Queries, List Audit Log Records, List Email Threat Submissions, List Incidents, List Threat Assessment Requests, Remediate Analyzed Emails, Review Email Threat Submission, Run Hunting Query, Update Alert, Update Incident

Use **Search permissions** to find and check each permission your integration needs, then click **Add permissions**.

![Application permission search with a selected permission and the Add permissions button highlighted](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2_client_credentials-config-select-permissions.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=6eb0e8c338460278f99cc79ead1b8ce0)

<ul>
  <li>
    ThreatHunting.Read.All
  </li>

  <li>
    SecurityAlert.Read.All
  </li>

  <li>
    SecurityAlert.ReadWrite.All
  </li>

  <li>
    SecurityIncident.Read.All
  </li>

  <li>
    SecurityIncident.ReadWrite.All
  </li>

  <li>
    SecurityAnalyzedMessage.Read.All
  </li>

  <li>
    SecurityAnalyzedMessage.ReadWrite.All
  </li>

  <li>
    ThreatSubmission.Read.All
  </li>

  <li>
    ThreatSubmission.ReadWrite.All
  </li>

  <li>
    ThreatAssessment.Read.All
  </li>

  <li>
    AuditLogsQuery.Read.All
  </li>
</ul>

**4. Grant admin consent**

On the **API permissions** page, click **Grant admin consent for** your organization, then click **Yes** to confirm.

<ul>
  <li>Every permission's **Status** should show **Granted for** your organization.</li>
  <li>Application permissions only take effect after admin consent is granted.</li>
</ul>

![Configured permissions with every Status showing Granted for the organization](https://mintcdn.com/stackone-60/nimiyq0XAEe-rVPo/connectors/microsoftdefender/images/oauth2_client_credentials-config-grant-admin-consent.png?fit=max\&auto=format\&n=nimiyq0XAEe-rVPo\&q=85\&s=72b5d3dca21b3c0648c8cb280511b1fb)

## Linking the Account from the Hub

**1. Navigate to the Hub**

Use one of the three [Linking Account Methods](https://docs.stackone.com/connect/managing-connectors/linking-accounts.md) to access the Hub.

**2. Fill out the fields**

Fill out the following fields using details from your provider:

<ul>
  <li>**Tenant ID**</li>
  <li>**Client ID**</li>
  <li>**Client Secret**</li>
</ul>

**3. Connect**

<ul>
  <li>Click **Connect**</li>
  <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
  <li>Once authorization is successful, you will see a confirmation popup</li>
</ul>

If the account linking is successful, you will see the newly linked account on your [Accounts](https://app.stackone.com/accounts) page.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.