> ## Documentation Index > Fetch the complete documentation index at: https://docs.stackone.com/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft Defender > How to set up the Microsoft Defender connector, plus the actions that are available. ![Microsoft Defender](https://stackone-logos.com/api/microsoft-defender/filled/svg) Betav0.1.0[See changelog](https://docs.stackone.com/connectors/microsoftdefender/changelog.md) [23 actions](#actions) · 2 auth methods ## Getting Started **1. Create or Select a Project** Set up a new project or select an existing one. See [Organizations & Projects](https://docs.stackone.com/gateway/concepts/organizations-and-projects.md). **2. Configure the Connector** Enable the connector and set up a Connector Profile in your project. See [Setup Connector Profile](https://docs.stackone.com/gateway/quickstart.md#setup-connector-profile). > [card] [Connector Profile · OAuth 2.0](https://docs.stackone.com/connectors/microsoftdefender/guides/connector-profile/oauth-2-0.md) > > Delegated access on behalf of a signed-in user, using an app registration in Microsoft Entra ID. The user also needs a M... > [card] [Connector Profile · OAuth 2.0 (Client Credentials)](https://docs.stackone.com/connectors/microsoftdefender/guides/connector-profile/oauth-2-0-client-credentials.md) > > App-only access without a signed-in user, using application permissions granted by an admin in Microsoft Entra ID. Canno... **3. Link an Account** Link an account [from the dashboard](https://docs.stackone.com/connect/managing-connectors/linking-accounts.md#link-from-the-dashboard) (or via [StackOne Hub](https://docs.stackone.com/embed/account-linking/overview)). See the guide for the authentication type chosen in the Connector Profile: > [card] [Link Account · OAuth 2.0](https://docs.stackone.com/connectors/microsoftdefender/guides/link-account/oauth-2-0.md) > [card] [Link Account · OAuth 2.0 (Client Credentials)](https://docs.stackone.com/connectors/microsoftdefender/guides/link-account/oauth-2-0-client-credentials.md) **4. Use Actions** Connect an AI platform to the linked account's actions. See [AI Platforms](https://docs.stackone.com/connect/ai-platforms/overview.md). Other ways to call actions are listed in [Protocols & SDKs](https://docs.stackone.com/connect/protocols-and-sdks.md). ## Actions Authentication type Select all | Clear OAuth 2.0 OAuth 2.0 (Client Credentials) No auth methods found Scopes Select all | Clear AuditLogsQuery.Read.All SecurityAlert.Read.All SecurityAlert.ReadWrite.All SecurityAnalyzedMessage.Read.All SecurityAnalyzedMessage.ReadWrite.All SecurityIncident.Read.All SecurityIncident.ReadWrite.All ThreatAssessment.Read.All ThreatAssessment.ReadWrite.All ThreatHunting.Read.All ThreatSubmission.Read ThreatSubmission.Read.All ThreatSubmission.ReadWrite ThreatSubmission.ReadWrite.All No scopes found 23 actions ActionDescriptionRequired scopes List Alerts`microsoftdefender_list_alerts` List security alerts raised by Microsoft Defender and integrated providers. `SecurityAlert.Read.All` Get Alert`microsoftdefender_get_alert` Get a single security alert by its ID, including evidence and the policy that generated it. `SecurityAlert.Read.All` Update Alert`microsoftdefender_update_alert` Update an alert's status, classification, determination, assignee or custom details. `SecurityAlert.ReadWrite.All` Create Alert Comment`microsoftdefender_create_alert_comment` Add a comment to an existing security alert. `SecurityAlert.ReadWrite.All` List Analyzed Emails`microsoftdefender_list_analyzed_emails` List emails analyzed by Microsoft Defender for Office 365 (Threat Explorer data) within a time window. `SecurityAnalyzedMessage.Read.All` Get Analyzed Email`microsoftdefender_get_analyzed_email` Get one email analyzed by Microsoft Defender for Office 365, including verdicts, policy actions, URLs and attachments. `SecurityAnalyzedMessage.Read.All` Remediate Analyzed Emails`microsoftdefender_remediate_analyzed_emails` Remove a threat from users' mailboxes by moving or deleting analyzed emails, or move false positives back to the inbox. `SecurityAnalyzedMessage.ReadWrite.All` List Audit Log Queries`microsoftdefender_list_audit_log_queries` List unified audit log queries created in the tenant and their status. `AuditLogsQuery.Read.All` Create Audit Log Query`microsoftdefender_create_audit_log_query` Start an asynchronous search of the Microsoft 365 unified audit log. `AuditLogsQuery.Read.All` Get Audit Log Query`microsoftdefender_get_audit_log_query` Get an audit log query and its current status. `AuditLogsQuery.Read.All` List Audit Log Records`microsoftdefender_list_audit_log_records` List the audit log records returned by a completed audit log query. `AuditLogsQuery.Read.All` List Email Threat Submissions`microsoftdefender_list_email_threat_submissions` List emails reported to Microsoft Defender for Office 365 as spam, phishing, malware or false positives. `ThreatSubmission.Read``ThreatSubmission.Read.All` Get Email Threat Submission`microsoftdefender_get_email_threat_submission` Get a single email threat submission and its rescan result. `ThreatSubmission.Read``ThreatSubmission.Read.All` Create Email Threat Submission`microsoftdefender_create_email_threat_submission` Submit a suspected spam, phishing or malware email, or a false positive, to Microsoft Defender for Office 365. `ThreatSubmission.ReadWrite``ThreatSubmission.ReadWrite.All` Review Email Threat Submission`microsoftdefender_review_email_threat_submission` Record an administrator's review verdict on a user-reported email threat submission. `ThreatSubmission.ReadWrite.All` Run Hunting Query`microsoftdefender_run_hunting_query` Run a Kusto (KQL) advanced hunting query over up to 30 days of Microsoft Defender data, including email events. `ThreatHunting.Read.All` List Incidents`microsoftdefender_list_incidents` List Microsoft Defender incidents that correlate related alerts into a single attack story. `SecurityIncident.Read.All` Get Incident`microsoftdefender_get_incident` Get a single Microsoft Defender incident by its ID. `SecurityIncident.Read.All` Update Incident`microsoftdefender_update_incident` Update an incident's status, assignee, classification, determination, severity or tags. `SecurityIncident.ReadWrite.All` Create Incident Comment`microsoftdefender_create_incident_comment` Add a comment to an existing Microsoft Defender incident. `SecurityIncident.ReadWrite.All` List Threat Assessment Requests`microsoftdefender_list_threat_assessment_requests` List threat assessment requests submitted to check how Microsoft's scanning judges mail, files or URLs. `ThreatAssessment.ReadWrite.All``ThreatAssessment.Read.All` Get Threat Assessment Request`microsoftdefender_get_threat_assessment_request` Get a threat assessment request, optionally expanding its policy check and rescan results. `ThreatAssessment.ReadWrite.All``ThreatAssessment.Read.All` Create Threat Assessment Request`microsoftdefender_create_threat_assessment_request` Submit a mail message, email file, file or URL for Microsoft to assess and report the policy result. `ThreatAssessment.ReadWrite.All` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.